Arbor Networks introduces Pravail® Security Analytics

“Arbor is able to offer enterprise security teams the richest set of data regarding the activities happening on their network. Pravail Security Analytics is a powerful solution that will allow our customers to see attacks on their global networks faster and in more detail than seen before. We’re focused on bringing meaningful context to massive amounts of data so that security teams can focus on the critical few, react faster and identify the threats lurking within their network environment before they impact the business,” said Arbor Networks President Matthew Moynahan.

Global Attack Intelligence for Local Protection
The attack intelligence that keeps Pravail Security Analytics at the cutting edge of network security comes from Arbor’s ATLAS® Active Threat Level Analysis System. ATLAS is a collaboration with nearly 300 service providers who share anonymous data with Arbor, up to 70TB/sec of global Internet traffic. This collective view delivers globally scoped insight into the attack landscape. This data set is analysed by Arbor’s security research team who then develops detection methodologies; and creates fingerprints that identify threats and malicious activity occurring within the enterprise.

Reveal Attacks Hidden within Your Global Network
Today’s breed of attacker is not looking to be a short-term and visible nuisance. They use stealthy and sophisticated methods to penetrate an organisation’s perimeter and the indicators of compromise are often impossible to identify before it’s too late. In order to really understand subtle, advanced targeted attacks, enterprises need a complete record of all network traffic. By analysing data very quickly, Pravail Security Analytics can be used for real-time attack response decisions, and by storing the data for future reviews, it can be looped to identify previously undetected attacks using the latest threat intelligence.

Rapid Deployment, On-Premise or In the Cloud
Pravail Security Analytics uses big data technologies that lower the barrier to entry for organisations looking to deploy and operate world-class security analytics. An organisation can securely upload packet captures to Pravail Security Analytics in the Cloud and be analysing their data within minutes of a threat being identified. For organisations that cannot upload their packet captures for compliance or regulatory reasons, Pravail Security Analytics can also be deployed as an on-premise solution using distributed Collector appliances. The Collector appliances can be used to scale out storage or processing capabilities for high speed capture points, or for deployment into multiple locations to provide distributed coverage. Most importantly, the Collector appliances operate in real-time, streaming the security analytics data to the Controller for analysis with virtually no delay. This means security analysts can track attacks live, as they happen, or perform post hoc analysis with stored and uploaded packet captures.

By using Controllers and Collectors, Pravail Security Analytics can support three flexible deployment architectures:
· Pravail Security Analytics Cloud - where the Controller is the Pravail Security Analytics cloud platform. Data is uploaded in the form of packet captures and processed in the cloud.
· On-Premise Collector to Cloud Controller - A collector is deployed on your network and processes real-time network streams. The results are encrypted and streamed to the cloud where they are analysed.
· On-Premise Collector to On-Premise Controller - in this model nothing leaves your network. Data is collected and processed within your network and streamed to a Controller within your network.

The technology in the Collectors can scale to meet network speeds, length of packet capture retention (for looping) and real-time processing speed. This means that full real-time functionality of Pravail Security Analytics is available for network speeds in excess of 10Gbps. Big Data Security Analytics on a grand scale. Collectors are available in multiple physical appliance form factors as well as Virtual Machines. Controllers can also be scaled but aren’t as heavily utilised as Collectors. They store all the metadata and make it available for analysis and can scale to support decades of processed data. At this time Controllers are only available in a physical appliance or of course by leveraging the cloud platform.

A production demonstration of the Cloud solution is available that leverages pre-existing data sets. This enables the user to test drive the solution and see its powerful capabilities firsthand. A free trial of the Cloud solution is also available, enabling users to quickly analyse their own network packet captures for threats, anomalies and misuse. The free trial allows users to upload up to 1GB of their data for thirty days.

General availability of the Pravail Security Analytics on-premise Collector solution is planned for April 30, 2014.

“Organisations are looking for solutions that help them deal with the problem of advanced threats hidden within their networks," said John Grady, research manager for Security Products at IDC. "Arbor’s Pravail Security Analytics is a powerful platform for the security analyst, processing huge amounts of data and providing actionable intelligence through intuitive visualizations that reveal threats in both real-time and historical data sets. Arbor now has a unique combination of NetFlow, packet capture and global threat intelligence from their ATLAS infrastructure to address today's dynamic threats that evade signature-based solutions.”