[April 18, 2018]

Network Security Forensics in the Incident Detection and Response Lifecycle Space, 2018 - ResearchAndMarkets.com

The "Network Security Forensics in the Incident Detection and Response Lifecycle" report has been added to ResearchAndMarkets.com's offering.

Network security forensic tools get to the heart of the matter in cybersecurity and that is the proper indexing and correlation of packets.

The most noted platforms include RSA NetWitness, Cisco Stealthwatch, Arbor Networks Spectrum (News - Alert), and IBM QRadar. However, often companies do not wish to use full packet capture platforms; and will consider solutions that have partial packet capture with metadata (PacketSled as an example). network security forensics tools offer a way to reduce the mean-time-to-detect (MTTD), and mean-time-to-respond (MTTR) to security incidents and, because these tools offer packet-level visibility, they find the root-cause of an incident.

This network security forensics report is developed in the context of an IDR framework. The framework explains varying attributes of Detection, Contextual Analysis, Remediation, and Restrictions/Penalties for cybersecurity technologies in the security operations center (SOC).

Two capabilities differentiate network security tools from other cybersecurity platforms:

1)Platforms are capable of full packet capture (PCAP)

2) Other platforms use partial packet capture with metadata fields. Both types of tools are covered in the report and an explanation about the pros and cons can be found in Capacity Partial and Full Packet Capture.

Key Topics Covered:

1. Executive Summary

• Key Findings
• Executive Summary-Key Questions This Study Will Answer

2. Introduction

• Introduction to the Research

3. Introducing Network Security Forensics

• Network Security Forensics-Definitions
• Network Security Forensics and Forensic Investigations
• Network Security Forensics-Investigating an Alert
• Network Security Forensics-Investigating a Breach

4. Network Security Forensics Origins by Technology Types

• Network Security Forensics Origins by Technology Types

5. Drivers and Restraints-Network Security Forensics

6. Capacity-Partial and Full Packet Capture

7. Network Security Forensics Role in IDR

• Network Security Forensics Role in IDR
• Attributes of Vendor Analysis of Network Security Forensics in IDR

8. Vendor Analysis of Network Security Forensics in IDR

9. The Last Word

10. Vendor Participation Slides

11. Appendix

Companies Mentioned

• Arbor Networks, the Security Division of NETSCOUT
• CSPi
• Cisco (News - Alert)
• Corelight
• LogRhythm
• NIKSUN (Big Data Analytics on Lossless Full Packet Capture)
• NetFort
• Savvius
• Symantec (News - Alert)
• VIAVI Solutions

For more information about this report visit https://www.researchandmarkets.com/research/vgbw3v/network_security?w=4

View source version on businesswire.com: https://www.businesswire.com/news/home/20180418006608/en/

[ Back To TMCnet.com's Homepage ]