Products
- Products
  
  Platform
  ShadowPlex Advanced Threat Defense
  Deception for early detection of cyber threats with precision and speed
  
  ShadowPlex Identity Protection
  Visibility, management and protection of identity stores and attack paths
  Acalvio Active Defense Platform
  Comprehensive and Award-winning Distributed Deception Platform
  
  What is Active Defense?
  Active defense detects and diverts attacks.
  
  Why do I need Acalvio Active Defense?
  Active Defense deceives and disrupts attackers.
Solutions
- Technology Solutions
  
  Industry Solutions
  Breach Detection
  Active Defense for breach detection and response, both in on-premises and cloud workloads
  
  Identity Threat Detection & Response
  Visibility into Identity attack surface and effective detect & respond solution for identity attacks
  
  OT / ICS Security
  Passive and low-risk agentless solution that is easy to deploy
  
  Active Directory Protection
  Visibility into AD attack surfaces and detection of AD Attacks
  
  Threat Hunting
  Active threat hunting, based on targeted deception, to confirm hunting hypothesis
  
  Ransomware
  AI-Driven Advanced Deception Technology to combat even zero-day Ransomware
  
  Honeytokens for CrowdStrike
  Honeytokens are deceptive credentials and data that are embedded in legitimate assets
  Public Sector
  Targeted solution for protecting Federal agencies in conformation with NIST and CISA recommendations
  
  Healthcare
  Active defense solutions thwart healthcare attacks before they can inflict real damage.
Resources
Partners
- Strategic Partners
- Technology Partners
Company

Advancing State of Art in Cloud Malware Detection

by Team Acalvio | February 13, 2019

In the past few blogs (All Roads Lead to Kubernetes, and Deceiving Attackers in a Kubernetes World) we zeroed in on the cloud native environments being the next frontier for the attacker-defender games. We also commented on how deploying deception in a Kubernetes-based environment is an easy approach to detecting attackers that have breached into the infrastructure. Still, deriving the right stack of deception workload to deploy can be tricky. Let’s dig into how to deploy an effective decoy in cloud environments.

Ideally, the deception should mirror the application. The next generation of applications are designed with scale and agility as their top goals. This requirement means they typically span the hybrid cloud, are based on a microservices design pattern, and leverage as many native cloud services (e.g., AWS S3, Spark/EMR) as your budget would allow. The figure below illustrates a typical application stack. This expanded set of options to build applications increases the attack surface and makes it essential that any security solution cover all these diverse resources at cloud scale. Consequently, the deception objective is to mimic production applications and spin up decoys as a tiered-stack that includes front-end, message bus, database and backend tier services, without conflicting or overlapping with existing production workloads, that will work across the full spectrum of platforms in the hybrid cloud.

Acalvio’s ShadowPlex Cloud does just that for you! Based on a production workload blueprint, ShadowPlex Cloud controller applies data-science based recommendation to determine the most effective rollout of decoy EC2 or other virtual machine instances, S3 buckets and SQL databases, and Kubernetes pods and services (either in existing namespaces, or a completely new decoy namespace). The inserted decoys can be customized if desired or the security operator can choose to just go with the default recommendation set. Once the decoys are deployed, the appropriate breadcrumbs will, then, be added as environment variables, registry references, and configmaps so as to lead an attacker to the decoys. This makes ShadowPlex Cloud an effective tool in cloud malware detection with negligible false positives.