Do you have questions?
There is no argument against the fact that Credential Stuffing and ATO attacks are one of the greatest (and fastest growing) threats. And, while the ATO Demo Video provides excellent insight into the "how" of protecting a network, we want to answer some specific questions you may have.
Q. Where does the PPE need to be placed on the network to detect ATO attacks?
The PPE hardware appliance should be installed such that it receives all (public) internet facing network traffic. Alternatively, the Virtual PPE (vPPE container software) should be configured in the data path to receive all traffic between firewalls and authentication servers, file servers, or public-facing application servers where potentially sensitive or valuable information assets are located.
Q. Do I need to modify my network?
No. Both the PPE appliance and Virtual PPE (vPPE container software) can be configured to receive inline traffic or from network TAPs or SPAN ports (physical or virtual.)
Q. What applications can consume the types of metadata that the PPE produces?
The PPE and vPPE produce highly efficient open metadata (json, avro, msgpack, protobuf...) that can be consumed by most existing (NPM, UEBA, SIEM, DLP, IDS/IPS...) tools and frameworks, as well as AI/ML analytics platforms to perform any number of complex monitoring and analytics tasks.
Additionally, these metadata formats can be natively ingested into a wide variety of streaming analytic frameworks and a wide variety of in-memory systems; both open source platforms such as NoSQL (MongoDB, Neo4J, RethinkDB, Elastic), SQL (PrestoDB, VoltDB, PipelineDB), Storm, and Flink, as well as commercial analytics platforms such as Splunk, SAS (ESP), Software AG (APAMA), SAP (HANA), and TIBCO.
Q. Where can I find a more in-depth view of the PPE?
Our PPE Products page contains a datasheet with a detailed look into the PPE; also, better understand how to identify and defend against Credential Stuffing and ATO Attacks on the blog.
Want to see the PPE in action?
If you have any further questions about the PPE, don't hesitate to contact us.
