NetWitness - Total Network Knowledge™


Products NextGen Overview Infrastructure Products Decoder Concentrator Broker Applications Informer Investigator SIEMLink API/SDK Tech-in-Depth InSight Live Freeware Solutions Overview By Challenge Incident Response Data Leakage Data Governance By Industry Financial Services Government Law Enforcement Protection of Customer Data Resources Overview Webcasts Press Releases In the News Events Company Management Team Board of Directors Careers Contact Us

Why InSight?

According to recent findings from IDC

“Two-thirds of loss cases involved data the organization did not know was present.”
“67% of regulated or sensitive data resides outside the data center.”
“Accidental exposure of PII accounts for more losses than stolen or lost hardware.”

Simply put, enterprises frequently fail in their information risk management practices because they are unable to maintain an awareness of where their sensitive data resides or how exposed it becomes once outside of the data center. NetWitness InSight changes that reality.

NetWitness InSight simplifies information risk management by combining data discovery, configuration analysis and vulnerability assessment in a single, easy-to-use solution. For the first time, public and private sector organizations can deploy one technology and obtain reliable risk metrics containing the locations of sensitive, regulated and proprietary information and the level of exposure to that data. InSight puts enterprises firmly in the know and removes the uncertainty and doubt from the IT risk equation.

InSight provides three critically important functions for public and private sector IT professionals.

Fast and accurate identification of sensitive, proprietary and regulated data on host systems
Assessment of the likelihood of exploitation of the systems on which critical data resides
Automate the prioritization and execution of risk remediation efforts on the most exposed critical data

InSight simplifies the process of IT risk evaluation and remediation through automated risk scoring and enabling centralized remediation functionality. InSight’s unique, patent-pending approach focuses the efforts of IT, security, compliance and audit staff on the data most at risk within the enterprise – aiding IT risk management, operational security, incident response, e-discovery and compliance activities.

How InSight Works:

Distributed, Automated and Extensible Data Discovery:

InSight’s unique data discovery engine quickly scours through systems (Windows, Linux and others) – whether client or server – identifying sensitive, proprietary and regulated information. InSight’s data discovery engine is faster and more accurate than other solutions available in the market, performing a level of structural file analysis unavailable in content management tools today. InSight even supports undefined file formats, providing an extensible technology platform that identifies the types and volumes and combinations of data elements across enterprise servers and workstations.

Assessment of Exposure

InSight concurrently assesses the likelihood of exploitation of the hosts it examines. To determine the security condition of the host, InSight combines five key assurance measures using industry standards and best practices.

Vulnerability Assessment – Evaluation of vulnerabilities present on the system using the Common Vulnerabilities and Exposures (CVE) standard.
Security Configuration - Assessment of the security configuration of the system using the Common Configuration Enumeration (CCE) standard.
Usage Profile -- Analysis of the usage profile of the system, including information about processes, services, open connections and other usage metrics.
Malware / Computer State -- Search for indications and warnings of malicious code using known signatures and by identifying new or changed executable content, signs of code obfuscation and other methods of compromise.
Compliance – Verification against generally accepted standards using the Extensible Configuration Checklist Description Formats (XCCDF).

Risk Scoring and Prioritization

Once InSight has inventoried the information on the host and determined its level of exposure, InSight uses a patent-pending model to assign a risk score to each host. The InSight Risk Scores is determined by both the impact of potential data loss and the likelihood of exploitation. The resulting metrics permit IT, security, audit, and compliance staff to prioritize IT risk remediation activities.

Centralized Remediation

In both workstation and server deployments, InSight can perform automated data centric remediation, giving IT and security staff maximum flexibility regarding the manner in which the organization will handle remediation tasks..

Reporting and Information

InSight is designed by security, audit and forensics professionals with decades of experience. It automates the data collection necessary for reporting high-risk problem areas, assists in continuous policy and compliance verification, supports the incident response process, and provides a valuable tool for fraud and digital investigation, and e-Discovery. InSight bridges the knowledge gap between security, audit and compliance teams by providing the commonly requested detailed reporting and trending information all three areas require to fulfill their respective reporting and operational responsibilities.

“At the host-security level, security staffs still struggle to create a sensible and measurable data protection strategy that prioritizes security program activity according to the highest risk to the enterprise. The NetWitness InSight model provides an opportunity for organizations to discover where their sensitive data reside, and which assets are most likely to be compromised.”

Michael Monticello, Principal Analyst – Enterprise Management Associates (EMA)

Product Features:

Objective and defendable metrics-based risk model that concurrently calculates impact and probability of data loss
High-performance and low-impact IT risk assessment engine
Modular, standards-based, extensible architecture
Supports Microsoft Windows and Linux-based operating systems for both server and workstation platforms
Centralized and local data remediation options
Risk trending and reporting

Deployment:

NetWitness InSight is licensed per host, and requires InSight Server for data management and reporting. InSight clients deploy via standard desktop management practices to support periodic audits or continuous IT risk monitoring. InSight client/server communications can be configured and scheduled to meet any corporate policy. In addition, InSight can be integrated with NetWitness NextGen™ products to provide network-based context to information at risk.

Screenshots:

The NetWitness InSight dashboard and user interface provide authorized users interactive navigation, centralized and local remediation options, and numerous risk reporting perspectives. InSight administrators can easily configure and manage InSight clients to provide reliable, risk prioritized metrics regarding the IT assets creating the most risk. In addition, InSight offers extensive reporting at all levels of detail for distribution to audit teams, IT and security staff, and non-IT management.