PacketViper Deception Use Case

Deception-Based Threat Hunting, Detection & Response for OT/IT Networks

The Opportunity:

Level the cyber playing field with next generation deception technology.

Cyber threats regularly take a dynamic, deception-based approach to attacking organizations of all types. Attackers fool users with highly-believable tactics. Users reveal identity and confidential information as a result. Attackers pivot and morph their attack. Armed with new information, they sprawl through the network. Security teams counter with static defenses that repeatedly let them down. These headline events happen every day.

It is time for a different approach. PacketViper deception technology provides an active defense and counter-attack capability that is designed to identify suspicious behavior at wire speed and contain the threat so that practitioners can quickly remediate the incident. We use deception to fool the attackers by making the network difficult to see and hard to understand. Our patented technology allows users to proactively defend OT/ICS assets, remote OT endpoints, and IT infrastructures while eliminating the false-positive burden. PacketViper’s deception-enabled agentless detection, prevention, containment, and response technologies – Deception360™, IT360™, and OT360™ – automate threat hunting, attack detection, and attack prevention from both external and internal threats.Our solutions provide line operators with the deception-enforced contextual security data required to act while potential threats are still in motion, and before critical OT/ICS and IT assets are completely compromised.

Our flagship Deception solution - Deception360 - improves security and protects performance with active cyber deception everywhere in the network in all directions to improve threat prevention, detection, containment, and response. Deception360 automates deception-based attack defense from both known and unknown threats, internally and externally for every boundary. By utilizing agentless active deceptive elements that are easy to create and deploy, we solve the saturation, complexity, and believability problems inherent with most other deception technologies.

PacketViper’s highly differentiated and proven approach starts before attacks can penetrate the network, while complementing existing solutions like firewalls, NAC and SIEM, without risk to network performance and uptime like invasive agent-based and IT-centric solutions. Deception360 is far more cost-effective than traditional and overly complex deception tools in terms of solution fees and level of effort for personnel.

PacketViper Deception technology adds measurable value to organizations seeking to modernize security without a costly 'rip and replace'.

PacketViper Deception technology adds measurable value to organizations seeking to modernize security without a costly ‘rip and replace’. Traditional deception solutions only providing internal threat detection simply don’t provide enough results.

Deception supports multiple use cases to improve security and protect performance. These include:

Boundary defense & prevention
Threat detection
Threat hunting
Threat response
Active containment

Deception360. Addressing network noise - a root-case problem

Deception360 with multi-context filtering at the boundary simply and intuitively reduces traffic volumes up to 70%. This is accomplished through significant reductions in unwanted, unneeded, and illegitimate global IP traffic with no false-positive impact. All these capabilities vastly improve the threat identification process, eliminate false positives, and reduce noise-level alerting to security and operations teams, while also reducing events and logs that inflate SIEM costs. All at wire speed.

Small team & Service Provider friendly - Deception as a service

The Deception360 solution is also designed with service providers in mind who are seeking to offer high-value outcome-based solutions. With physical and virtual deployment options, MSSPs can configure deployments virtually in the cloud, or on appliances in their datacenter. Deception as a Service allows organizations to gain all the benefits of enterprise-wide deception without managing it themselves, while having sensors, deceptive transmitters, deceptive responders (commonly referred to as decoys), and policies configured specifically for them.