1

At A Glance● 의심되는 파일, 핸들, 핵심 상황 데이터

(파일 경로 등)를 즉각적으로 검색

● 레지스트리 설정, 레지스트리 경로, 활성화된 연결, 리스닝 포트 등을 총체적으로 분석

● 실행 중인 프로세스, 뮤텍스, 로드된 모듈의 MD5/Sha1 해시값 쿼리

● 대규모 환경에 대해 신속하게 조치 실시: 프로세스 강제종료, 파일 캡처, 사용자경고, 패치 설치, 업데이트 적용 등을 몇 분 이내에 완료

● 추가 분석을 위해 감염된 엔드포인트로부터 정보 수집

●

Tanium Incident Response태니엄 Incident Response는 비견될 수 없는 속도 및 확장성으로 모든 엔드포인트에 대한 위협 및 취약성을 추적, 격리 및 조치할 수 있는 광범위한 능력을 제공합니다.

진화하는 사이버 공격과 그 대응의 한계오늘날 사이버보안에 있어서 가장 우려스러운 점은 바로 공격자가 활용할 수 있는 스킬, 정밀도, 그리고 전략이 빠른 속도로 발전하고 있다는 것입니다. 이제 최신의 공격들은 놀라울 정도로 효율적으로 이루어지고 또 탐지해내기 어려워졌으며, 침해 발생 시 엄청난 피해와 많은 비용을 초래합니다. 사고대응팀은 항시 공격을 받고 있지만, 대부분은 지능적이고 강한 의지를 지닌 공격자들과의 전투에서 무력할 수밖에 없습니다. 왜냐하면, 사고대응팀이 가진 툴들은 환경에 대해 수 시간, 수 일, 심지어 수 주나 지난 정보밖에 제공하지 못하여, 초 단위를 다투는 시간과의 싸움에서 완전히 무용지물이 되기 때문입니다.

태니엄만의 차별점태니엄 엔드포인트 플랫폼은 보안 및 IT 운영팀에게 15초 가시성 및 컨트롤 능력을 제공하여 글로벌 네트워크에서도 모든 엔드포인트들을 보호하고 관리할 수 있게 해주는 최초이자 유일무이한 기업용 플랫폼입니다. 태니엄의 특허받은 아키텍처는 Low Latency, High Bandwidth를 활용하여 허브-스포크 아키텍처가 지닌 본질적인 한계를 초월합니다. 또한, 인프라를 최소화하여 비용 절감이 가능할 뿐만 아니라, 지속적인 릴레이 서버의 추가 및 유지보수 없이도 수백만 대 규모로 손쉽게 확장할 수 있습니다. 태니엄 엔드포인트 플랫폼은 오늘날의 보안 위협에 맞서기 위해 필요한 속도와 확장성, 그리고 신뢰성을 제공합니다.

Tanium Incident Response OverviewTanium Incident Response, a module of the Tanium Endpoint Platform, provides the essential tools and functionality required for hunting, containing and neutralizing unfolding attacks at the endpoint, at any scale, in seconds. Tanium Incident Response provides security teams immense flexibility and a wide array of out of the box functionality that is crucial to discovering attack artifacts, applying remediating actions directly to a�ected endpoints, and verifying compromises are properly eliminated. This unprecedented agility significantly reduces the time required to resolve incidents, and this in turn limits the impact and damage related to incidents such as unauthorized intruders, insider threats and critical system outages.

Adaptability To Scope Even The Most Sophisticated AttacksMalicious attackers are not bound by any rules and o�en strike opportunistically and behave erratically. Under these wide-open circumstances, there aren’t any guidelines or structure that can be prescribed to predict their motives or strategies. Tanium Incident Response provides the flexibility to adapt to this uncertainty, and provides security teams full control over ad-hoc or methodical endpoint investigation and threat detection. Tanium Incident Response includes out of the box capabilities to search for MD5s of processes, mutexes, application logs, scheduled tasks, active users, loaded modules, open ports, running services, unauthorized connections, unmanaged assets, semaphores and much more, and retrieve accurate results back from every endpoint in just seconds.

Remediate Any Attack On The EndpointOnce an incident has been fully scoped, remediation must be executed swi�ly and precisely to limit the time adversaries have to counteract. Tanium Incident Response provides a full suite of out of the box capabilities, for example quarantining machines, killing processes, disabling network connections, changing registry data, uninstalling applications, resetting credentials, shutting down systems and much more, that allow security teams to reestablish full control and stop attacks already underway dead in their tracks in just seconds.

태니엄 Incident Response는 그 어떠한 규모의 환경에서도 엔드포인트에 대해 이뤄지는 공격을 수 초안에 추적하고, 억제하며, 무력화시킬 수 있는 필수적인 툴 및 기능을 제공합니다.

HS-DS-TAN-IR-010416

© 2015 Tanium, Inc. All rights reserved. Tanium is a registered trademark of Tanium, Inc. All other brands, products, or service names are or may be trademarks or service marks of their respective owners.

Data Sheet

2

ABOUT TANIUM태니엄은 전 세계의 가장 큰 기업 및 정부기관들에 수 초 이내에 수백만 대의 엔드포인트를 보호, 컨트롤 및 관리할 수 있는 독보적인 경쟁력을 제공합니다. 이제 보안 및 IT 운영팀은 태니엄이 제공하는 전례 없는 속도와 간편함, 그리고 확장성을 통해 항시 정확하고 총체적인 엔드포인트 상태 정보를 수집하여 현재의 보안위협에 대해 효과적으로 방어할 수 있게 되었을 뿐만 아니라, IT 운영에 있어서도 새로운 차원의 비용 효율을 달성할 수 있게 되었습니다. 더 많은 정보를 위해서는 www.tanium.com을 방문하시거나, 트위터에서 @Tanium을 팔로우하세요.

© 2015 Tanium, Inc. All rights reserved. Tanium is a registered trademark of Tanium, Inc. All other brands, products, or service names are or may be trademarks or service marks of their respective owners.

Tanium Incident Response delivers a broad set of capabilities to hunt, contain and remediate threats and vulnerabilities across every endpoint with unparalleled speed and scalability.

Security Teams Are Bringing Sticks To GunfightsThe most alarming trend in cyber security today is the pace of advancement in skill, precision and tactics at attackers’ disposal. Modern attacks are now frighteningly elusive and e�icient, and breaches are staggeringly costly and devastating. Incident response teams defending high value assets are constantly under siege, and almost all are powerless when combating sophisticated and determined attackers, because the tools they are equipped with can only provide views of their environments that are hours, days or even weeks old, and that is simply worthless in this struggle against time.

The Tanium Di�erenceThe Tanium Endpoint Platform is the first and only enterprise platform that empowers security and IT operations teams with 15-second visibility and control to secure and manage every endpoint, even across the largest global networks. Its patented architecture transcends the inherent limitations of hub-and-spoke technologies by harnessing the speed of low-latency local area networks coupled with a minimal, cost-saving infrastructure that e�ortlessly scales to millions of endpoints without the need for ongoing addition and maintenance of supporting servers. The Tanium Endpoint Platform delivers the speed, scalability and reliability necessary for defending against today’s threat landscape.

태니엄 Incident Response 개요태니엄 Incident Response는 태니엄 엔드포인트 플랫폼의 모듈 중 하나로, 그 어떠한 규모의 환경에서도 엔드포인트에 대해 가해지는 공격을 수 초안에 추적하고, 격리하며, 무력화시킬 수 있는 필수적인 기능을 제공합니다. 태니엄 Incident Response는 보안팀에게 어마어마한 유연성과 함께, 공격 아티팩트 발견 / 감염 엔드포인트에 조치 직접 적용 / 위협 침입 제거의 검증에 필수적인 다양한 기본 탑재 기능을 제공합니다. 이러한 전례 없는 민첩함은 사고를 해결하는데 소요되는 시간을 대폭 단축시켜주며, 이는 승인되지 않은 침입자, 내부자 위협, 그리고 크리티컬 시스템 다운 등의 사고가 유발하는 피해 및 악영향을 줄여줍니다.

다양한 정보 수집을 통한 총체적 가시성 제공악의적인 공격자들은 그 어떠한 룰에도 얽매이지 않으며, 보통 기회가 생기면 이를 놓치지 않는 데다가, 이들의 행동은 매우 예측 불가합니다. 그러나 이처럼 공격자들에게 훤히 노출되어있는 상황에서, 이들의 동기 및 전략을 예측할 수 있는 가이드라인이나 체계는 전무한 실정입니다. 태니엄 Incident Response는 이러한 불확실성에 적응하기 위한 유연성을 제공하며, 임시적, 또는 체계적인 엔드포인트 조사 및 위협 탐지에 대한 완전한 통제력을 보안팀에게 제공합니다. 태니엄 Incident Response는 프로세스의 MD5 해시값, 뮤텍스(Mutex), 애플리케이션 로그, 예정된 작업, 액티브 사용자, 로드된 모듈, 오픈 포트, 실행 중인 서비스, 승인되지 않은 연결, 미관리 자산, 세마포어(Semaphore) 등 다양한 정보를 검색할 수 있는 기능을 기본으로 탑재하고 있으며, 이를 통해 수 초안에 모든 엔드포인트로부터 정확한 결과를 수집합니다.

유연하고 즉각적인 조치를 통한 사고대응사고에 대해 전부 파악한 후에는, 적이 대응할 수 있는 시간을 줄이기 위해 신속하고 정밀하게 조치를 실행해야 합니다. 태니엄 Incident Response는 별도의 설치나 구성 없이도, 기기의 격리, 프로세스 강제종료, 네트워크 연결 차단, 레지스트리 데이터 변경, 애플리케이션 삭제, 크리덴셜(Credential) 초기화, 시스템 종료 등, 다양한 기능을 기본 제공합니다. 이를 통해, 보안팀은 수 초 안에 모든 통제권을 회복하고, 즉시 진행 중인 공격을 멈출 수 있게 됩니다.

관리 대상 엔드포인트 수 5,000대 이하 150,000대 이하 400,000대 이하

Hardware Requirements(Tanium Server / Database Server)

Processor Cores (Physical)

Memory

Disk Space2

So�ware Requirements

Operating System

Database Version

16 / 8

48 GB / 16 GB

400 GB / 1 TB

40 / 32

256 GB / 64 GB

1.5 TB / 4 TB

Microso� Windows Server 2008 R2, 2012 or 2012 R2

Microso� SQL Server 2008, 2012 or 2014

80 / 64

512 GB / 128 GB

3 TB / 10 TB

시스템 요구사항 Server Requirements1 Client Requirements1

● Microsoft Windows Vista, 7, 8 or Windows Server 2003, 2008, 2012

● Mac OS X 10.7+ (Intel-only)

● Linux (RHEL 5.x / 6.x, CentOS 5.x / 6.x, SLES 11, OpenSUSE 11.x / 12.x,Debian 6.x / 7.x, Ubuntu 10.04LTS, 12.04LTS, 14.04LTS)

● Oracle Solaris 10 SPARC / x86 “U8”+, 11 SPARC / x86

● IBM AIX 6.1 TL7SP10+, 7.1 TL1SP10+

1 더 많은 정보는 https://kb.tanium.com/System_Requirements 참조2 제시된 디스크 용량 요구사항은 근사치이며, 사용사례 및 사용방법에 따라 달라질 수 있음