Applications erode the secure network How can malware be stopped?

Transcription

1 Vulnerabilities will continue to persist Vulnerabilities in the software everyone uses everyday Private Cloud Security It s Human Nature Programmers make mistakes Malware exploits mistakes Joe Gast Recent headlines Do you trust end users??? Applications erode the secure network How can malware be stopped? Web 2.0 Tunneling Apps File Transfer, Video, Audio, Chat, Browser Gaming, , CRM, etc Allow ports 80/443 Allow Everything Yahoo! ebay HOW? HOW? Important Apps Unimportant Apps ORACLE Salesforce Skype AIM myspace amazon.com SAP SIEBEL Twitter YouTube facebook BitTorrent 1

2 Legacy Gateway Security Model Implementation What if you had a security solution that could Server Server Server Server Server THREAT THREAT Internet Your security solution is inspecting all traffic coming in and going out from the Internet? Right? Automatically block attacks (intrusion, malware, etc) Automatically identify applications by their DNA Automatically identify users Illuminate all application traffic on the network Allow you to control by application and user Dell SonicWALL network security capabilities Global threat visibility and intelligence First-Generation Firewall Capabilities Application Visibility and Control Supports Stateful Packet Inspection, NAT, IPSec VPNs, & SSL VPNs Granular control & real-time visualization of applications running North America 946,497,494 IPS attacks Europe 467,195,993 IPS attacks Integrated IPS Protects against a comprehensive array of network-based threats and vulnerabilities Asia 136,43, 706 IPS attacks SSL Decryption and Inspection AD/LDAP Integration (SSO) Decrypts and inspects SSL traffic for threats, applies application, URL and content control policies User identification and activity are made available through seamless AD/LDAP SSO South America 85,036,625 IPS attacks Africa 12,087,222 IPS attacks Bump-In-the-Wire Deployment Anti-Malware & Content Transparent mode deployment, in addition to Layer-3 Gateway & Cloud AV, Anti-Spyware, Anti-Spam, & URL/Content 4-month Snapshot: Sep Dec 2013 Oceania 11,139,882 IPS attacks +1M Sensors 249 Countries 24X7 X365 15M+ Counter-measures 50K+ Malware samples collected daily 15K+ Malicious event analyzed daily Application visualization & control Break the malware cycle URL Page Visit Compromised Good Site Identify Application Signatures By Application By User/Group LDAP/SSO By Content Inspection Categorize By Application By Application Category By Destination By Content By User/Group Control Prioritize Apps by Policy Manage Apps by Policy Block Apps by Policy Detect and Block Malware Manage network bandwidth SSL Decryption Intrusion Prevention Network Anti-Virus Cloud Anti- Virus Botnet Exploit Malware Request Malware Malware Hosting Site 2

3 Web content filtering Dynamically updated rating architecture. Application traffic analytics Web-based management Web Caching and rating architecture IP based HTTPS content filtering 16M+ 56+ Granular level blocking based on predefined Report & Analyze Application traffic analytics suite - Website rating database used to block categories. integration with Dell SonicWALL GMS, inappropriate and illegal content, reduces IP-based HTTPS content filtering to control Analyzer & Scrutinizer provides real-time organizational liability and increases user access to web sites over encrypted and historic analysis of data transmitted productivity HTTPS through the security solution. Intrusion detection & prevention NSS Labs 2013 & 2014 IPS SVM, Recommended Quadrant Detect & Prevent Software vulnerabilities such as buffer Comprehensive Pure Pattern Matching Reporting On-box reporting overflows, peer-to-peer and instant Buffer Overflow Detection IPfix / Netflow exporting messaging exploits, backdoor attacks, Botnet detection & blocking and other malware. DoS / Flood detection Geo IP monitoring & blocking SSL decryption & inspection Gateway anti-malware powered by the cloud Scans & Prevents installation of malicious spyware and 13M+ signatures detecting millions of pieces Unlimited Dell SonicWALL Reassembly-Free Deep disrupts background communications of malware and intelligent enough to Packet Inspection engine scans analyzes from existing spyware programs that detect new variants providing effective all files in real time regardless of file transmit confidential data All protocols zero-day protection size or compression. across every port, including SSL traffic with DPI SSL. SSL decryption and inspection Deep Packet Inspection of Secure Socket Layer (DPI-SSL) SSL traffic decrypted, inspected, then re-encrypted Client DPI-SSL and Server DPI-SSL Inspects SSL sessions on all ports independent of protocol Content can be scanned as well as injected (e.g. HTTP/S block pages) All Security Services are supported Extends Deep Packet inspection to SSL traffic Inspects Inspects SSL traffic across other security Granular Control Inclusion/Exclusion list to customize scanning both LAN and WAN traffic for mechanisms, such as URL filtering, IP & which traffic DPI-SSL inspection allows threats and vulnerabilities Gateway AV better management of CPU Dell SonicWALL network security capabilities Highly efficient single-pass RFDPI security engine Proven & proprietary Reassembly-Free Deep Packet Inspection Deep SSL Packet Decryption Inspection 1. Stateful Packet Inspection 2. Intrusion Prevention The front-line network defense against application attacks 3. Application Identification & Visualization Can t control what you can t see 4. User Identification through Single Sign On (SSO) Correlate network traffic with users 5. Application Control Granular control (Allow Facebook, Block Social Gaming) 6. SSL Decryption Don t allow threats to tunnel through encrypted channels 7. Threat Prevention Anti-X (Virus/Trojan/Malware) Input Packet TCP Reassembly Preprocessors Low-latency ultra-scalable single pass Deep Packet Inspection engine Signature Signature Pattern Definition Language Interpreter Deep Packet Inspection Engine Output Packet Postprocessors Policy Decision API 3

4 Linearly scalable on a massively multi-core architecture Intra-VLAN Security Model Implementation Malware may be introduced within any single zone, but will be inspected, blocked, and alerted to as it attempts to propagate to other zones. Server Server Server Server Server The Firewall now inspects data going between all network zones, including internal-to-internal traffic 1 Core 96 Cores From the TZ to an NSA and even the SuperMassive BYOD Users Internet All network traffic can be forced into the appropriate zone via VLAN Tagging on switches, and with Layer 3 Gateways on the firewall. Its all the same security engine! 20 Event Notification A virus is introduced internally. It infects the other zones on network. Activate Gateway Antivirus Inspection on Zone Interface. Gateway scans, stops, and discards virus. A log VIRUS ALERT is sent to the admin. Off box visualization and network intelligence Export Rich data through NetFlow/IPFIX with Extensions Provides security monitoring for distributed installations Run collector in the cloud, send data over VPN 21 Dell SonicWALL Security Appliance Lineup The all new Dell SonicWALL Gen6 Trusted Zone Appliance SMB/Campus/Branch Enterprise, Data Center SuperMassive Series TZ Series NSA Series SuperMassive E10800 SuperMassive E10400 TZ SOHO/W TZ 300/W TZ 400/W TZ 500 TZ 600 NSA 4600 NSA 3600 NSA 2600 NSA 6600 NSA 5600 SuperMassive 9800 SuperMassive 9600 SuperMassive 9400 SuperMassive

5 Dell secure mobile access solution Enable mobile worker productivity while protecting from threats Industry leading security effectiveness Provide simple, policy-enforced, per app VPN access to permitted resources Enforce and manage mobile device policy terms Authenticate user and validate app and device integrity Enable secure SSL VPN connections and granular network access controls Centralize access policy management Mobile Connect app Secure Remote Access appliance 1.78 Billion Malware blocked 14 Zero day exploits blocked Trillion Intrusions prevented 50,000+ Malware samples collected every day ICSA Labs Next-Generation Firewall Evaluation results: Certifications 100% Effective for application identification & control (Productivity) 100% Effective against malware (Protection) 100% Effective for user-based authentication Dell No SonicWALL false positives is the first and only firewall to receive the ICSA Labs Enterprise Firewall Certification and ICSA Labs Next-Generation Firewall Evaluation. Common Criteria FIPS IPv6 / USGv6 UC-APL* VPAT Suite B / CsFC* VPNC WiFi Alliance Q&A and Thank you! Joe Gast Martin and Associates joe.gast@martinandassoc.com 5