Hello, this is Eric Chabro, Information Security Media Group. I'm with Mark Seward, Vice President of Marketing, and Examine, welcome, Mark. Thanks. Glad to be here.
So tell us about Examine. Well, Examine is a relatively new company in a sort of a brand new category called User Behavior Analytics. And what we're doing is we're looking at normal behavior of users. We're sort of fingerprinting that behavior.
And then looking for the divergence of what a normal employee would do versus what an attacker would do. So a normal employee, their objective is to create value for the business. The attacker's objective is to steal the value they create. So you can begin to look at the divergence of behavior and score all of the access behaviors and characteristics.
And when you get a score that's high enough, you know that Eric is not who he says he is. Somebody else has stolen his credentials and is impersonating him either directly or through malware inside the environment. What's driving this? Is there some kind of an insider?
Is it right occurring? The headlines. I mean, if you look at Paragraph 4 in nearly every story about a data breach, somewhere in there it'll say attacker got access to unauthorized access to data. And that's the number one sign that what happened was somebody's account was social engineered by somebody either phishing or texting or something like that.
So they went to a website that had malicious code on it, something like that, and they got infected. And the attacker is using that malware as a proxy using your credentials to access data and hopefully steal it. We hear a lot about analytics here at this conference. We're at the RSA conference.
What differentiates your product from others? Not only that we actually fingerprint the user's behavior, and we're taking sort of a different look than a typical security guy would take. Security guys don't start with what's normal. They typically start with what's abnormal.
And most of the time out of context. So we start with what's normal. We look at the identity of the user. We look at the behavior of the user, what systems they're touching, but we take the next two very important steps.
And the next two steps are, first of all, we keep state on the attacker and the credential use inside the organization. So just because you log in as Eric, doesn't necessarily mean that you're going to not switch accounts and try to access other systems. So we keep state on the identity and track all of those switches back to Eric. That's the first thing.
That's where the cyber trail kind of goes cold for forensic investigators. Oh, I lost the send of the trail because he switched credentials. The second thing we do, which is kind of unique, is we'll take security alerts that you have from certain sources, ones that are typically fairly trusted or highly reliable, like FireEye, or Fireamp, or Wildfire, some of those kinds of things. And we'll associate that back to an anomalous user session by asking who had an open session on that device that FireEye had an alert about.
And then we assign that to the credential, to that particular user session. And we'll give points for that as well. And that'll be part of your overall point total. And so it's kind of an upside down look at security events.
We're not taking all of the stuff that's happening in the environment. We're only looking for unusual credential behaviors and then associating alerts to that wherever we can. And who is getting these alerts? Who within the organization?
What kind of jobs? Are there systems that we're going to destroy? Yeah, it's interesting because we're defining some efficiencies within the security operations teams that are kind of interesting. And what we do with the anomalous user sessions is put those up on the SOC wall.
And we say, anybody that has a session over 100, then you pick up the phone, you call them. And you have a credit card fraud kind of phone call with them. You say, was that you using the VPN accessing these systems, switching credentials, and then logging out from Singapore? And the person, first of all, a person on the other and the phone is typically baffled that you know all that stuff.
But they'll say, oh, no, that wasn't me. And the SOC is instructed to say, OK, close your laptop. We're going to send that off to the forensics team so they can figure out exactly what's going on here. So we've taken a tier three activity trying to put together the story around a single event like a fire-riler and doing that in an automated fashion, relieving them of that kind of responsibility, and then taking that automated session and displaying it to the SOC and moving that down to their level.
So what you want to do is you want to have problems solved at the lowest, less expensive route possible, both from a time and money perspective. And we're doing that and creating that kind of efficiency in addition to exposing the attacker in the center of the attack chain, not at the initial compromise phase, not at DLP, but in the middle where the attacker spends most of their time. Thanks, Mark. You bet.
Thank you.