SCIT Labs Company

The Digital Vacine

Current experience suggests that intrusions of Information Technology systems are inevitable. Further, the human intervention needed to support alert analysis and configuration management is huge.

 Detecting a system breach is difficult – approximately 70% of the intrusions are detected because of external parties. To improve the chances of prevention and detection, a defense in depth approach is used. In some installation more than 10 layers are employed. NSS Labs4 published “Correlation of Detection Failures” report on the effectiveness of the layered security approach. To undertake this test, NSS selected 1711 exploits; 37 security products from24 vendor including 16 IPS, 8 next generation firewalls, and 13 endpoint production products. No single product detected all exploits, and only 3% of the 606 combinations of two security products detected all the exploits.

SCIT Labs has developed software for an early warning system that provides an alert based on post exploit detection. Our approach does not require signatures or other a priori information of the attacker; we do not need to know the vulnerability being exploited; we can highlight repeat attempts at compromising servers. The IT Early Warning System (ITEWS) approach is deterministic in comparison to reactive systems in which incorrect predictions lead to false positives.