April 2017 Digital Edition

Click Here

March 2017 Digital Edition

Click Here

Feb. 2017 Digital Edition

Click Here

January 2017 Digital Edition

Click Here

Nov/Dec 2016 Digital Edition

Click Here

Oct 2016 Digital Edition

Click Here

Technology Sectors

Market Sectors

Using forensics tools to achieve total security intelligence

Karl Klaessig

In today’s connected world, government agencies face network attacks on a daily basis – from government-sanctioned espionage to serious international cyber thieves trying to gather intelligence, to amateur hackers playing around on their computers and trying to break in for ‘sport.’  Whatever the source, government networks are under attack and there have been numerous reports of data breaches of government systems, leaving officials scrambling to figure out how they got in, how long they accessed the network and what they were able to view or take during the breach.

Fortunately, the available computer forensics from security information and event management (SIEM) solutions enables users to view all activity in the chain of events that occurred leading up to the attack, as well as the breach itself. Next-generation SIEM technology provides an in-depth analysis of where the offender entered the network, where he/she went once they got in, and what they were able to see and take.

For instance, a state government customer was recently under attack by nation-state cyber criminals that were trying to steal water filtration schematics; the thieves failed because the customer had next-generation SIEM technology in place. Using the security intelligence – including all network activity, derived from next-gen SIEM technology – the government agency was able to detect that an unknown source outside of the network had successfully accessed the network and that unauthorized file transfers were about to take place. The agency used next-gen SIEM’s forensics capabilities to identify how the thieves gained access, and was able to not only stop the attack in its tracks, but to prevent such attacks in the future.

In another recent government deployment, a customer used SIEM to correlate millions of daily security events with network activity and reduced this massive amount of data down to 40 actionable incidents. As a result, security analyst teams reduced the time it takes to detect, isolate, and perform forensics of complex security threats from days to minutes.

But more importantly, Security Intelligence leveraging next-gen SIEM technology delivers complete threat context (assets, applications, users) for government agencies – before attacks occur – and  includes comprehensive forensics afterward, to simply, accurately, and thoroughly respond to incidents and assess impact.  Such solutions also provide the ability for agencies to identify threats, including insider fraud such as attempted transfer of intellectual property outside the agency.  By providing all associated network, asset vulnerability and identity context related to such incidents, next-gen SIEM technology provides comprehensive forensics for security and operations teams.


Karl Klaessig is the senior manager of industry marketing for the Federal division at Q1 Labs. He can be reached at [email protected].


Recent Videos

HID Global is opening the door to a new era of security and convenience.  Powered by Seos technology, the HID Mobile Access solution delivers a more secure and convenient way to open doors and gates, access networks and services, and make cashless payments using phones and other mobile devices. ...
Mobile device forensics can make a difference in many investigations, but you need training that teaches you how to get the most out of your mobile forensics hardware and software, and certifies you to testify in court. Read this white paper to learn how to evaluate mobile forensics training...
PureTech Systems is a software company that develops and markets PureActiv, its geospatial analytics solution designed to protect critical perimeters and infrastructure.  Its patented video analytics leverage thermal cameras, radars and other perimeter sensors to detect, geo-locate, classify, and...
PureTech Systems is a technology leader in the use of geospatial video, focusing on perimeter security.  When combining geospatial capabilities with video analytics and PTZ camera control, managers of critical facilities can benefit by allowing the video management system to aid them in the process...