The Attivo BOTsink Deception System

Deception and Decoy for Inside-the-Network Threat Detection

The Attivo BOTsink solution uses dynamic deception techniques and a matrix of distributed decoy systems to turn an entire network into a trap, which is designed to deceive and detect attackers and their automated tools into revealing themselves. Whether the attack vector is zero day, stolen credential, ransomware, phishing or an insider threat, the BOTsink system provides an effective and efficient solution to detect these threats in real-time. Prevention-based detection does not reliably detect signature-less attacks, the use of stolen credentials, and the lateral movement of attacks that have bypassed firewall, anti-virus and other prevention solutions. Not reliant on known attack patterns or signatures, Attivo will instead use deception to deceive the attacker into engaging. Once the attacker engages, an alert is immediately created with the substantiated attack detail required to block the attacker and quarantine the infected device. The attack details can be viewed in the Attivo Threat Intelligence Dashboard, through a variety of reports, and can be automatically uploaded into 3rd party prevention solutions dramatically improving incident response.

Elements of the BOTsink

- Physical, virtual and cloud engagement servers provide the threat detection engine, a multi-dimensional correlation engine, and the analysis engine that allows the attack sequence to safely play out, allows viewing of lateral movement and can open communications with the Command and Control to better understand the attacker tools, methodologies, and intent.
- Decoys based on a wide variety of operating systems and services, which can also be golden image customized to match a customers production environment.
- Server and end-point deception lures combined with other deception techniques are used to deceive an attacker into engaging with the BOTsink system for detection.
- Central Manager provides global deployment and management of BOTsink devices and the aggregation of threat intelligence for all types of BOTsink devices.

Environments supported

- User networks, data centers, AWS, VMWare, SCADA
- Endpoint deceptions for Mac and PC
 

Certificate No.
SERTIT-084 C
Mutual Recognition
CCRA
Product
BOTsink appliances: Model 3200, Model 5100;
vBOTsink for Vmware Version 3.3,
ACM appliance Version 200;
Software: ACM Version 3.3,
BOTsink and Endpoint Version 3.3
Category
Network and Network-Related Devices and Systems
Developer
Attivo Networks, Inc.
Evaluation Facility
Advanced Data Security
Certification Date
Evaluation Level
EAL 2, ALC_FLR.1

Documents