Symantec Endpoint Security Management Solutions Presentation and Demo for:

Transcription

1 Symantec Endpoint Security Management Solutions Presentation and Demo for: University System of Georgia Board of Regents Information Technology Services

2 Executive Summary Business Requirements To migrate University Systems campuses to a common security platform to allow campuses to leverage each other for support and best practices, to centralize and standardize. Symantec Capabilities to Address Systems Management Symantec Management Platform (Altiris): System inventory, management patch management, software delivery, Mobile management To centralize management and reporting on threats facing the campuses and share within community. Develop and publish endpoint policies, standards, and guidelines in direct support of the campuses for endpoint security. Lower the cost of security for the System Threat Management Symantec Protection Center : Central management platform for Symantec threat solutions for RBAC login, reporting. The below are managed from this console Symantec Data Loss Prevention: Prevent confidential information from leaving endpoint or network Symantec Protection Suite: AV protection for endpoints, and web gateways and includes basic offering of Network Access Control 2

3 Use Case #1 Business Requirements The University System of Georgia has challenges with maintaining a state of compliance for all endpoints. USG systems needs to meet the standards and guidelines established to comply with the written polices. We are looking for an endpoint security solution and a policy, standard, and guidelines on how institutions can implement USG best practices at their campuses RFI Reference Introduction 1.1 Today, IT and Information Security face evolving business processes and connectivity requirements that have become more and more complex. In addition, students, faculty, and staff have pushed IT for support of mobile devices and increasing support of a nomadic workforce. The old network design with defined endpoints has shifted and a new paradigm has emerged. Support and security staff realizes that securing and supporting endpoints the way we currently are is no longer effective, efficient, or economical. 3

4 Symantec Management Platform Symantec Solutions SECURITY INFORMATION RISK & COMPLIANCE STORAGE INFRASTRUCTURE OPERATIONS BUSINESS CONTINUITY Dell Management Console Dell Client Manager Third-Party Solutions vpro TM enabled computer management Management Platform 7.1 HP Client Manager Endpoint & Mobile Security Management Backup Management Application Virtualization Power Management HelpDesk Management Patch and System Management Symantec Confidential 4

5 IT Lifecycle Management Service Support and Remote Assistance Transition and Migration Discovery and Inventory Backup and Recovery Contracts and Cost Analysis Monitoring and Reporting Symantec Management Platform Application Packaging and Virtualization Desktop Power Management Imaging and Deployment Patch Management and Compliance Endpoint Protection Intelligent Software Management 5

6 Lifecycle Management as part of Defense in Depth. Client Service IT Management Server Asset Desk Management Enterprise Mobility & Management *MDM for ios and Droid

7 Demo Symantec Management Platform Application Distribution Configuration and Patch management Areas to Focus: Discovery Tools Inventory Management Patch Management Compliance Management Device Control/Remote Management Ability to manage existing antivirus Symantec Corporation, All Rights Re

8 Use Case #2 Business Requirements University System of Georgia requires a method to address the risks and implement Security and Management best practices for mobile devices accessing USG resources. RFI Reference What are all the types of endpoints that your solution manages including but not limited to mobile devices, points of sale, laptops, desktops, barcode readers, smartphones, tablets, etc.? How does your endpoint security management solution handle the following features? Mobility Management (BYOD) 8

9 Consumerization of Applications Users Adopting Apps Pragmatically Is IT Security the Champion, the Blocker, or Irrelevant?

10 Apps SaaS Social Media Storage Vision & Security Solution Strategy - Confidential 10

11 App-Centric Control Mobile Devices in the Enterprise Defining Your Journey BYOD Company Owns an Unmanaged Device Company Controls Relevant Apps & Data Only Unmanaged Managed Company Controls Standard Device Authentication & Access VIP MPKI O3 Information Protection DLP App Center Company Owned Device Control & Management MDM Mobile Security App Distribution & Collaboration App Center Norton Zone 1 Authentication & Access Company Controls Personal Device Authentication & Access VIP MPKI O3 VIP O3 Information Protection DLP App Center Information Protection App Center Personally Owned Device Control & Management MDM Mobile Security App Distribution & Collaboration App Center Norton Zone 3 App Distribution & Collaboration App Center Norton Zone 2 Device-Centric Control

12 Best Practices in the Mobile Space Your users want mobile access: Give it to them! Set up segregated Guest WiFi environments that they connect their personally owned devices to the Internet; only. They want to do mission critical/business applications on mobile devices: Why?! What is the benefit of doing it on a mobile device? Determine the risk. What is the type of information they will be processing, and should it only reside on enterprise protected assets? Enterprise issued mobile devices: Determine a strong management approach which is risk based Mobile Device Management Enterprise Application Management Information and Application Sandboxing Strong & Unified Application Authentication Internet Security Threat Report, Vol

13 Demo Mobile Device Management Policy and Configurations Content and Applications Areas of Focus: BYOD Management Security Device Control/Remote Management Symantec Corporation, All Rights R

14 Use Case #3 Business Requirements University System of Georgia requires the ability to centralize reporting for threat awareness yet delegate operational tasks to local schools. RFI Reference Hierarchical environment such as the University System of Georgia and the Georgia Public Library Service What are the FTE requirements to implement and operate your solution What are the technical specifications for running your solution? a. Server Requirements b. Client Requirements c. Network Requirements d. Storage Requirements e. Virtual Environment requirements if any 14

15 Reference Architecture Management Symantec Protection Center Databases SEPM SSR ITA Embedded SEPM (ASA) SEP Manager Endpoint Protection Network Access Control ITA for SEP Mail Security Messaging Gateway SMS for Exchange SMS for Domino SMP SSR Manager SSR Desktop Edition Workflow Client Endpoints Server Endpoints Endpoint Protection Symantec Management Agent Endpoint Protection NAC Self-Enforcement SEP for Macintosh Antivirus for Linux Symantec Management Agent BESR Desktop Agent 15

16 Symantec Protection Center (Security Management Console) 16

17 Demo Cross Product Reporting Role based Access Adding additional Symantec and 3 rd party solutions Areas of Focus: One Single Pane of Glass or Console Reporting and Dashboard Symantec Corporation, All Rights R

18 Use Case #4 Business Requirements University System of Georgia requires the ability to centrally deploy and manage endpoint security solutions to prevent interruptions in the learning environment, loss of data and productivity, and reduce risk by blocking malicious files and activities, thereby removing the associated sideeffects of compromised systems. RFI Reference How does your endpoint security management solution handle the following features? Firewall Host Intrusion Prevention Application Management (whitelisting/blacklisting) Host Integrity Checking Anti-Virus Anti-Spyware/Malware Anti-Spam Network Access Control (NAC) 18

19 Protecting the Infrastructure Protecting Infrastructure and Data with Protection Suite 19

20 Protection Suite Enterprise Edition Endpoint Security Messaging and Web Security Backup and Recovery Antivirus / Antispyware Antivirus/Antispam/Antiphishing Backup Live Desktops & Laptops Desktop Firewall Reputation-based spam filtering Restore to any Hardware Intrusion Prevention Content Filtering / Compliance Threat Driven Backups Generic Exploit Blocking Data Loss Prevention Device & Application Control Microsoft Exchange Antivirus for Linux Lotus Domino Network Access Control Self Enforcement Symantec Protection Suite Messaging Gateway software subscription 20

21 Symantec Endpoint Protection Version Security Technologies 1 Installed Agent 1 Management Console PC and Mac clients Drastically improved scanning capabilities Optimized for Virtual Clients Real-time No longer dependent on signatures. Insight Reputation Network Access Control Host Integrity Checking Heuristic Detection Location Awareness Application Control Device Control SONAR Firewall Intrusion Prevention Service Antispyware Antivirus

22 Protect Infrastructure Symantec Insight Proactive Protection from New & Targeted Threats Leverages anonymous telemetry data from 250M+ machines to construct a massive nexus of files, machines and domains Tracks nearly every binary in the world 4 billion files, adding 37 million every week 1 Petabyte of statistical data Uses age, prevalence, source and other attributes to assign a reputation rating to files Can accurately identify and block threats even if just a single Symantec user encounters them Bad Safety Rating File is blocked No Safety Rating Yet IT can set block/ allow thresholds Good Safety Rating File is whitelisted 22

23 Prevalence Protect Infrastructure Symantec Insight Proactive Protection from New & Targeted Threats Bad Files No existing protection addresses the long tail Unfortunately neither technique works well for the tens of millions of files with low prevalence. (but this is precisely where the majority of today s malware falls) Good Files Blacklisting works well here. For this long tail a new technique is needed. Whitelisting works well here. 23

24 Demo Policy and Configurations Ensuring Compliance Scalable Architecture Areas to Focus: Antivirus, Anti-spyware, Anti-Malware IPS/Firewall Application Control/HIPS Application Blocking Connection Control Network Access Control Symantec Corporation, All Rights R

25 Use Case #5 Business Requirements University System of Georgia requires the ability to prevent the loss of personal, private, and confidential data, and reduce the liability with lost or stolen assets. Additionally, USG requires a solution to meet legal requirements for audit, discovery, and compliance. RFI Reference How does your endpoint security management solution handle the following features? Encryption and Device Management Data Leakage Protection e-discovery and Forensics 25

26 Protect Information Encryption as part of Defense in Depth. Insight Reputation Network Access Control Host Integrity Checking Heuristic Detection Location Awareness Application Control Device Control SONAR Firewall IPS E N C R Y P T I O N Risk-based deployment: Whole Disk Encryption Removable Media Encryption Network Fileshare Encryption Gateway Encryption Desktop Encryption Antispyware Antivirus

27 Protect Information Data Loss Prevention as part of Defense in Depth. Three different Languages Insight Reputation Network Access Control Host Integrity Checking Heuristic Detection Location Awareness Application Control Device Control SONAR Firewall IPS Antispyware Antivirus E N C R Y P T I O N D L P DISCOVER MONITOR PROTECT Three different Countries ENDPOINT NETWORK STORAGE *Detection Technologies *Data Insight w/ *DLP for Tablets

28 Demo Storage Network Endpoint Symantec Corporation, All Rights R

29 Use Case #6 Business Requirements University System of Georgia requires the ability to enable efficient and reliable cloud services to increase security levels and reduce the overhead of administration and maintaining proficient staffing while providing separation of duties. RFI Reference How does your endpoint security management solution handle the following features? Cloud Security Management Cloud Sourcing (Real Time Updates/Protection) 29

30 A New Security Layer Above the Cloud Access Control Information Protection O Cloud Visibility 3 Control Security Compliance Private Cloud To embrace the cloud with confidence 30

31 Enable the Cloud Securely. Consume Security as a Service customers consume our products and solutions information from the cloud Extend Solutions to enable customers to extend their security reach for cloud services Build Solutions that enable the creation of secure and well managed public and private clouds

32 Best Practices in the embracing the Cloud What does the Cloud mean to my organization? Public Cloud Private Cloud Government Cloud Hybrid Cloud There has not been a significant Cloud breach, yet. The strong majority of breaches are using legacy systems; through 4 key aspects: Incursion, Discovery, Capture, Exfiltration Categorization/Classification of Information Many insist that it is to early to move sensitive information to the Public Cloud; the security models are not mature enough. Only move Public Information to the Cloud. Utilize the Cloud for what is was designed for: ease of access, reduced capital expenditures, ability to access NON-sensitive data anytime, anywhere. Internet Security Threat Report, Vol

33 Demo Symantec O Symantec Corporation, All Rights R

34 Demo- Using Symantec Endpoint Protection.cloud to Protect Your Business CISO Summit - November 2010

35 Use Case #7 Business Requirements University System of Georgia is interested in other solutions that may address similar issues or compliment the solutions already addressed by extending the feature set. RFI Reference How does your endpoint security management solution handle the following features? Workflow IT Analytics Automating Governance Infrastructure for incident response Infrastructure for audit retention compliance 35

36 Thank you! Copyright 2011 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. CISO Summit - November 2010

37 Additional Demo Videos Installation Videos

38 Demo - Mobile Management Installation CISO Summit - November 2010

39 Demo Installing Symantec Protection Center CISO Summit - November 2010

40 Demo Installing Symantec Endpoint Protection CISO Summit - November 2010

41 Additional Videos Product Demos CISO Summit - November 2010

42 Demo - Topology Viewer Video Demo part of Server Management Suite 7.1 CISO Summit - November 2010

43 Demo Delivering a Endpoint Recovery (V-Pro) Symantec Corporation, All Rights R

44 Demo Delivering a Temp Environment (V-Pro) Symantec Corporation, All Rights R

45 Demo Symantec Mobile Management 7.1 CISO Summit - November 2010

46 Demo- Symantec Endpoint Protection 12: Insight CISO Summit - November 2010

47 Demo Reputation Based Security CISO Summit - November 2010

48 Demo- Critical System Protection: Maximum Security for Physical, Virtual, and Cloud Servers CISO Summit - November 2010