Security framework integrates forensics and data auditing

AccessData announced the initial release of its new integrated security framework, CIRT (Cyber Intelligence and Response Technology), and is inviting select government and commercial clients to test drive the solution and provide feedback.

CIRT is the first solution to integrate network forensics, computer forensics and large-scale data auditing into a single interface. Designed for security and response teams, as well as information assurance teams, CIRT allows personnel to analyze what is happening across the enterprise from multiple vantage points.

CIRT enables cyber security personnel to proactively and reactively detect, analyze and remediate security threats in the most efficient manner by correlating network and host data within a single interface. Furthermore, it enables large-scale auditing and the correlation of network and host data, allowing organizations to quickly chase down and remediate classified spillage and files with embedded malware.

Currently, organizations must rely on a variety of disparate tools to respond to incidents, such as advanced persistent threats and classified data leakage. For example, in the case of an advanced persistent threat, the organization may or may not be alerted to the threat by its alerting technologies.

However, if an alerting system catches the incident, the organization must then chase down the malware by investigating both network traffic and data on individual computers across the enterprise. That traditionally requires the use of two or more different tools that do not integrate with each other. This lack of integration makes it extremely difficult to correlate the information and perform root cause analysis, in turn, making it next to impossible to identify all affected computers and thoroughly remediate the threat.

With regard to information assurance, data spillage is often discovered by accident, or in the case of Wikileaks, it is discovered after the classified information has found its way onto a website. Ideally, organizations should conduct regular automated audits of the enterprise to identify whether any documents or emails containing sensitive information have spilled onto an unsecure segment of the network.

Once sensitive content is discovered in unsecure locations, it is critical for an organization to be able to quickly determine root cause, how the spill propagated and how that content is leaving the organization’s enterprise. With an integrated view into computer data and network traffic, an information assurance team can more quickly determine whether a data leakage incident was a hack, an internal employee’s error or a malicious employee’s pet project.