ForeScout | Access Ability

Overview

Threat Protection Made Simple.

ForeScout CounterACT Edge is a high performance security appliance that protects your network perimeter against intrusion. Unlike traditional IPS products, ForeScout CounterACT Edge is extremely easy to install and requires approximately zero management overhead. It is powerful, and painless.

ForeScout CounterACT Edge deploys outside your firewall to protect against incoming attacks. It is connected to a switch via a mirror port. It installs out of band, not in-line with traffic. There is no “bump in the wire”, no latency, no single point of failure.

ForeScout CounterACT Edge uses ForeScout’s patented ActiveResponse™ technology to detect and stop attacks without any need for signatures, anomaly detection or pattern matching. ActiveResponse™ is effective against zero-day and “low and slow” attacks. ActiveResponse™ technology is protected by US Patent number 6363489.

Use Cases #1:   Primary IPS

ForeScout CounterACT Edge can be used as a primary IPS system in front of your existing network firewall. The amount of time that you will spend planning, installing, and managing your network defenses will be lower than with any other product combination. CounterACT Edge is effective against both human and automated attack patterns, including zero-day and “low and slow” attacks.

Use Cases #2:   Secondary IPS

ForeScout CounterACT Edge can be used in front of an existing signature-based IPS to improve the performance and extend the life of your existing product. In this configuration, CounterACT Edge will greatly reduce the number of events that your signature-based IPS system needs to process. It will also reduce your administrative overhead because you will have fewer events that you need to monitor and analyze. CounterACT Edge operates with 100% accuracy, so the events (attacks) that CounterACT Edge blocks do not need to be reviewed by a human. CounterACT Edge filters out the noise, leaving traditional IPS devices to deal with a small number of other attacks.

Features include:

• ActiveResponse™ technology. ForeScout CounterACT Edge uses ForeScout’s patented ActiveResponse™ technology to detect and stop attacks without any need for signatures, anomaly detection or pattern matching.
• 100% accuracy. ForeScout CounterACT Edge communicates with external entities during the reconnaissance phase of an attack. This allows CounterACT Edge to identify the subsequent attack with 100% accuracy – zero false positives. This fact allows you to comfortably put the product into blocking mode and walk away from it. It is truly “set and forget.”
• Multiple blocking modes. ForeScout CounterACT Edge provides multiple ways of blocking attacks. The primary blocking mode utilizes an advanced TCP session reset. Unlike conventional TCP resets, which are sensitive to timing subtleties, CounterACT Edge TCP resets are activated during the initiation of the TCP session, providing more efficient blocking. Other blocking modes include tarpit blocking, UDP blocking, and firewall ACL integration.
• Easy to install. You plug it in, configure it (usually in less than an hour), and walk away. ForeScout CounterACT Edge begins protecting your network immediately with 100% accuracy. No lengthy tuning period.
• Easy to maintain. CounterACT Edge needs no signatures, no updates, no tuning, no maintenance. Forever.
• Alerting & Reporting. CounterACT Edge provides flexible, intuitive alerting and reporting options to ensure that security managers get the information they need, when they need it:
  • Geographical Maps. CounterACT Edge features a world map with geographical locations of monitored and/or blocked sources, and offers history reports for any specific point in time or time range.
  • Complete Event Documentation and Reporting. CounterACT Edge records all detected malicious activity, enabling security personnel to thoroughly investigate incidents. Comprehensive reports feature current and historical data of CounterACT Edge activity.
  • Trend Analysis. CounterACT Edge maintains a historical database of reconnaissance and malicious activity, enabling security managers to pinpoint trends and take the appropriate action.
  • E-mail Alerts. Event information is sent based on user-defined parameters.
• SNMP Traps & Management. ForeScout CounterACT Edge can send SNMP traps about specific attack and operational events to authorized SNMP management stations. Various communities can be defined, allowing read-only access to different parts of the CounterACT Edge management information database.
• WhoIs. CounterACT Edge sends WhoIs service information on suspected attackers to security staff, including their geographic location, corporate affiliation and contact information.