Palo Alto Networks. October 6

Transcription

1 Palo Alto Networks October 6

2 Agenda Malware Trends by the numbers Protect Locally Share Globally

3 Delivery methods 21.5% ~14% OF MALWARE HAS BEEN DELIVERED OVER APPS OTHER THAN WEB AND IN % 7.5% i.e. SharePoint IAN..15 APR..15 IUL..15

4 Decryption ~ 40% OF WEB MALWARE HAS BEEN DELIVERED OVER SSL DAY-TO-DAY IN % 46.5% 43.5% 24% i.e. Webmail File hosting Social media IAN..15 APR..15 IUL..15

5 File Types EXE files are known to be toxic/malicious for years DLL files became more toxic last year APK files became more toxic last year Office documents with Macro s Office with embedded executable

6 AV is dead? OF MALWARE IS NOT DETECTED BY ANY ANTI-VIRUS VENDOR

7 Agenda Malware Trends by the numbers Protect Locally Share Globally

8 CONTENT USERS APPLICATIONS KNOW WHAT S ON YOUR NETWORK AT ALL TIME BASED ON APPLICATIONS, USERS, AND CONTENT Classify all traffic by application (layer 7) with App-ID Tie users and devices to applications, regardless of location, with User-ID Scan content and protect against all threats, both known and unknown, with Content-ID

9 Structural Reduction of Attack Surface Provide true visibility Enable business-relevant apps & users Known threats Prevention TCP * Discover unknown threats End Point Prevention 83 UDP unknown OLD FW APP/USER VISIBILITY & CONTROL URL/AV/IPS /DNS APT SANDBOX PROTECT ENDPOINT SHARED THREAT INTEL AUTOMATED LOOPBACK PROTECTION INVESTIGATE THE RELEVANT

10 Zero-Day discovery with WildFire Advanced threat visibility and prevention on all traffic, all ports (web, , ftp, etc.) including SSL Global intelligence and protection delivered to all users Anti-malware signatures DNS intelligence Malware URL database Anti-C2 signatures Malware run in the cloud with open internet access to discover C2 protocols, domains, URLs and staged malware downloads Malware, DNS, URL, and C2 signatures automatically created based on WildFire intelligence and delivered to customers globally Stream-based malware engine performs true inline enforcement On-premises WildFire appliance available for additional data privacy Command-and-control Staged malware downloads Host ID and data exfil WildFire TM WildFire Users Soak sites, sinkholes, 3 rd party sources WildFire Appliance (optional) 32,000+ 7,500+ Customers NGFWs , Palo Alto Networks. Confidential and Proprietary.

11 Agenda Malware Trends by the numbers Protect Locally Share Globally

12 Founding Members: Purpose: The Cyber Threat Alliance is a group of cyber security practitioners that have chosen to share threat information with each other for the purpose of improving defenses against advanced cyber adversaries across member organizations and their customers , Palo Alto Networks. Confidential and Proprietary.

13 Founding Members: Membership: Open to any organization that can share a minimum volume of threat intelligence designed by the Alliance , Palo Alto Networks. Confidential and Proprietary.

14 AutoFocus Palo Alto Networks Threat Intelligence Service

15 What AutoFocus provides Prioritize important events Context around indicators and incidents Quick and proactive response Adversary Lotus Blossom Related indicators Connection: :443 DNS: gagalist.net Targets Government & Military Automatically export high-value indicator sets to security controls Prevent future attacks , Palo Alto Networks. Confidential and Proprietary.

16 AutoFocus Architecture Intelligence with context 900M sessions 540M samples 110B artifacts WildFire TM Palo Alto Networks Threat Intelligence Cloud URL intelligence Dynamic DNS rd party feeds WildFire intelligence correlated WildFire detects unknown threats on NGFW & Traps +32,000 devices worldwide 5M samples per day 70k unique malware per day , Palo Alto Networks. Confidential and Proprietary.

17 Adding Context Intelligence on actors, campaigns and attack methods Context Analytics , Palo Alto Networks. Confidential and Proprietary.

18 , Palo Alto Networks. Confidential and Proprietary.

19 , Palo Alto Networks. Confidential and Proprietary.

20