Sourcefire tackles advanced malware with cloud-hosted FireAMP tool

Security specialist Sourcefire is addressing the threat to enterprises from sophisticated malware with a new tool that can trace and remove infections by utilising the power of the cloud and big data analytics to identify new threats and enable customers to take remedial action.

Available now, FireAMP is designed to combat advanced malware threats that may be capable of evading traditional security counter measures and, hence, complements existing anti-malware tools rather than directly replacing them, the firm said.

"Advanced malware has become difficult to catch because it is changing all the time, through packing and repacking of the code and techniques such as polymorphism that change the code every time it is executed," Leon Ward, field marketing manager for Sourcefire, told V3.

"Because of this, traditional antivirus and anti-malware is unable to cope and you need a second line of defence"

FireAMP has been designed with the assumption that some malware is going to make it onto the network before it gets detected and, once this happens, security teams need to be able to pinpoint the source of the infection and how far it has spread before they can take action.

To this end, the platform uses an endpoint agent that tracks the creation and movement of files on the network, which enables the security team to trace the exact propagation path of any malware, find how it got onto the network in the first place and quarantine any infected systems.

"FireAMP is unique in giving control to the end user, so they can contain and remediate immediately any type of malware threat they find," added Ward.