The Power of Sotero’s Data Detection and Response (DDR)

Sotero’s platform employs behavioral analytics to establish baselines of normal user and application behavior. By analyzing deviations from these baselines, it can identify insider threats, unauthorized access attempts, and other suspicious activities that may indicate a security incident. By leveraging advanced machine learning (ML) algorithms and data analytics, Sotero evaluates every data access request in real time, categorizing them based on their potential threat level. A powerful self-training ML model performs this analysis, inspecting and parsing each transaction into its components. These components are then evaluated in the context of historical data usage.

Each attribute within the transaction is assigned an anomaly score, and a combined threat score is computed using weighted scores for all attributes. The threat score helps categorize transactions into ranges, enabling decisions on their execution, execution with notification, or quarantining for further review and approval/disapproval. All decisions and actions are logged for auditing purposes.

Sotero's in-use encryption APIs seamlessly integrate the transaction review, scoring, and decision engine. The logging and scoring framework works in conjunction with the translation and encryption/decryption APIs, benefiting from an autonomous service and asynchronous function. This approach accumulates knowledge from each transaction, continually improving the analysis of future transactions. Additionally, Sotero allows threat detection learnings to be built across multiple datasets or file stores, expanding its effectiveness across various data sources.

The accompanying management console provides administrative functions and serves as a repository of database activity. It offers filtering capabilities by database, file storage, or application, including multi-tenant scenarios. The console provides insights such as total transactions, transactions categorized by threat score range, flagged transactions, and quarantined transactions.

DDR solutions collect and analyze vast amounts of log data from various sources, including network devices, endpoints, applications, and security systems. Through log analysis and correlation, the solution can identify patterns, correlations, and indicators of compromise, providing deeper insights into potential security incidents.

Because Sotero’s DDR capability combines signature-based detection with behavior-based detection, it has a unique ability to detect unknown or zero-day attacks. Ransomware attacks tend to infiltrate the network level undetected and will lie dormant for several months. Rather than being detected when it is too late, Sotero allows organizations to take a proactive approach. Our technology detects new strains of ransomware based on how they interact with files and data, not because they have been seen before. Along with this, Sotero has the ability to detect when a ransomware attack is attempting to encrypt data and will stop the attempt in its tracks.

Sotero’s DDR is technology agnostic and easily integrates with other security tools and systems, such as Security Information and Event Management (SIEM) systems, Endpoint Detection and Response (EDR) solutions, and Threat Intelligence platforms. This integration capability facilitates the sharing of data, correlation of events, and centralized management of security operations.

Our technology provides reporting capabilities for compliance with regulatory requirements. It generates audit trails to help you demonstrate adherence to industry standards and regulations. 

Sotero’s patented encryption leaves no gaps in your security posture. Traditional encryption methods keep data protected while it is in motion or at rest, but not while it is in-use or being accessed. This leaves a massive loophole in an organization’s security posture. In the case of malicious activity or insider threats, the data is left unsecured the moment it is accessed. Our in-use encryption technology (also referred to as queryable encryption), lets organizations or third parties access data without the need to decrypt it. This further fortifies your data security posture; the moment an attacker exfiltrates data, it is rendered unusable, only showing jumbled text. Our customers no longer have to worry about attackers holding them at ransom with extortion attacks, as their data cannot be sold on the black market.

Sotero’s dashboard offers visualization tools to provide a clear overview of the security posture and ongoing incidents. This allows security analysts and stakeholders to monitor key metrics, track incidents, and gain actionable insights for decision-making.