File access behavior protection

[hoffa2000]

Hi all

I'm tossing around an idea, or requirement rather, I have and need some input. It's concerning all these ransomware that are causing me much headache. Some get caught by different layers in my defence but those that get through manage to do damage and cost us man hours to recover. What about all these encryptions that are going on in parallel, executed on the infected user PC and carried out on our file servers? I mean when a user, instead of having one or three files open at the same time, start accessing and writing thousands...there should be a clear market for a behavior analisys/protection feature there. Right?

Might not be a Cisco thing but you never know. 

Regards

Fredrik

[nspasov]

You need a very good endpoint client to prevent such attacks from happening. There are several vendors out there but right now I see a lot of traction with Cisco's FireAMP for endpoint and TRAPS from Palo Alto Networks. If you already have a Cisco Sourcefire running on your network then FireAMP for endpoint would be a better fit  and vice-versa. 

Thank you for rating helpful posts!