Public Relations

Asgent Announces SecurityPlus “SecurityDoc”, a New Service to Proactively Detect and Address Security Incidents and Damage

June 10, 2015
Asgent, Inc.
(JASDAQ: 4288)

Asgent, Inc. (President & CEO: Takahiro Sugimoto, located in Chuo-ku, Tokyo), a pioneer in network security and operations management solutions, announces the start of SecurityPlus^※1 “SecurityDoc” service, a new spot service to proactively detect and address massive security incidents and damage in corporate and other organizations’ networks, before it becomes exposed.

【Background】

Corporations and organizations have traditionally put a lot of effort into devising protective measures for their networks to prevent invasion by cyber security threats, using security devices such as firewalls, IDS/IPS and sandbox appliances etc., along with SOC (Security Operation Center) monitoring.

【A Well-known Fact】

While strengthening of preventative measures will continue to be essential in the future, it is a well-known fact globally that these measures alone cannot 100% prevent intrusions, as is known from the security incidents being reported on a daily basis. To take an example, even if a preventative measure could block one million attacks, all it takes is one intrusion to create massive damage.

【Period of Latency until Attack】

Today’s threats do not cause damage immediately after invading the network. The significance of the attack only becomes greater the longer the threat remains dormant.

In the US alone, the average latency from invasion until attack is seven months, and the number of cases where an invaded party was informed of their invasion by a third party rises to 69%, according to reports.

【Early Detection/Coping Mechanism】

Therefore, the focus has shifted to deploying highly detailed systems to proactively detect and deal with hidden threats that passed through the preventative measures. By deploying such systems, it is possible to address security incidents and damage before they become exposed.

【SecurityPlus “SecurityDoc” Service】

In traditional security incidents (accidents), the corporation or organization would be faced with the task of determining the terminal involved the cause of the incident, extent of damage and initializing/recovering terminals or servers after they had already been hit with the attack.

The SecurityPlus “SecurityDoc” service provides an early detection and coping mechanism as a spot service. Using the highly detailed monitoring/analysis tool “DAMBALLA Failsafe”^※2 to determine if there is a latent threat in the corporation or organization network, a diagnosis of the incident before it becomes exposed and a guideline on how to deal with the issue are provided.

Just as humans receive periodic health check-ups from a human “doc”, so this service has been named “SecurityDoc” in the same vein.

This service is ideal for the following situations.

- As a periodic health check for network systems

- As part of information security auditing process in a corporation or organization

- As part of initial investigation into potential infection

- As part of ongoing prognosis follow-up after an incident has occurred

【Service Flow】

Asgent will deploy the DAMBALLA Failsafe appliance in the customer environment and receive and audit network traffic via a mirror port. Once suspicious activity has been detected, the activity on each terminal will be analyzed and an “investigation” will begin. As a result of the investigation, evidence to back up the determination (information on where was accessed, the access results and packet capture file etc.) will be collated and the terminal where the threat is hiding will be determined. Next, the infected content will be shown and guideline on how to deal with the issue will be provided.

The SecurityPlus “SecurityDoc” service will provide diagnostic results in one month of deployment. Because DAMBALLA Failsafe does not require a long period to learn the “behavior”, it is possible to detect dormant or latent threats immediately after beginning the service.

【Comments from DAMBALLA】

Yasuyuki Shinmen, the country manager for DAMBALLA, has the following comment regarding this service.

“We welcome Asgent, who has lead the internet security market for many years and has proactively provided advanced security services for many years, as they begin this new service that recognizes the unique value provided by the “DAMBALLA Assessment Service”, which has had success with many business partners including auditing firms in the US.”

※1 About SecurityPlus
The generic name for a group of services that provide the highest quality of security, including Asgent’s security knowhow gained over many years, at a reasonable price.
SecurityPlus provides all the necessary services that a company requires to maintain the highest level of security, including (1) Managed Security Services, (2) Security Diagnosis, (3) Forensic Security Investigations/Countermeasures, (4) ISMS and security audits, and countermeasures for (5) Social Engineering, which is common among all security breaches.

※2 About DAMBALLA Failsafe
An appliance product that uses eight highly advanced and detailed detection engines work to detect activity from latent threats and perform “profiling investigations” through correlation analysis to determine infected terminals. The detection capabilities are backed by constant analysis of passive DNS records that amount to almost thirty percent of global internet traffic and are continuously updated.
Also, the profiling investigative function that is the greatest characteristic of the product provides a high level of operability without over-detection or mis-detection. This functionality has resulted in DAMBALLA　FailSafe receiving the “2015 Red Herring 100” award in the US and the “2015 New Product Innovation Award” from Frost & Sullivan in Europe.
Asgent is the primary distributor for DAMBALLA Failsafe in Japan.

【Sales Target】

Start of Sales:: June 10^th, 2015
Sales Price:: 756,000 Yen～　(～500 Node environment/1 month of monitoring, tax excl.)
Sales Target:: 500 Million Yen/Initial Year

【Reference Material - Flow of Intrusion to Infection, Dormancy to Damage】

① File with hidden infected file arrives at user terminal

② User opens file and threat uses exploit to “infect” the terminal

③ Threat uses preprogrammed method to contact external “C&C Server”

④ Infected terminal falls under attackers control

⑤ Attacker commands threat to begin search for target confidential data

⑥ Terminal continues periodic communication with C&C server and search activities within the network system

⑦ Attacker finds the targeted data

⑧ Secondary malware is introduced to retrieve targeted data

⑨ Targeted data is retrieved

⑩ Evidence of threat activity is deleted (or modified)

* All company names or product names are registered trademarks of their respective companies.