4 Forensics

Security technologies designed to detect advanced threats have prompted IT executives to take a closer look at tools designed to document the extent of an attack and the malicious tools and tactics used to gain initial access to the corporate network and navigate to more critical systems. The market includes both network and endpoint forensics tools. Network packet capturing appliances from RSA, The Security Division of EMC and Blue Coat Systems provide forensics investigators with historical data to trace the scope of threats. At the endpoint, the two most prominent players, Access Data spinoff Resolution1 and Guidance Software are favorite by large enterprises. Other security vendors that incorporate detection, containment and forensics capabilities include, Bit9-Carbon Black, and FireEye’s Mandiant software.