Threat Mitigation

Fidelis XPS- Threat Mitigation Capabilities        

Today’s threat actors are determinedly focused on the theft or exfiltration of protected or sensitive information, continually evolving their attack methods and using attacks where traditional security tools—particularly signature-based products—struggle, including custom “zero day” attacks, and attacks that focus further up the architecture to the application layer, and often target users’ activity through both technical and social mechanisms.  To date, the limited amount of threat intelligence data available has been trapped in products offering only partial visibility into network traffic and minimal coverage of a small number of ports and protocols.   As these advanced and persistent threats—such as phishing and malware attacks—constantly morph, it is critical to stay ahead of the threat.

Fidelis XPS™ provides a new approach to computer network defense by bringing real-time threat intelligence into the underlying Fidelis XPS architecture, the Deep Session Inspection® platform.  Unlike signature-based solutions that are easy to evade, or reputational data tied to a small number of ports, Fidelis XPS, via its Feed Manager feature, brings real-time reputational knowledge to life for all 65,535 ports along with the unparalleled visibility and control of network traffic needed to mitigate today’s advanced and persistent cyber threats.

Through the Fidelis XPS Feed Manager feature, the solution’s management console, Fidelis XPS CommandPost, can connect to threat intelligence sources—either internal or external to the organization—to provide dynamic, reputation-based policy updates to Fidelis XPS sensors, which then enforce those policies on network traffic in real time.

With this added visibility, analysis, and control over network traffic, Fidelis XPS provides a new level of automated intelligence sharing, enabling organizations to increase their situational awareness to manage advanced threats and prevent data breaches.  Fidelis XPS cyber intelligence feed capabilities include:

• Fidelis XPS Feed Manager – This standard feature, available on the Fidelis XPS management console, Fidelis XPS CommandPost, provides the ability to connect to threat intelligence sources and automatically integrate timely reputational data into Fidelis XPS policy.  This real-time threat information allows an organization to differentiate between trusted sources and known bad actors in Fidelis XPS policy, enabling more granular inspection of network sessions and separate actions based on reputation. Beyond Fidelis XPS feeds, other threat intelligence sources can be accessed via HTTP or FTP with support for XML, CSV, and IP list formats. 
• Fidelis XPS Anti-Botnet Feed - Available through an annual subscription service, this feed provides botnet command and control threat intelligence. Powered by Umbra Data, the Fidelis XPS Anti-Botnet Feed integrates botnet threat intelligence with Fidelis XPS sensors, enabling the detection and prevention of communications with botnet command and control servers.
• Fidelis XPS Anti-Phishing Feed – Available through an annual subscription service, this feed provides real-time threat intelligence of known fraudulent Web pages.  Powered by Cyveillance, the Fidelis XPS Anti-Phishing Feed provides near real-time updates of systems with fake or copied login pages for banks, brokerages, payment services and other financial services; customer surveys, giveaways and sweepstakes-entry pages. Information collected by bad actors through these pages is used to commit fraud, ID theft, and gain access to enterprise networks, intellectual property and highly sensitive information.
• Fidelis XPS Anti-Malware Distribution Feed – Available through an annual subscription service, this feed provides real-time threat intelligence of systems, websites, and IP addresses distributing malicious software.  Powered by Cyveillance, the Fidelis XPS Anti-Malware Distribution Feed provides near real-time updates on locations known to deliver a piece of malicious code. 
• Dynamic Sensor Updating – Through the Feed Manager feature, Fidelis XPS provides the ability to automatically include threat intelligence information in Fidelis XPS location policy profiles.  Each individual threat intelligence source, or feed, can be configured as an individual profile and can also be customized to control how often to connect to update the source and when to expire data.  Anytime new information is retrieved, the updated profiles will automatically be pushed to any Fidelis XPS sensor, which will use the updated profile in its active policy.

Contact Fidelis Security Systems today to learn more about how Fidelis XPS is uniquely engineered to provide proactive situational awareness to managed advanced threats in your organization.