Synchronized Security

Transcription

1 Synchronized Security Revolutionizing Advanced Threat Protection Justinas Valentukevicius Channel Account Executive, Baltics 1

2 About Sophos 3

3 Sophos Snapshot Founded 1985 in Oxford, UK Appx. $400 million in FY13 billings Appx. 2,200 employees Over 220,000 customers Over 100 million users HQ in Oxford, UK and Boston, MA Best in class renewal rates (90+%) 20,000+ channel partners OEM Partners: Cisco, IBM, Juniper, Citrix, Lenovo, Rackspace Key development centers: Abingdon, UK; Vancouver, BC; Karlsruhe, Germany; Linz, Austria; Budapest, Hungary; Ahmedabad, India 20+ additional offices worldwide Sophos in Oxford, UK 4

4 Sophos Historical Timeline Founded in Abingdon (Oxford), UK Supplied security software to UK forces in 1st Gulf War Acquired ActiveState Acquired Utimaco Safeware AG Acquired Astaro Acquired Cyberoam Peter Lammer c.1985 Jan Hruska c First checksumbased antivirus software First signaturebased antivirus software Voted best small/medium sized company in UK US HQ established in Boston Awarded 3 Queen s Awards for Enterprise, Innovation and International Trade Majority interest sold to Apax Partners Acquired DIALOGS 5

5 Sophos Major Global Sites Vancouver Canada 155 San Francisco Bay Area 10 Others The World 150 Wiesbaden Germany 100 Aachen Germany 95 Oxford UK 425 Boston MA 240 Paris France 50 Karlsruhe Germany 165 Munich Germany 40 Linz Austria 60 Dortmund Germany 30 Budapest Hungary 65 Singapore 50 Ahmedabad India 550 Tokyo Japan 40 Manila Philippines 30 Total Sophos Employees 2,200 Sydney Australia 50 6

6 Sophos Partners (OEM and Alliances) Companies that OEM Sophos Security Technology Strategic Alliance Partners 7

7 Threat Volume Total Malware ,000 previously unseen files received each day within SophosLabs Source: SophosLabs

8 3 Increasing Attacker Sophistication Zero-day Vulnerabilities Price of Zero-day attacks in various applications or operating systems Adobe Reader Mac OSX Android ($ 000) Flash / Java Source: Forbes 8 Firefox / Safari MSFT Word Chrome / IE Windows IOS Increasing Volume of Zero-day Vulnerabilities Zero-day vulnerabilities discovered per year Source: Symantec 9

9 Mid-Market Faces Same Threats as Large Enterprise High Profile Enterprise Breaches Sony Pictures Hackers gained access to *all* company data, from unreleased movies to sensitive s. Adobe 150,000,000 passwords stolen. Target 110 million records stolen. Home Depot 56 million credit cards and 53 million addresses stolen. UPS Store Malware on PoS systems in 24 US states left customers at risk of identity theft and credit card fraud. Impact Mid-Market Equally Racing Post SQL injection attack led to leaking 677,335 user accounts for this sports betting website. Signature Systems Criminals installed malware and then stole the card data of the restaurants customers. Park N Fly Website compromise exposed customer card number, name, billing address, card expiration, CVV code. Swansea Police Dept. CryptoLocker police to pay cybercriminals to decrypt department files. LaCie Online store infiltrated, exposing customer credit card numbers and contact information. Data Breaches by Company Size (# employees) Unknown More than 100,000 10, ,000 7% 22% 31% 20% 11% 9% ,000 At least 51% of data breaches affect organizations with fewer than 10,000 employees Source: Verizon data breach investigations report,

10 but Don t Have Adequate Resources to Respond 20,000+ Employees An Enterprise Approach Is Not Realistic Average Number of People Dedicated to IT Security Large Enterprises 5,000-19,999 Employees Mid-Market Enterprises Employees Employees 1,000-4,999 Employees Key Security Challenges Faced by Mid-Market Growing number and sophistication of security threats Increasing cost and exposure of "getting it wrong" Traditional, complex point solutions increase cost and erode usability and manageability Fragmented and constantly changing vendor landscape is difficult to navigate and understand Limited in-house IT security personnel and expertise Pressure on resources, budgets and time Enterprise security issues without enterprise class budgets 11

11 Mid-Market Focus with Value Proposition that Resonates with Enterprises of All Sizes % OF SOPHOS BILLINGS IT SECURITY MARKET SOPHOS CUSTOMER EXAMPLES 20% Large > 5,000 Employees $4.9Bn 18% OF TOTAL c. 22K ENTERPRISES 57% Mid-Market 100 5,000 Employees $18.5Bn 69% OF TOTAL c. 1M ENTERPRISES 23% SMB < 100 Employees $3.5Bn 13% OF TOTAL c. 64M ENTERPRISES 13

12 A Proven Market Leader Endpoint Encryption Leader UTM Unified Threat Management EPP Endpoint Protection Client Sec/ Endpoint Wave Leader SWG Secure Web Gateway SEG Secure Gateway ENF Enterprise Network Firewall MDP Mobile Data Protection EMM Enterprise Mobility Management Endpoint Encryption Champion Endpoint Anti- Malware Champion Next Generation Firewall Champion 16

13 Only Vendor Ranked as a Leader in Endpoint, UTM and Encryption Endpoint, UTM and Encryption Represent [73]% of Sophos Billings (1) LEADER in all 3 of these Gartner Magic Quadrants LEADER in 2 of these Gartner Magic Quadrants LEADER in 1 of these Gartner Magic Quadrants (2) PRESENT in 1 of these Gartner Magic Quadrants Notes: 1. Figures refer to fiscal year Fiscal year-end March In February 2015, FrontRange and Lumension announced they would merge and form HEAT Software, backed by Clearlake Capital Group 17

14 Unique Balance Between Endpoint and Network ENDPOINT NETWORK 10,8% 54,9% 100,0% 93,7% 100,0% 100,0% 100,0% 89,2% 100,0% 100,0% 100,0% 100,0% 100,0% 45,1% 6,3% 18

15 Complete Security, Made Simple Complete Security Network Servers Anti-Malware End Users and Devices Next Gen Firewall Antimalware and IPS URL Filtering Network Access Control Webserver Protection Virtualization Anti- Malware Mobile Encryption Patch Assessment Wireless VPN Anti-Spam Encryption App Control V-Shield Application Control Device Control Encryption for Cloud Endpoint Web Protection Made Simple. Simple Deployment Simple Protection Simple Management On premise Virtual Cloud User self provision Active Protection real-time protection powered by SophosLabs Live lookups via the Cloud SophosLabs experts tune the protection so you don t have to Intuitive consoles: On Premise or From the Cloud Backed by expert support 19

16 Sophos Labs Using Big Data to Protect Information SAMPLES TELEMETRY SOPHOSLABS HUMAN DECISION MAKING AUTOMATED LEARNING & AUTOMATION AT HOME ON THE MOVE REMOTE OFFICE HONEY POTS BIG DATA ANALYTICS Dynamic & Static HEADQUARTERS 20

17 SophosLabs Protection Via the Cloud Better, Real-time Protection Made Simple Malware Data Website URL Database HIPS Rules SophosLabs Active Protection Sensitive Data Types Application Categories Device Data Reputation Data Malicious URLs Spam Campaigns Mobile Application Reputation Anonymizing Proxies Application Patches Correlated Intelligence Reputation Data Content Classification Network Servers Devices Web Web App FW Wifi Next Gen FW Web File Smartphone/ Tablet Data Workstation/ Laptop 21

18 Discover Sophos Project Copernicus 22

19 Copernicus 23

20 Project Copernicus + 24

21 Next Gen Network Security Leading Threat Protection Capabilities Layer 8 User Identity Based Policies Sophos RED for Distributed Networks Secure Wi-Fi & Access Points Common architectures enable rapid integration Leading Application Control Capabilities High Performance Packet Filtering Web, Endpoint and Mobile Protection Architecture Platform Modular Open Source iview Logging & Reporting 25

22 Setting a new benchmark for firewalls Project Copernicus Comprehensive Management Every feature, on-premise and cloud, dashboards and reports Simple to Use From evaluation, licensing, deployment to day-to-day management Secured by Galileo Network, Enduser and Cloud combine to deliver advanced protection Re-designed workflows User-based policy model 26

23 Extensive UX Research and Design More friendly, inviting, and useful Fresh New User Experience A fresh ground-up design approach to user interface, navigation, and data presentation that s engaging and useful 27

24 Built-in Discovery Learn-as-you-go with context-aware documentation and visual reminders Contextual Documentation Provides documentation and visual cues directly in the navigation structure to remind users what that area of the product does 28

25 Built-in Policy Templates For common business applications like Exchange/Mail, SharePoint, Lync, etc. Business Application Policy Templates Provide access to business application servers or services quickly and easily Common templates include Exchange, SharePoint, Lync, and others TBD 29

26 Built for Real People Plain language policy descriptions Policy in Plain Language System automatically generates plain-english description of the policy in real-time as options are selected. 30

27 iview - Added Visibility 31

28 Easy evaluation using Discover Mode and Bridge Mode Two options to produce a comprehensive Security Audit Report Discover Mode Mirror Port Existing Firewall Existing Switch Bridge Mode Protected Network Discover Mode Discover Mode TAP /Mirror No disruptive changes to the network Mirrors traffic through UTM/NGFW Monitor only, no enforcement Visibility (no enforcement) into: User Behavior User-App Risks & Usage Web Risks & Usage Intrusion Attacks & ATP Client Insights (Heartbeat), Virus, VPN coming post v1 Security Audit Report Evaluation using Bridge Mode Offers extended reporting insight including Heartbeat Allows optional policy enforcement Traffic is passing through UTM/NGFW 32

29 User Threat Quotient Identifying potential security issues before they become problems User Risk Quotient Graph (Low, Medium, High-risk) with pop-over and drill-down options Risk Meter displays average threat score for the selected user, and compared to other users. User Risk Analysis Behavior-based analysis of Web behavior ATP triggers Ranks users Identifies top risks Enables quick and easy policy changes Broad-based or individual education Targeted intervention 33

30 Security Heartbeat Network and Endpoint share heartbeat and context to work better together Endpoints Access Control Heartbeat & Context Compliant Partially Compliant Non-Compliant Non-Compliant Suspect Endpoint Non-compliant Endpoints blocked from network and identified SG Firewall Server Partially-compliant Endpoints blocked from servers and identified Advanced Threat Protection 1. ATP detects and blocks suspect C&C connection 2. Context requested from Endpoint Internet SG Firewall Devices on the network share heartbeat and context Firewall enforces access policy based on level of compliance Firewall requests context from Endpoints in the event of suspicious network traffic Two products work better together to provide enhanced protection and improve response times to incidents 3. Connection context provided (user, process, etc.) 4. Admin notified about ATP event including context 34

31 Discover Sophos Project Galileo 35

32 36

33 Sun-centric Earth-centric view of of planetary revolution Simple Systematic Working in concert Relationship to nearby objects Based on multiple points of information Advances in technology Complex Myopic Independent of nearby objects Assumptions based on limited knowledge Best available technology at the time 37

34 Increasing attacks, increasing sophistication Attack surface exponentially larger Laptops/Desktops Phones/Tablets Virtual servers/desktops Threats more sophisticated Attacks are more coordinated than defenses 38

35 System-centric Threat-centric view of security Simple Systematic Working in concert Relationship to nearby objects Based on multiple points of information Advances in technology Complex Myopic Independent of nearby objects Assumptions based on limited knowledge Best available technology at the time 39

36 Project Galileo Security must be comprehensive The capabilities required to fully satisfy customer need Sophos Cloud Security can be made simple Platform, deployment, licensing, user experience Next Gen Enduser Security Next Gen Network Security Security is more effective as a system New possibilities through technology cooperation heartbeat Project Galileo Integrated, context-aware security where Enduser and Network technology share meaningful information to deliver better protection. SOPHOS LABS 40

37 Galileo delivers comprehensive security CORPORATE DATA WINDOWS PHONE ios WINDOWS MAC Prevent Malware Detect Compromises Remediate Threats Investigate Issues Encrypt Data ANDROID LINUX 41

38 42

39 Next Generation Threat Detection Sophos Cloud Application Control Application Tracking Reputation Web Protection IoC Collector Routing Security Web Filtering Intrusion Prevention System Firewall Threat Engine SOPHOS SYSTEM PROTECTOR Galileo Heartbeat heartbeat Galileo Heartbeat SOPHOS FIREWALL OPERATING SYSTEM Threat Engine Live Protection Emulator HIPS/ Runtime Protection Device Control Malicious Traffic Detection Proxy Selective Sandbox Application Control Data Loss Prevention ATP Detection Compromise User System File Isolate subnet and WAN access Block/remove malware Identify & clean other infected systems 43

40 Improved Threat Detection Sophos Cloud Application Control Application Tracking Reputation Web Protection IoC Collector Routing Security Web Filtering Intrusion Prevention System Firewall Threat Engine SOPHOS SYSTEM PROTECTOR Galileo Heartbeat heartbeat Galileo Heartbeat SOPHOS FIREWALL OPERATING SYSTEM Threat Engine Live Protection Emulator HIPS/ Runtime Protection Device Control Malicious Traffic Detection Proxy Selective Sandbox Application Control Data Loss Prevention ATP Detection Compromise User System File Lockdown local network access Remove file encryption keys Terminate/remove malware Identify & clean other infected systems 44

41 Automated Protection of Endpoints Sophos Cloud Application Control Application Tracking Reputation Web Protection IoC Collector Routing Security Web Filtering Intrusion Prevention System Firewall Threat Engine SOPHOS SYSTEM PROTECTOR Galileo Heartbeat heartbeat Galileo Heartbeat SOPHOS FIREWALL OPERATING SYSTEM Threat Engine Live Protection Emulator HIPS/ Runtime Protection Device Control Malicious Traffic Detection Proxy Selective Sandbox Application Control Data Loss Prevention ATP Detection Endpoint Win Mac Mobile Discover unmanaged Endpoints Could it be managed? Self-service portal setup User authentication Distribute security profile 45

42 Network Visibility & Control Application Control Application Tracking Reputation Web Protection IoC Collector Routing Security Web Filtering Intrusion Prevention System Firewall Threat Engine Live Protection Sophos System Protector Emulator HIPS/Runti me Protection Device Control Galileo Heartbeat Malicious Traffic Detection Galileo Heartbeat Proxy Selective Sandbox Sophos Firewall Operating System? Application Control Data Loss Prevention Threat Engine ATP Detection i App Info User System File Query if Top 10 bandwidth user Query endpoint for App info Identify other systems with same app Update all NGFW with app characteristics 46

43 Improve TCO Distributing security workload Application Control Application Tracking Reputation Web Protection IoC Collector Routing Security Web Filtering Intrusion Prevention System Firewall Threat Engine Sophos System Protector Galileo Heartbeat Galileo Heartbeat Sophos Firewall Operating System Threat Engine Live Protection Emulator HIPS/Runti me Protection Device Control Malicious Traffic Detection Proxy Selective Sandbox Application Control Data Loss Prevention ATP Detection i Compromise User System File Endpoint secure Turn off HTTPS scanning Endpoint compromised Activate HTTPS scanning 47

44 Wrapping Up 48

45 Project Galileo Difference Project Galileo System-Centric Simple Comprehensive Prevention, Detection, Investigation, Remediation, Encryption Enduser, Network, Server Automated Block unknown, advanced, coordinated attacks Competition Threat-Centric Complex Incomplete Prevention Point Product Manual Block the known 49

46 Conclusion 50

47 Security Made Simple RESULTS More Effective Security Users secure and productive, whatever device they are using. Fewer technologies and vendors simplifies implementation Less Investment No need for ton of time spent on security-focused IT tasks You ll consolidate licensing and get more from budgets 51

48 Complete Security Can Be Made Simple Complete Security Wherever the user is, whatever device they use Deployed How You Want On premise, as a service or as a hardware or virtual appliance Made Simple Easy setup, managed via Cloud, etc. 52

49 Sophos Ltd. All rights reserved. 53