Leading The World Into Connected Security. Dipl.-Inform., CISSP, S+ Rolf Haas Enterprise Technology Specialist Content Lead EMEA

Transcription

1 Leading The World Into Connected Security Dipl.-Inform., CISSP, S+ Rolf Haas Enterprise Technology Specialist Content Lead EMEA

2 History of Defining Largest Dedicated Delivering a Next Generation Architecture Security Provider Security Architecture Inventor of the world s most Broadest security product widely used computing Defining innovative industry approaches for coverage collaborative in the industry architecture and adaptive security Complete portfolio focused Defining countless Introducing standards security integrations which are sustainable upon security used in everyday and lives broadly ranging reaching from USB, WiFi, to IoT Leadership position in 6 of 8 Developing capabilities for new security paradigms Gartner Security in Magic Top 10 Most Influential Brands areas such as Software Defined Datacenter, Quadrants Cloud, and in the World IoT 2

3 The ATTACKERS are in between US already 3

4 WE 200,000 Unique malware samples discovered every DAY and attacks are more and more targeted MUST of Organizations admitted that they have 83% been under targeted attack EVOLVE of Organizations need weeks, 79% month and even years to discover attacks 1,2 Incidents per day with an average cost of $8900 per incident 150 Tier 1 Security Vendor 4

5 Building Security By Silo Creating a False Sense of Security TCO CapEx + OpEx Security Posture Point Products Layered Tools Parity TIME Advancement 5

6 Why the Security Industry Must change No Integration and No Standardization across Vendors Targeted Attacks Trial and Error Confiker ZEUS Hackers leave footprints - Information is available in various silos HOW can we integrate all silos to get realtime situational awareness X X X X X Layered Security Concept Security Connected Platform 6

7 Building Security By Silo Delivering Operationally Effective Security TCO CapEx + OpEx Security Posture Point Products Layered Tools Connected Architecture Parity TIME Advancement 7

8 Innovating the Security Connected Concept Consistently Creating Operational Effectiveness Consolidated Agent Network/ Vulnerability Management Endpoint/Vulnerability Management Hybrid Web Protection Host/ Network DLP Consolidation Endpoint/ Web Gateway Integration Security Connected Platform Standardized Architecture Single Console Network/Endpoint Integration One Time Password/ Web Gateway Global Threat Integration Intelligence Security Innovation Alliance Advanced Threat Defense Click Protect

9 Security Connected: Reality SIA Associate Partner SIA Technology Partner ( Compatible) 9

10 All Solutions Informed by Global Threat Intelligence Integrated Solutions Deliver Threat Reputation Network Activity Affiliations Geo-Location Ports/Protocol IP Address Application Domain Data Activity Web Reputation URL Web Activity Sender Reputation Mail Activity Address File Reputation DNS Server Network IPS Firewall Web Gateway Mail Gateway Host AV Host IPS 3rd Party Feed 300M IPS attacks/mo. 300M IPS attacks/mo. 2B Botnet C&C IP Reputation Queries/mo. 20B Message Reputation Queries/mo. 2.5B Malware Reputation. Queries/mo. 300M IPS Attacks/mo. Geo-Location feeds 10

11 Security Connected Platform They Layers Analytics OPTIMIZED PERFORMANCE FOR ACTIONABLE DECISION-MAKING Real-Time Engine Fully Extensible Contextually Aware Situational Awareness and Response Structured Data Unstructured Data 11

12 Security Connected Platform They Layers Threat Intelligence ADAPTIVE INTELLIGENCE PROVIDES STRONGER PROTECTION Global Threat Intelligence Local Threat Intelligence Organizational Threat Intelligence 3 rd Party Threat Intelligence 12

13 Security Connected Platform They Layers Countermeasures BROAD DEFENSIVE COVERAGE FROM ENDPOINT TO NETWORK Data Center Transformation Next Generation Endpoint Web and Identity Management Comprehensive Malware Protection Situational Awareness Cloud Protection Virtual Machine Protection Application Control Change Control Database Security Mobile Security HW Enhanced Security Application Control Device Control Endpoint Encryption VDI Protection Identity and Authentication Single-Sign On Cloud Access Broker Web Security Security Data Loss Prevention Advanced Threat Defense Network Protection Layered Endpoint Security Web Protection HW Enhanced Security SIEM Real-Time Visibility Vulnerability Management Policy Auditing and Reporting Centralized Management 13

14 Security Connected Platform They Layers Security Management SIMPLIFIED MANAGEMENT EXPERIENCE REDUCES EFFORT AND COST Adaptive Architecture Real-Time Reporting Intel Security Active Response Continuous Compliance Integrated Partner Ecosystem Protect, Detect & Correct Strategy Cyber Historian vs. Cyber Hunter Security Management 14

15 Complete Platform to Deliver Integrated Protection Protect. Detect. Correct. Analytics OPTIMIZED PERFORMANCE FOR ACTIONABLE DECISION-MAKING Threat Intelligence ADAPTIVE INTELLIGENCE PROVIDES STRONGER PROTECTION Countermeasures BROAD DEFENSIVE COVERAGE FROM ENDPOINT TO NETWORK Security Management SIMPLIFIED MANAGEMENT EXPERIENCE REDUCES EFFORT AND COST Context and Orchestration INTEGRATED DATA EXCHANGE DELIVERS COHESIVE DEFENSE 15

16 The Need for Context & Orchestration Proprietary Integration creates Complexity and point of Failure API-BASED INTEGRATIONS Product to Product Integration: n x (n-1) If 10 Systems want to talk to each other we need 90 API s Result Proprietary Integrations Version and Use Case Depended Point of Failure Complex n x (n-1) For 30 Systems we need 870 API s 16

17 BPM Asset Data Exchange Layer An innovative, real-time, bi-directional communications fabric providing with product integration simplicity. Risk Threat Identity Security components operate as one to immediately share relevant data between endpoint, gateway, and other security products enabling security intelligence and adaptive security. Activity Data Location THE SECURITY CONNECTED FRAMEWORK ADAPTIVE SECURITY ARCHITECTURE 17

18 Data Exchange Layer (DXL) Standardize integration and communication to break down operational silos DXL Integration Phases API-BASED INTEGRATIONS COLLABORATIVE ECOSYSTEM (DXL) Phase 1 Intel Security Products Phase SIA Partner (as of Result today 6 Partner) Proprietary Integrations Version and Use Case Depended Phase 3 The Big 5 Point of Failure Complex n x (n-1) Result Standardized Communication Real Time Information Exchange API and Version independent Open 18

19 Clarity to Drive Better, Faster Decisions Current state vs. Adaptive approach CURRENT STATE Limited scope. Limited point in time context. ADAPTIVE APPROACH Continuous monitoring and contextual analytics Product 1 Product 2 Product 3 Result Limited, reactive visibility and threat protection Result Faster, more proactive awareness of threats and anomalous events 19

20 The Question of all Questions! What are the steps you take when you discover something suspicious and how long does it take you from discovery to containment? 20

21 Steps and Timelines Fully Optimized process between hours Send suspicious file to AV Vendor Feedback from AV Vendor (+8 hours) Provide new EXTRA DAT to internal Team Deploy new EXTRA DAT to protect all Endpoints Customer CERT or SOC finds suspicious file Internal Forensic 0 hours

22 Steps and Timelines The Reality is between hours and more Internal Forensic Feedback from AV Vendor (+8 hours) Provide new EXTRA DAT to internal Team Deploy new EXTRA DAT to protect all Endpoints Detect and Protect in 5-7min with a fully connected Architecture based on Intel Security Data Exchange Layer Customer CERT or SOC finds suspicious file Send suspicious file to AV Vendor 99,8% time savings +8 hours internal QA Process hours is where the majority of customers sit 0 hours

23 Threat Intelligence Exchange Concept Apply the Power of Knowledge Global Intelligence Intel Security Threat Intelligence Exchange Server EXTERNAL INTELLIGENCE VirusTotal GLOBAL THREAT INTELLIGENCE Intel Security COMPANY SPECIFIC INTELLIGENCE Customer network HUMAN ORGANIZATIONAL INTELLIGENCE CERT Organizational Intelligence 23

24 Threat Intelligence Exchange One Central Threat Intelligence Repository Global Threat Intelligence NO TIE Server ATD 3 rd Party Feeds NO NO YES Data Exchange Layer NO epo VSE Threat Intelligence Module VSE Threat Intelligence Module 24

25 Direct TIE Integration via DXL Current Integration Overview TIE Integration via ATD Direct and indirect integrations NSP NGFW Web Gateway Gateway Global Threat Intelligence TIE Server ATD 3 rd Party Feeds Data Exchange Layer (DXL) epo ESM VSE Threat Intelligence Module 25

26 @rolfhaas