1. StealthWatch: Network Visibility & Security Intelligence BATTLE CARD
“How do I know if my network is compromised?”
“How do I lower my TCO for Threat Management?”
“How do I know who is doing what/when on the internal & virtual network?”
“How do I improve how we detect and respond to active attacks?”
“How do I improve my enterprise risk posture?”
“How do I protect against threats from Mobile Devices?”
What It Is
Customer Benefits
Questions To Ask To Initiate The Sale
Lancope's StealthWatch® System helps organizations quickly detect a wide range of attacks from APTs and DDoS to zero-day malware and insider threats. It accelerates incident response, improves forensic investigations and reduces enterprise risk. StealthWatch’s security capabilities are continuously enhanced with threat intelligence from the StealthWatch Labs research team.
How important is security to your organization?
Explain how you detect and respond to active attacks? How quickly?
How do you know what devices and hosts on your network are already infected?
How do you determine which information, systems, or individuals could be targeted in an advanced attack?
Does your current solution provide the same level of security as it does visibility? (SW offers both)
How do you assess the scope and magnitude of a compromise?
Describe your visibility into historical, end-user activity when launching a security investigation.
Did you know there is a solution that can address BYOD, Continuous Monitoring, Data Loss and other challenges using your existing network equipment?
Continuous monitoring and situational awareness for internal networks
Quickly detects stealthy, zero-day attacks that bypass traditional defenses and identifies affected hosts
Quickly pinpoints source of insider misuse and abuse
Single pane of glass for troubleshooting, incident response and forensics
Audits firewall rules and detects policy violations to help demonstrate compliance
Cost-effectively leverages flow telemetry from edge, access and core across physical and virtual networks
Eliminates network blind spots and reduces total network and security management costs
Value Proposition, Key Points
Pervasive visibility and security intelligence across the internal network: With advanced security intelligence, SW finds the “needle in a haystack” and identifies security and performance issues before they impact operations.
Detect and resolve advanced threats: Through sophisticated behavioral analysis and security context, SW can quickly detect both internal and external threats, helping to address advanced, targeted attacks and other issues such as botnets, DDoS and insider threats.
Accelerate incident response and troubleshooting: SW dramatically accelerates Mean-Time-to-Know (MTTK) to uncover root cause, manage security incidents, restore performance and combat advanced cyber threats faster than ever.
Mitigate operational and enterprise risk: SW delivers unparalleled levels of visibility, accountability and measurability to enhance security posture, reduce risk, improve compliance and ensure network availability.
Adjacent Technologies
SIEM tools can process some NetFlow to help supplement log-based analysis tools, but offers limited anomaly detection, if any.
IPS/IDS tools only see traffic that crosses the perimeter and lack visibility into traffic that stays internal to the network.
PCAP/Forensics tools capture, store and analyze the full packet, are triggered by policy violations; Flows provide continuous network monitoring and auditing, whereas logs provide additional context for an investigation.
NPM tools analyze NetFlow primarily for performance, availability and traffic analysis, but lack behaviour-based anomaly detection and security capabilities.
Challenges StealthWatch Resolves
Insider Threats
Zero-day Malware
APTs
DDoS
BYOD
Policy violations
Performance bottlenecks
Continuous monitoring
Audit & compliance
Network Visibility & Security Context Lancope Confidential ©2013 V 3.2 INTL

2. StealthWatch: Network Visibility & Security Intelligence BATTLE CARD
Top Customer Objections
Massively Scalable StealthWatch Architecture
Objection: We already have tools in place to address those issues.
Answer: FW, AV, and traditional IPS/IDS play a role in defense-in-depth. StealthWatch adds functionality through a behavioral approach that detects APTs, zero-day attacks and insider threats that bypass signature-based devices. SIEMs lack the situational awareness of security events that StealthWatch provides.
Objection: Flow data is not reliable enough for my network. NetFlow cannot scale to meet my network needs.
Answer: StealthWatch leverages NetFlow from routers/switches (without requiring probes or network downtime to install) to provide a continuous and pervasive network surveillance system for end-to-end visibility.
Objection: I’m already doing flow monitoring today.
Answer: Can your NetFlow tool provide more than basic flow visibility for networking staff? StealthWatch delivers commodity, NetFlow-based performance monitoring features, differentiated by innovative security intelligence to detect APTs, botnets, malware, DDoS, data exfiltration, insider threats and policy violations.
Objection: I don’t have any current budget or projects.
Answer: How would you prioritize this level of visibility for your security strategy? Do you have any data center consolidation or
infrastructure refreshes planned? Do you have OpEx for a service?
Competition
Success Story Proof Points
Cascade/Riverbed: Focus is on WAN optimization. Low capacity, flows per minute, lacks security features (Internal Host Reputation, ISE integration, NAT Stitching, additional threat context, e.g. SLIC). Be aware: RB has always-on packet capture and VXLan integration.
Arbor: Focus is on DDoS Mitigation. Pravail has only been available since Oct Pravail is Peakflow X rebranded. Collectors are lower in capacity, as is management. No NAT Stitching. Be aware: Arbor is attractive to customers concerned with stopping DDoS and could use existing relationships to bring in Pravail.
IBM/Q1 Labs: More akin to a SIEM than a true security tool. Flow collectors are low capacity, between 10K-20Kfps. Scaling to meet the needs of the enterprise would be costly.
“StealthWatch has allowed us to…..isolate network-based threats quickly and with confidence.” Sherman Lofton, Security Manager, Turner Broadcasting System, Inc.
“Lancope enables our team to detect and respond quickly to security incidents as they occur.” Jeff DeLong, Security Architect, Westinghouse
“We were quickly able to get [bot-infected] machines off the network that had been sitting there and scanning for months.” Todd Ferris, Director of Informatics Services, Stanford University's School of Medicine
“Lancope’s anomaly-based protection has been instrumental in identifying both internal and external security threats.” M. Smith, Engineer, United Auto Insurance Group
Network Visibility & Security Context Lancope Confidential ©2013 V 3.2 INTL