• Enterprise Threat Mgmt
  • IPS
  • NBA
  • NAC
  • VA
• Compliance
• Vertical Industries

Sourcefire^® Network Behavior Analysis

Virtually every IT organization deploys one or more firewalls at the perimeter. And most organizations also implement an IDS or IPS to detect and/or block attacks that pass through the firewall. But with today’s mobile workforce, many exploits are literally hand-carried right through the front door, residing on laptops and other mobile devices. This leaves organizations vulnerable as well-intentioned employees and contractors unknowingly spread worms, trojans and other malware from one endpoint to another.

The foundation of Sourcefire’s NBA solution is the Sourcefire RNA (Real-time Network Awareness) product. Using RNA, Sourcefire customers can analyze custom network flows, create baselines of “normal” network traffic and detect network anomalies. A worm propagating from endpoint to endpoint can now be detected and quarantined in minutes, rather than hours or even days.

RNA can also “passively” detect operating systems, services and select applications used on the network, providing crucial endpoint and network intelligence leveraged by other Sourcefire ETM solutions. IT can then formulate network usage policies to help organizations achieve government and/or industry compliance.

In summary, the benefits of Sourcefire’s NBA solution include:

• Detect the spread of worms, trojans and other malware inside an organization through traffic baselining and network anomaly detection
• “Passively” collect endpoint and network intelligence to help IT make informed network security decisions
• Implement IT policies to help secure the network and aid in the achievement of government and/or industry regulatory compliance