Story image

RepKnight adds dark web monitoring to top 3 SIEM vendors

04 Jun 18

Today RepKnight announced the integration of its BreachAlert Dark monitoring platform with Splunk, IBM QRadar, and LogRhythm.

Gartner’s current Magic Quadrant for Security Information and Event Monitoring (SIEM) listed these vendors as the top three in the industry, with the market worth US$2 billion annually.

According to RepKnight, what the integration effectively means is that customers of these vendors will now be able to receive BreachAlert notifications directly into their core security operations centre platforms and correlate dark web data with in-house network activity.

The company says this integration couldn’t come soon enough, as the aforementioned Gartner report also asserts that “organisations are failing at early breach detection, with more than 80% of breaches undetected by the breached organisation.”

RepKnight CEO Jeremy Hendy says the reason for this is simple – the company believes that less than 1 percent of organisations are currently monitoring for leaked data being outside their network.

“Large organisations invest a lot of resource to prevent data breaches from their own networks. But that doesn’t help detect breaches of corporate data that’s already outside the firewall — sitting on the networks and endpoints of thousands of their clients, suppliers, and business partners,” says Hendy.

“It only takes one of those third parties to suffer a breach, and highly sensitive information can rapidly propagate onto dump sites, forums, and dark web marketplaces — often with disastrous consequences to your reputation.”

Hendy says what makes BreachAlert unique from other threat intelligence feeds is that it searches for targeted data specific to the organisation, like corporate email credentials, clients lists, IP addresses of critical infrastructure, or keywords relating to brand, product or app names. Furthermore, the SIEM integration allows the data to be automatically correlated with in-house activity.

“RepKnight’s vision is to look after your data, not just your network. Our BreachAlert SaaS platform makes it easy for organisations of any size to proactively monitor for their data being leaked online,” says Hendy.

“For our larger customers, integrating BreachAlert feeds into their SIEM platform is a natural step. As well as simplifying their incident response workflow, the integration allows dark web activity to be correlated with what’s happening inside the network.”

According to RepKnight, many attacks on businesses begin with compromised login credentials that often result from hacks to a third party website that an employee has signed up for with their work email address and a reused password.

Its BreachAlert platform has been designed to address staff or client login credential leaks to be addressed as soon as possible by providing live feeds of compromised credentials directly into the SIEM, in addition to an interactive historical database of more than 6 billion compromised credentials.

The solution scans the Dark Web and hundreds of other paste, dump, and bin sites used by cybercriminals to exchange, buy and sell corporate data, to then alert customers in real-time as soon as their data appears on the dark web.

SailPoint releases first identity annual report
SailPoint’s research found that many organisations are lacking maturity in their governance processes over identities.
Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.