Most organizations today realize that it’s not a matter of if, but when, they’ll be the target of a disruptive, costly, and potentially, ruinous, cyberattack.
And when it does happen, they want their security teams to contain and remediate the threat quickly. To do that, security operations professionals need to identify the compromised host, know what other devices are connected to that compromised host, and understand the traffic patterns between all of those objects.
However, security teams can’t move fast if they need to sift through spreadsheets, request information from network operations, and engage in other time-consuming processes to answer critical questions such as: What are all the possible paths attackers can take from the compromised host? What ports can they access? What objects are along these paths, and what do those devices touch? Is it possible for the attackers to move laterally in the network to reach critical systems or exfiltrate data to the internet?
Security teams need access to actionable information about everything in the network—where devices are located, how they
interact, and all relevant details about their configuration and state.
Ideally, they will also have the ability to not only isolate devices and
cut off paths after an attack, but also prevent hosts from being
vulnerable to attackers in the first place at their fingertips.
