Threat Response Incident Response. Hans Irlacher. Manager Presales Engineering CEMEA

Transkript

1 Threat Response Incident Response Hans Irlacher Manager Presales Engineering CEMEA Copyright 2015 Proofpoint, Inc. All Rights Reserved. 1

2 Proofpoint Portfolio Blockieren Erkennen Protection: Proofpoint Protection Server, Best in Class Protection Reagieren TAP: Erkennt zielgerichtete, polymorphe und Zero-Day Attacken Threat Response: Umfassendes Incident Handling und schnelle Reaktion Copyright 2015 Proofpoint, Inc. All Rights Reserved. 2

3 Geschäftliche und Rechtliche Konsequenzen CSO Online, Dec. 15, 2014 InfoSecurity, Jan. 16, 2015 The Cost of Malware Containment, Ponemon Institute, January 2015 Copyright 2015 Proofpoint, Inc. All Rights Reserved. 3

4 Die Wichtigkeit einer schnellen Reaktion 46% 70% Ponemon Institute & Verizon Data Breach Report: Copyright 2015 Proofpoint, Inc. All Rights Reserved. 4

5 Das Neue Erkennungsproblem Advanced Malware Detection Source Destination Severity High SIEM Source Destination Type Anomaly IPS Source Destination Severity High Security Operations Was jetzt? 1. Welcher Alarm ist der wichtigste? 2. Wie erhalte ich mehr Informationen im Kontext? 3. Wie bestätige ich eine Infektion? (ohne False Positive ) 4. Wie kann ich mich schnell schützen und eingrenzen? 5. Wie kann ich die eigene Effektivität messen? Copyright 2015 Proofpoint, Inc. All Rights Reserved. 5

6 Losses Incident Response Herausforderung Mit nur wenigen Daten sind Alarme nicht zu handhaben Wer wurde attackiert? Welche Art von Attacke ist es? Bedrohungs Nachforschung Bedrohungs Verifikation Bedrohung eindämmen & Reimage Daten zusammenfassen Security Alerts Security Operations Woher kommt die Attacke? Time Copyright 2015 Proofpoint, Inc. All Rights Reserved. 6

7 Der Gewöhnliche Incident Response Prozess Infizierung Erkennung Behebung DHCP server Intelligence/Rep Meeting Scheduler console(s) Domain Controller High AD Server value targets? Phonebook/directory High value targets? Geo IP service High Whois value/severe threats? Virus Total High value/severe threats? Forensic collection/ Confirm analysis Infection? Security alert source Incident management Confirm Infection? AD console(s) Quarantine/Contain? FW/Proxy console(s) Ticketing system Change control Contain? Copyright 2015 Proofpoint, Inc. All Rights Reserved. 7

8 Incident Response sollte einfach sein High Value Target? Endpoint infiziert? Zentrales Dashboard Informationen Zusammenführen Quarantäne & Beheben Copyright 2015 Proofpoint, Inc. All Rights Reserved. 8

9 Proofpoint Threat Response Virtual Appliance Verstehen Automatisiert Verifizieren Durchgängig Custom Events und mehr Beheben Unmittelbar und mehr... Copyright 2015 Proofpoint, Inc. All Rights Reserved. 9

10 Threat Response Use Case Add: Username Infection history Group Local information Local IP Malicious file check IP/Domain Reputation Geo-location CNC server check Incident assignment Put user in Penalty box Update Firewalls/Proxies Quarantine Create audit trail Manage IP lifecycle Update Security Alert Threat Response AD IP reputation Geolocation WhoIS Virus Total IOC Verification Threat Verified Network connections: Registry Changes: File changes: Mutexes: Yes Yes Yes Yes AD User: Group: User phone : System IP: Attacker IP: Location: User Context joe@myco.com Josephsmith Finance Fargo, ND Additional Threat Context Sender IP: Known Malware?: New Domain? Domain Reputation? CNC List? Country? Known bad actor Trojan.Zbot.X Yes Neutral Y N. Korea Copyright 2015 Proofpoint, Inc. All Rights Reserved. 10

11 Threat Response mit TAP Attachment Defense (AD) 2 1 Proofpoint TAP TAP AD Alert 1 Nachricht wird dem Nutzer direkt zugestellt. Zeitgleich wird eine Kopie innerhalb der Sandbox analysiert Threat Response 2 TAP Alerts werden an PTR gesendet. PTR verbindet sich direkt mit Exchange (O365) und überträgt die Nachricht automatisch in die Quarantäne Exchange/ O365 Quarantine Copyright 2015 Proofpoint, Inc. All Rights Reserved. 11

12 SIEM + Threat Response Logs Alerts Events SIEM Threat Response Security Analysts Incident Context Forensic data collection Infection Verification Past infection checking Threat Scoring Incident/User/IP history Incident assignment User Isolation Network Containment Quarantine Copyright 2015 Proofpoint, Inc. All Rights Reserved. 12

13 Threat Response schließt die Lücke Erkennung Nachforschung Verifizieren Priorisieren Reagieren TAP Copyright 2015 Proofpoint, Inc. All Rights Reserved. 13

14 Kundenvorteile Threat Response beschleunigt den Prozess: Verstehen & Priorisierung von Bedrohungen Infizierungen bestätigen (Vergleich forensischer Infos) Reagieren auf Bedrohungen (FW/Proxy/AD Integration) Geschäftliche Vorteile: Senkt die Zeit der Nachforschung um > 50% Um bis zu 20-fache Beschleunigung der Reaktion Reduziert die Belastung und das Risiko bei zeitgleich weniger Arbeit Copyright 2015 Proofpoint, Inc. All Rights Reserved. 14

15 Protection Platform Powered by Big Data PROTECTION ADVANCED THREAT PROTECTION/RESPONSE INFORMATION PROTECTION PROOFPOINT PLATFORM BIG DATA ANALYTICS SOCIAL MEDIA PROTECTION # ARCHIVING + COMPLIANCE Copyright 2015 Proofpoint, Inc. All Rights Reserved. 15

16 DEMO Copyright 2015 Proofpoint, Inc. All Rights Reserved. 17

17 Understand: Who, What, Where What is the Threat Who is the target Where is attack coming from Copyright 2015 Proofpoint, Inc. All Rights Reserved. 18

18 Target information: User Phone Department Special groups Location more Incident history Drill down available, one click away Copyright 2015 Proofpoint, Inc. All Rights Reserved. 19

19 Verify: Confirm Infection via Forensics Summary of Forensics found vs. reported Infection confidence Forensic Matches Forensic Matches Forensic Matches Past infection check Copyright 2015 Proofpoint, Inc. All Rights Reserved. 20

20 Contain: Quarantine and Contain Identities and Hosts Attacker and CNC data drill down At-a-glance Geo-location Copyright 2015 Proofpoint, Inc. All Rights Reserved. 21

21 Automatic IP Blocking lifecycle Push-button or automatic protection Copyright 2015 Proofpoint, Inc. All Rights Reserved. 22

22 Push-button or automatic quarantine after is delivered Contain: quarantine automated or manual Copyright 2015 Proofpoint, Inc. All Rights Reserved. 23

23 Incidents by Department With Built-in & Custom Reports and Views Customizable Reports Copyright 2015 Proofpoint, Inc. All Rights Reserved. 24