The document outlines a process for executing a watering hole attack, which involves targeting specific websites to exploit vulnerabilities and inject threats. It discusses AlienVault's unified security management (USM) platform that integrates various security capabilities, including threat detection and intelligence. Additionally, it highlights the regular updates provided by AlienVault Labs for actionable security guidance and a call to action for users to try their services.

1. Live Demo: Get Complete Security
Visibility in Under 1 Hour

2. @AlienVault
1. Determine Target Group
• Attacker Identifies Websites to Target
- Based on observation or guessing
- Compromising a well-known, legitimate site avoids blacklist issues
• Examples
- Compromise a desirable applet
- Redirect visitors to malicious site
- Inject
Watering Hole Attack in 4 Easy Steps

3. @AlienVault
2. Identify Vulnerabilities on those Websites
• Test web servers, ad servers, web apps, etc for vulnerabilities to exploit
3. Inject Threat into Website
• For example, inject HTML or JavaScript to redirect victims to sites
hosting malware
Watering Hole Attack in 4 Easy Steps

4. @AlienVault
4. Sit in the Tall Grass and Wait for Targets to
Come to You
- Redirected from compromised site
- Eventually compromised by download of
malware
Watering Hole Attack in 4 Easy Steps

5. @AlienVault
powered by
AV Labs Threat
Intelligence
USM
ASSET DISCOVERY
• Active Network Scanning
• Passive Network Scanning
• Asset Inventory
• Host-based Software
Inventory
VULNERABILITY ASSESSMENT
• Continuous
Vulnerability Monitoring
• Authenticated /
Unauthenticated Active
Scanning
BEHAVIORAL MONITORING
• Log Collection
• Netflow Analysis
• Service Availability Monitoring
SECURITY INTELLIGENCE
• SIEM Event Correlation
• Incident Response
THREAT DETECTION
• Network IDS
• Host IDS
• Wireless IDS
• File Integrity Monitoring
USM Product Capabilities

6. @AlienVault
AlienVault Labs threat intelligence:
Coordinated Analysis, actionable guidance
 Weekly updates that cover all your coordinated rule sets:
 Network-based IDS signatures
 Host-based IDS signatures
 Asset discovery and inventory database updates
 Vulnerability database updates
 Event correlation rules
 Report modules and templates
 Incident response templates / “how to” guidance for each alarm
 Plug-ins to accommodate new data sources
 Fueled by the collective power of the AlienVault’s Open Threat Exchange (OTX)

7. @AlienVault
AlienVault Labs Threat Intelligence:
Coordinated Analysis, actionable Guidance
•Updates every 30 minutes
•200-350,000 IP validated daily
•8,000 Collection points
•140 Countries

8. @AlienVault
Unified Security Management
Complete. Simple. Affordable.
Delivery Options:
Hardware, Virtual, or Cloud-based appliances
Open-Source version (OSSIM) also available
AlienVault USM provides the five essential security
capabilities in one, pre-integrated platform
 Unified Security Management (USM) Platform
 AlienVault Labs Threat Intelligence
 AlienVault Open Threat Exchange

9. More Questions?
Email Hello@alienvault.com
NOW FOR SOME Q&A…
Test Drive AlienVault USM
Download a Free 30-Day Trial
http://www.alienvault.com/free-trial
Try our Interactive Demo Site
http://www.alienvault.com/live-demo-site