Intelligente und machbare Schutzkonzepte für mittelständische Unternehmen Next Generation Netzwerksicherheit. Don T. Kalal main.it

Transkript

1 Intelligente und machbare Schutzkonzepte für mittelständische Unternehmen Next Generation Netzwerksicherheit Don T. Kalal main.it

2 Warum was neues? 91% Attackers are more increase in targeted attacks in 2013 sophisticated and well funded 78% of Launching exploit kits Zero-Day utilize attacks is vulnerabilities more accessible less and than common 2 years old 71% of Targeted breaches attacks involvecan only a be targeted solved user on the device endpoint

3 So viele möglichkeiten Schwachstellen zu benützen Cloud + SaaS Social + consumerization Massive opportunity for cyber criminals Mobile + BYOD Cloud + virtualization

4

5 Die Kill Chain heute Bait the user Exploit Download Backdoor Establish Back-Channel Explore & Steal

6 Den Nutzer ködern Bait the user Exploit Download Backdoor Establish Back-Channel Explore & Steal

7 Anwendungen erkennen und kontrollieren Anwendungen haben sich verändert: Ports Applications IP Addresses Users Packets Content 7

8 Die Lösung: Drei Technologien App-ID Identifikation der Anwendung User-ID Identifikation der Benutzer Content-ID Untersuchung des Inhalts

9 Warum Visibilität & Kontrolle in der Firewall sein muss Traffic Firewall Port Policy Decision Port IPS Applications App Ctrl Policy Decision NGFW Applikations Kontrolle Applikations Kontrolle ist in der FW = 1 Regelwerk Sichtbarkeit über alle Ports, für jeden Traffic, zu jeder Zeit Implikationen Network Access Entscheidung basiert auf Applikations Erkennung Sicheres Bereitstellen von Applikationen Applikations Kontrolle als Add-On Port-basierende FW + App Ctrl (IPS) = 2 Regelwerke Applikationen sind Bedrohungen; Blockt nur wonach man explizit sucht Implikationen Network Access Entscheidung wird ohne Information getroffen Kein sicheres Bereitstellen von Applikationen Traffic Firewall Applications App Ctrl Policy Decision Application IPS Scan Application for Threats

10 Keine Sicherheit ohne Sichtbarkeit! Alle Anwender Alle Anwendungen Alle Inhalte jeder Zeit!

11 Eine Anwendungsschwachstelle ausnutzen Bait the user Exploit Download Backdoor Establish Back-Channel Explore & Steal

12 Die Lösung: Drei Technologien App-ID Identifikation der Anwendung User-ID Identifikation der Benutzer Content-ID Untersuchung des Inhalts

13 WildFire Architecture

14 Introducing Traps Next Generation Endpoint Security Prevent Exploits Including zero-day exploits Prevent Malware Including advanced & unknown malware Collect Attempted-Attack Forensics For further analysis Scalable & Lightweight Must be user-friendly and cover complete enterprise Integrate with Network and Cloud Security For data exchange and crossed-organization protection

15 Block the core techniques not the individual attacks Software Vulnerability Exploits Exploitation Techniques Thousands of new vulnerabilities and exploits a year Only 2-4 new exploit techniques a year Malware Malware Techniques Millions of new malware every year 10 s 100 s of new malware sub-techniques every year

16 Exploit technique prevention how it works Reported to ESM CPU <0.1% Forensic data is collected Process is terminated Safe! User\admin is notified Document is opened by user Traps seamlessly injected into processes Process is protected as exploit attempt is trapped Traps triggers immediate actions Attack is blocked before any successful malicious activity When an exploitation attempt is made, the exploit hits a trap and fails before any malicious activity is initiated.

17 Next Generation Endpoint Security Proven Success! Successfullyprevented allwindows-based published Zero-Days since March 2012 NetTraveler Campaign RSA Watering-Hole attacks Stuxnet European Aerospace (infector) Google (Operation Aurora)

18 Next Generation Endpoint Security It works!

19 Stop the payload Bait the user Exploit Download Backdoor Establish Back-Channel Explore & Steal

20 WildFire: extending coverage Malware and Exploit detection Mobile malware Simultaneous execution in multiple OSs Static file analysis & dynamic analysis in Android emulator

21 Command an Control Traffic erkennen Bait the user Exploit Download Backdoor Establish Back-Channel Explore & Steal

22 DNS beeinflussen WildFire DNS signatures Internal DNS Server DNS query for controlme.com DNS query for controlme.com Malicious Domain Database controlme.co m is report on connection attempts to Compromised host Passive DNS monitoring Opt-in, anonymous DNS collection Discovers additional C2 domains Block signatures distributed to firewalls for protection Local DNS sinkhole Confirm and discover host infections (trace back to the actual user) Safely block DNS requests and redirect malicious traffic to a sinkhole address

23 Schritt 5: Eine Anwendungsschwachstelle ausnutzen Bait the user Exploit Download Backdoor Establish Back-Channel Explore & Steal

24 Die Lösung: Drei Technologien App-ID Identifikation der Anwendung User-ID Identifikation der Benutzer Content-ID Untersuchung des Inhalts

25 Threat Intelligence Cloud Next-Generation Firewall Bait the user Inspects all traffic Blocks known threats Exploit Sends unknown to cloud Download Backdoor Extensible to mobile & virtual networks Establish Back- Channel Gathers potential threats from network Exploit and endpoints Analyzes and correlates threat intelligence Download Backdoor Disseminates threat intelligence to network and endpoints Next-Generation Endpoint Protection Inspects all processes and files Exploit Prevents both known & unknown exploits Establish Back-Channel Integrates with cloud to prevent malware

26 The making of a platform: correlated analytics Unknowns Real-time signatures Integrated reporting Unknowns & zero-day discoveries Confirm detection

27 Systematisches Reduzieren von Cybersecurity Risiken 0 Volle Sichtbarkeit 1 Limitierung auf geschäftsrelevante Anwendungen 2 Eliminieren bekannter Bedrohungen 3 Eliminieren unbekannter Bedrohungen

28