Integrating MSS, SEP and NGFW to catch targeted APTs

Transcription

1 #SymVisionEmea

2 #SymVisionEmea Integrating MSS, SEP and NGFW to catch targeted APTs Tom Davison Information Security Practice Manager, UK&I Antonio Forzieri EMEA Solution Lead, Cyber Security 2

3 Information security to cyber security WE EXIST IN A HYPER CONNECTED AND COMPLEX WORLD CYBER IS MOVING UP THE BUSINESS RISK REGISTER NATIONAL CYBER STRATEGIES & DATA PROTECTION LEGISLATION ARE GAINING SPEED DETECTION, PRIORITISATION & RESPONSE IS CHALLENGING

4 Targeted attacks just getting worse! % Increase in targeted attack campaigns Source: Symantec Internet Security Threat Report 2014 Volume 19 4

5 Rapid detection & response a significant challenge! Prepare Protect Detect Respond Recover Data & Process & People Stopping Incoming Attacks Finding Incidents Containing & Remediating Problems Restoring Operations Realization Breach is Inevitable Customer Needs Shift Protection Only Protection + Detection & Response 5

6 Solving the challenges: Advanced Threat Protection Focused on solving customer problems Protection only Help me Protect, Detect and Respond Tell me about them faster & better than anyone else, across all ports and protocols, whether blocked or detected Don t show me 100s of 1000s of events in a big list - Prioritize your detections so I can maximize my time Incident Responder & Security Operations Tell me what it means to me: details on why it is malicious, what it did, how it got in, what I can do about it, what it means in a global context 6

7 Security evolving in response Managed Security Services (MSS-ATP) 7

8 Evolution of network security technologies Traditional UTM or ISA Next Gen FW STAP Determine who can talk to who, but they can t hear what s being said. Port & protocol based IP-based detection Some IPS capabilities Limited to catching what s known Signature-based IPS & AV URL filtering Application control Analyzes files to detect unknown & zero-day malware Virtual Execution Sandboxing File hash lookups 8

9 Symantec offers great proactive protection today Symantec Global Intelligence Network Endpoint Protection Web Security Security IPS Prevents exploits Blocks command and control communication SONAR Insight Skeptic TM Disarm Behavioral analysis Analyzes over 1400 behaviors File reputation World s largest with intelligence on over 8 billion Intelligence Sharing Advanced spear phishing heuristics 100% unknown virus SLA Spear phishing attachment sanitization 95% + effectiveness Real Time Link Following Real time blocking Follows URL to true destination with Skeptic malware analysis 9

10 Evolution in network and endpoint still doesn t answer all Q s TODAY Manual correlation & remediation NetSec VX Network Security Group Endpoint Security Group Endpoint Protection Manager Network Security technology detects suspected Malware Determines whether malware is known and if endpoint has blocked it Verifies whether endpoints are compromised Determines if / where infection has spread Launches corrective actions Initiates endpoint actions (clean, block, quarantine, gather forensics, ) 10

11 Introducing Managed Security Services Advanced Threat Protection 11

12 Managed Security Services Advanced Threat Protection (ATP) Network Security Endpoint Security Security Intelligence Threat Experts Automated Triage Workflows Integration Rapid Response Operational Efficiency Attack Visibility 12

13 Symantec MSS IS big data security analytics DeepSight Global Threat Intelligence Log Collection Platform Security Analysts Customer Premise Data Warehouse Symantec SOC Customer Portal 13

14 Symantec IS security intelligence 7 Billion File, URL & IP Classifications Capturing previously unseen threats & attack methods 1 Billion+ Devices Protected More visibility across devices creates better context and deeper insight 2.5 Trillion Rows of Security Telemetry Putting big data analytics to work for every end user 2B+ events logged daily Monitors Threats in 157+ countries Over 100,000 security alerts generated annually 14 Data Centers World Wide 200,000 daily code submissions 550 Threat Researchers 14

15 Recent news: Symantec fighting advanced cyber threats GameOver Zeus Cryptolocker

16 Efficient detection and response should be be integrated Network-based Adv. Threat Detection MSS Advanced Threat Protection Symantec Endpoint Protection 16

17 Advanced Threat Protection Alliance Threat Emulation Wildfire Advanced Malware Protection (AMP) 17

18 What does MSS-ATP actually do? Network Adv. Threat Detection Virt Exec Symantec Global Intelligence Network GIN & Insight file reputational database adds global threat intelligence and context to detected threats Outcome: Protected INCIDENT Effective Detection of Advanced Threats Only Critical Threats Prioitised Efficiency Savings for Customers Symantec Endpoint Protection Symantec Managed Security Services 18

19 Insight detects targeted attacks Leverages file reputation to detect unknown files File A File B File C Bad Reputation Good Reputation Never before seen Targeted attacks use custom malware that can evade traditional defense technologies These custom malware files have never been seen before, and only appear in the targeted attack Insight can effectively detect these unknown or custom malware files without risk of false positives 19

20 Increased efficiency of threat investigations Sources SEP Correlation File Reputation & MSS Potential Threat List Potential Threat List Potential Threat List FILE A Network FILE B 20

21 Demo Managed Security Services Advanced Threat Protection 21

22 Managed Security Services - Response Release 2 (Early CY2015) Symantec Global Intelligence Network Billions of files (20 million new each week) 150 million endpoints 240,000 sensors across 200 countries Network Adv. Threat Detection Adversary & Threat Intelligence Virt Exec INCIDENT Symantec Endpoint Protection Symantec Managed Security Services Outcome: Not Protected RESPONSE Fingerprint Quarantine Threat behaviour endpoint (VX) OUTCOME Threat info (multi-source) Search for file hash Search File for Reputation IOCs Malware Origin clean Intelligence Network Mitigation containment guidance Outcome: Protected Increased security policy based on specific IP/app/user 22

23 Unified security next steps Leveraging our intelligence Symantec Gateway Security: Threat Defense Provides a prioritized list of suspicious activity discovered at the gateway Symantec SEP & Security.cloud: ATP Provides analysis of targeted attack activity observed in Symantec Incident Response Expert help to deal with a cyber incident Managed Security Services ATP Correlates endpoint data with events from 3 rd -party network security vendors, to discover suspicious activity 23

24 Managed Security Services Advanced Threat Protection (ATP) Network Security Endpoint Security Security Intelligence Threat Experts Automated Triage Workflows Integration Rapid Response Operational Efficiency Attack Visibility 24

25 How to get more information MSS Client? Reach out to your MSS Service Manager Symantec SEP customer? Reach out to your local rep go.symantec.com/ms s Follow us on Endpoint Protection Symantec Global Intelligence Network MSS Advanced Threat Protection Partner Network Security Gateways 25

26 #SymVisionEmea Thank you! Tom Davison Antonio Forzieri Copyright 2014 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. 26