{"id":556,"date":"2016-08-24T17:17:16","date_gmt":"2016-08-25T00:17:16","guid":{"rendered":"https:\/\/www.acalvio.com\/?p=556"},"modified":"2016-08-24T17:17:16","modified_gmt":"2016-08-25T00:17:16","slug":"announcing-acalvios-deception-2-0","status":"publish","type":"post","link":"https:\/\/acalvio.p2staging.us\/index.php\/2016\/08\/24\/announcing-acalvios-deception-2-0\/","title":{"rendered":"Announcing Acalvio’s Deception 2.0"},"content":{"rendered":"

Hello!<\/span>
\nGreetings from Acalvio! B We are joining the fight to keep our enterprises safe from malicious activity. While the problem is old, our approach is new and innovative.. read on!<\/span>
\nThe IT industry has paralleled our traditional approach for defending physical assets b\u0000\u0013 build perimeter defenses. B Walls, moats, doors, locks, identification, etc. are the motivation for the perimeter defenses that the security industry has spent its energy on. B Lately, the advent of ubiquitous mobile connectivity, proliferation of cloud services, advent of IoT, B and the quickening pace of IT change has made it clear that we cannot entirely depend on perimeter defenses. <\/span>
\nFurthermore, if any of the recent highly publicized security breaches are any indication, malicious activity is rampant. Studies tell us intruders are often active within the enterprise for as much as 200 days before they successfully exfiltrate data. Clearly we need a defense mechanism that takes into account the fact that malicious activity has already breached the perimeter.<\/span>
\nWell, in the physical world, we solve this by using motion sensors inside our buildings. B These catch successful penetrations of our perimeter defenses.<\/span>
\nWe need Motion Sensors for our digital environments b\u0000\u0013 to protect IT, IoT and so on.<\/span>
\nHow do we build that?<\/span>
\nA natural instinct is to try to look for anomalies within the IT environment. Accomplishing this is a herculean task b\u0000\u0013 we need to collect lots of event and log data, establish what is normal, and then what is left must be abnormal. Doing this at scale, with low false positives, is a very challenging task. The best efforts here can only yield a set of exceptions – potentially lots of them b\u0000\u0013 and someone has to work through each of these to find the true anomalies. The effort it takes to sift through these b\u0000\u001cpotentialb\u0000\u001d alerts makes the exercise a rather futile one, and one quickly reaches the point of diminishing returns. Security Operations Centers are already inundated with signals. Sending more signals to process B is not the most desirable solution. <\/span>
\nThere must be a better way! Can we invert the problem? Can we have the anomaly announce itself?<\/span>
\nWell fortunately, there is a way. B Deception. B Nature (flora, fauna) has used deception very effectively for millions of years for survival and self-preservation. And humans have used it in warfare for thousands of years – since the days of Sun Tzu. <\/span>
\nThe first successful use of Deception in IT security that made an impression on me was by Cliff Stoll, an incredibly brilliant computer scientist at Lawrence Livermore National Lab, Berkeley in 1986, where Stoll used honey pots to trap Russian intruders. This has been depicted in dramatic detail in his book, Cuckoob\u0000\u0019s Egg<\/span>. B Since then, Deception (usually in the form of honeypots) has been used extensively to ensnare threats on the public internet. <\/span>
\nHowever, for corporate IT departments, Deception has seen application mainly in labs, and science experiments, and has not seen the light of the day in production scale deployments. B Why is this?<\/span>
\nSimply put, the first generation of deception technologies – which we call Deception 1.0 – were simply not designed for success in the corporate network. B Before the technology could be ready for widespread use, some key problems needed to be solved:<\/span>
\n1. Automation – DevOps B for Deception<\/span><\/strong>
\nTraditionally, the entire task of setting up, maintaining, and interpreting the results of honeypots fell on the administrator. B No tools existed to automate these complex tasks.<\/span>
\n2.B Authentic or forget it<\/strong><\/span>
\nOne of the age-old dictums is for spies to be able to blend into the territory they serve for them to be effective. The same is true here, decoys or deceptions need to be authentic and need to blend very naturally.<\/span>
\n3. Staleness is the enemy of Deception. <\/strong><\/span>
\nOne thing we need to remember b\u0000\u0013 attackers have no penalty for retrying. We can count on them doing that. B The consequence of this is that, over several attempts, attackers can map out all the Deceptions that are hosted within an enterprise. If they arenb\u0000\u0019t changing, from then on the Deceptions are relics b\u0000\u0013 they will be avoided. <\/span>
\n4. Scale and Density are critical<\/strong><\/span>
\nThe historic difficulties deploying deceptions means they are normally deployed in small numbers, limiting their effectiveness.<\/span>
\nTo summarize, Deception 1.0 solutions established the potential. In order for them to be effective in Enterprise scale deployments, it needs to address the above systemic areas. This is precisely what we at Acalvio are doing with our Deception 2.0 solution. <\/span>
\nCalvio in Latin means Deception. At Acalvio, we are focused at delivering Active Deception solutions to address the needs of Advanced Threat Defense. <\/span>
\nWe are excited to be launching innovative products based on patented technologies that can deliver timely and effective detection, are cost effective, and can be deployed at DevOps scale.<\/span>
\nI would like to thank you for your interest in Acalvio. Check back here, where I will keep you briefed of key developments on our front.<\/span>
\nThank you.<\/span>
\nRam, co-founder, CEO<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Hello! Greetings from Acalvio! B We are joining the fight to keep our enterprises safe from malicious activity. While the problem is old, our approach is new and innovative.. read on! The IT industry has paralleled our traditional approach for defending physical assets b\u0013 build perimeter defenses. B Walls, moats, doors, locks, identification, etc. are […]<\/p>\n","protected":false},"author":2,"featured_media":566,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"_links":{"self":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts\/556"}],"collection":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/comments?post=556"}],"version-history":[{"count":0,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts\/556\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/media\/566"}],"wp:attachment":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/media?parent=556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/categories?post=556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/tags?post=556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}