INCREASINGLY, ORGANIZATIONS ARE ASKING WHAT CAN T GO TO THE CLOUD, RATHER THAN WHAT CAN. Albin Penič Technical Team Leader Eastern Europe

Transcription

1 INCREASINGLY, ORGANIZATIONS ARE ASKING WHAT CAN T GO TO THE CLOUD, RATHER THAN WHAT CAN Albin Penič Technical Team Leader Eastern Europe

2 Trend Micro 27 years focused on security software Headquartered in Japan, Tokyo Exchange Nikkei Index (4704) 8 consecutive years on Dow Jones Sustainability Indexes Customers include 48 of top 50 global corporations employees, 38 business units worldwide Enterprise Midsize Business 500k commercial customers & 155M endpoints protected Consumers r Small Business

3 27 Years of Innovation 1995: LAN Server Security 1996: Gateway Security 2008: Trend Micro Smart Protection Network 2010: Integrated Virtualization Security 2012: Breach Detection 2013: Cloud Computing Security 2016: Network Defense 3

4 4

5 Challenges 5

6 Many Attacks Include Phishing s External Phishing attacks: May target specific individuals or companies Customer malware or URL Ransomware more prevalent Internal Phishing Attacks: Less common, more serious Indicator of an attack already in progress within an organization Not caught by gateway security 6

7 Advanced Malware Difficult to Detect 90% of malware is used only once Network Breach Detection Systems help but miss traffic between offnetwork devices and SaaS services MS Office files with malware used in 60% targeted attacks 60% 7

8 User behavior changing: Attachments Cloud File Sharing 8 gateways don t see files which are already in the cloud!

9 What are Users Uploading to the Cloud? Compliance data? Sensitive information? 9

10 Many Companies Gradually Move to Cloud Intermediate stage to full cloud deployment May always keep group of users on premises Want equivalent protection without extra management 10

11 Before Cloud Apps Network boundary Most components are inside network boundary Can add layered protection including endpoint, SharePoint, DLP, gateways, sandboxing

12 Endpoints are frequently outside the corporate network Network boundary and documents move to the cloud, gateways can t see them

13 An attacker sends a zero-day infected PDF to a remote employee s personal

14 The employee uploads to Office 365 Another employee sees the PDF and downloads it

15 And this employee sends the PDF to a customer Customer

16 Securing SaaS-based Applications Advanced Threat Detection Finds zero-day and hidden threats Sandbox file analysis in the cloud Web reputation for URLs in /files Data Loss Prevention (DLP) Discovery and visibility into confidential data usage. DLP enforcement for cloud file sharing 240 customizable templates Direct cloud-to-cloud integration using vendor API s. No user changes, rerouting, or web proxy. 16

17 Cloud App Security s DLP Functionality 240 built in compliance templates which can be customized Import, create your own templates Exchange Online OneDrive for Business, Box, Dropbox, Google Drive, SharePoint Online Discovery (manual scan of database) Visibility / Reporting Enforcement delete/quarantine Not available* * in-line blocking of DLP violations is not available due to a limit of the Microsoft API 17

18 Cloud App Security Architecture API s https DLP URL scan Malware scan / file risk assessment (Microsoft Azure datacenters) https Sandbox Analysis <2% of files (Trend Micro datacenters) Trend Micro Cloud App Security 18 All communications encrypted No /files stored Quarantines located in customers accounts for Office 365, Box, Dropbox, Google Drive

19 Cloud App Security Service Delivery Netherlands US Germany US Japan Cloud App Security service, hosted by Microsoft Azure Sandbox service (<2% files), hosted by Trend Micro 99.9% Available No /files stored by Trend Micro Quarantines located within customer accounts for Office 365, Box, Dropbox US & EMEA sites are not interconnected All communications use encrypted https 19

20 Simple and Elegant Integration with SaaS Services API Cloud App Security Direct cloud-to-cloud integration using vendor s API s No impact to user/admin functionality Supports all devices, anywhere Fully automatic setup (contact Trend Micro for best practices) MX R e c o r d S o f t w a r e U s e r settings We b p r o x y 20

21 Find Hidden and Zero Day Threats Document Exploit Detection Parses documents to look for attempts to exploit an application Known exploits identified for deletion/quarantine Files with suspect exploits sent to sandbox for behavioral analysis Key technology in helping Trend Micro discover more vulnerabilities in 1H 2015 than all other security vendors combined 21

22 Find Hidden and Zero Day Malware Dynamic Sandbox Malware Analysis versus Static technique: Checking fingerprints for known bad criminals (similar to antimalware scanning) Dynamic technique: Observing criminal behavior with a surveillance camera (similar to virtual sandbox analysis) 22

23 Find Hidden and Zero Day Malware Dynamic Sandbox Analysis Leverages technology from Trend Micro Deep Discovery: 23

24 Example of an Internal Phishing Attack Internal Phishing Attacks Less common but even more important to detect Indicator of an attack already in progress Example: Financial Times attack Internal phishing s sent from a compromised user IT sent warning to users with a link to change their password Attackers resent IT s with their own phishing link! 24

25 Central Visibility with Control Manager User centric threat and DLP visibility across web, endpoint, , cloud security layers Single viewpoint into hybrid Office 365 & on-premises Exchange architectures 25

26 Hybrid Exchange Support Protect with Cloud App Security + ScanMail Supports all hybrid deployment scenarios ZERO impact to hybrid mail routing flow Avoids duplicate scanning with TrustScan Manage Cloud and On-prem protection together in Control Manager Trend Micro Control Manager 26

27 Complementing Office 365 and other services built in security for Better Overall Protection Built in security blocks known threats Trend Micro Cloud App Security finds hidden and unknown threats 27 Cloud App Security scanned 70M /files and detected an additional 500,000 malicious files/urls for Office 365 customers between July and Dec 2015

28 More protection than a SaaS gateway solution Redirect with MX-Record change SaaS Gateway Direct API integration into the cloud service Cloud App Security Gateway Cloud App Security Inbound Spam, Threat Threat (including malicious spam) Internal no protection Threat, DLP reporting Outbound Threat, DLP enforcement, encryption Threat, DLP reporting Cloud file sharing & collaboration no protection Threat, DLP enforcement 28

29 How is it different from Microsoft s Advanced Threat Protection Service? Better Protection Protects + SharePoint Online and OneDrive as well as Box, Dropbox, Google Drive Experienced with sandboxing since 2012 Leverages top rated Deep Discovery technology Avoids unnecessary delays Risk assessment before sandboxing avoids delaying >98% of attachments More efficient sandbox technology AV-Test.org Jan-Jun 2015 testing of endpoint security products shows the effectiveness of security technologies against unknown malware 29

30 Why Trend Micro Cloud App Security? Control & Protection Advanced protection for Office cloud file sharing Leverages top rated Deep Discovery detection technology Trusted Security Vendor 26 years focused on security Trusted by 48 of top 50 global corporations Microsoft Gold Partner for 20 years Hybrid Cloud Experience 15 years experience with on-prem Exchange protection Central visibility across multiple security layers 30

31 31