Sourcefire VRT (Vulnerability Research Team)

The Sourcefire VRT® (Vulnerability Research Team) is a group of leading edge network security experts working around the clock to proactively discover, assess and respond to the latest trends in hacking activities, intrusion attempts and vulnerabilities. Some of the most renowned security professionals in the industry, including the authors of several standard security reference books, are members of the Sourcefire® VRT. This team is also supported by the vast resources of the open source Snort® community, making it the largest group dedicated to vulnerability research and advances in the network security industry. The Sourcefire VRT is dedicated to protecting Sourcefire customers and Snort users by verifiably defending against:

• All possible attacks against vulnerabilities
• Before specific exploits proliferate in the wild, while
• Minimizing false positives and eliminating false negatives.

Rather than traditional exploit-based signatures, which provide little protection against unknown or zero-day threats, the Sourcefire VRT develops vulnerability-based rules for protection against emerging exploits before they are in the wild.

Below is a sampling of the threat detection provided by all Sourcefire IPS solutions:

DoS attacks Buffer overflows P2P attacks Worms Trojans Backdoor attacks Spyware

Invalid headers Blended threats Rate-based attacks Zero-day threats Port scans VoIP attacks

IPv6 attacks Statistical anomalies Protocol anomalies Application anomalies Malformed traffic TCP segmentation and IP fragmentation

Validated by a proven track record, the Sourcefire VRT has protected customers in advance of every significant outbreak of malware, including Conficker, Netsky, Nachi, Blaster, Sasser, Zotob and many more, without the need for further updates to detect new variants. The Sourcefire Vulnerability Research Team:

• Leads the IDS/IPS industry in delivering rules that provide same day protection for critical Microsoft Tuesday vulnerabilities.
• Develops the official Snort rules used by the Sourcefire 3D® System.

For more information on how to obtain these rules, visit snort.org/vrt. For the latest Sourcefire VRT advisories click here. Catch the latest news from the Sourcefire VRT on their official blog page here. To learn more about the Sourcefire VRT Rule Methodology and process for writing, testing and publishing new rules, download the Sourcefire Vulnerability Research Team white paper.