Cloud App Security. Tiberio Molino Sales Engineer

Transcription

1 Cloud App Security Tiberio Molino Sales Engineer

2 2

3 Customer Challenges 3

4 Many Attacks Include Phishing s External Phishing attacks: May target specific individuals or companies Customer malware or URL Ransomware more prevalent Internal Phishing Attacks: Less common, more serious Indicator of an attack already in progress within an organization Not caught by gateway security 4

5 Advanced Malware Difficult to Detect 90% of malware is used only once Network Breach Detection Systems help but miss traffic between offnetwork devices and SaaS services MS Office files with malware used in 60% targeted attacks 60% 5

6 User behavior changing: Attachments Cloud File Sharing 6 gateways don t see files which are already in the cloud!

7 What are Users Uploading to the Cloud? Compliance data? Sensitive information? 7

8 Many Companies Gradually Move to Cloud Intermediate stage to full cloud deployment May always keep group of users on premises Want equivalent protection without extra management 8

9 Before Cloud Apps Network boundary Most components are inside network boundary Can add layered protection including endpoint, SharePoint, DLP, gateways, sandboxing

10 Endpoints are frequently outside the corporate network Network boundary and documents move to the cloud, gateways can t see them

11 An attacker sends a zero-day infected PDF to a remote employee s personal

12 The employee uploads to Office 365 Another employee sees the PDF and downloads it

13 And this employee sends the PDF to a customer Customer

14

15 500,000 NEW unique threats EVERY day! 90% of malware Data Center only affects 1 device 74% of attacks begin with a spear-phishing 15 Copyright 2015 Trend Micro Inc. Source: Trend Research 2015

16 Why do I need to supplement the security built in to Office 365? Exchange Online is designed and SLA backed to catch 100% known malware But 90% malware is used only once. Only 10% malware is known. Every customer needs a strategy to deal with unknown malware If you bought a new home with a smoke detector guaranteed to detect 10% of fires would you supplement it? 16 Copyright 2015 Trend Micro Inc.

17 Securing SaaS-based Applications Advanced Threat Detection Finds zero-day and hidden threats Sandbox file analysis in the cloud Web reputation for URLs in /files Data Loss Prevention (DLP) Discovery and visibility into confidential data usage. DLP enforcement for cloud file sharing 240 customizable templates Direct cloud-to-cloud integration using vendor API s. No user changes, rerouting, or web proxy. 17

18 Cloud App Security s DLP Functionality 240 built in compliance templates which can be customized Import, create your own templates Exchange Online OneDrive for Business, Box, Dropbox, Google Drive, SharePoint Online Discovery (manual scan of database) Visibility / Reporting Enforcement delete/quarantine Not available* * in-line blocking of DLP violations is not available due to a limit of the Microsoft API 18

19 Cloud App Security Architecture API s https DLP URL scan Malware scan / file risk assessment (Microsoft Azure datacenters) https Sandbox Analysis <2% of files (Trend Micro datacenters) Trend Micro Cloud App Security 19 All communications encrypted No /files stored Quarantines located in customers accounts for Office 365, Box, Dropbox, Google Drive

20 Cloud App Security Service Delivery Netherlands US Germany US Japan Cloud App Security service, hosted by Microsoft Azure Sandbox service (<2% files), hosted by Trend Micro 99.9% Available No /files stored by Trend Micro Quarantines located within customer accounts for Office 365, Box, Dropbox US & EMEA sites are not interconnected All communications use encrypted https 20

21 Simple and Elegant Integration with SaaS Services API Cloud App Security Direct cloud-to-cloud integration using vendor s API s No impact to user/admin functionality Supports all devices, anywhere Fully automatic setup (above 5000 users contact Trend Micro for best practices) MX R e c o r d S o f t w a r e U s e r settings We b p r o x y 21

22 Find Hidden and Zero Day Threats Document Exploit Detection Parses documents to look for attempts to exploit an application Known exploits identified for deletion/quarantine Files with suspect exploits sent to sandbox for behavioral analysis Key technology in helping Trend Micro discover more vulnerabilities in 1H 2015 than all other security vendors combined 22

23 Find Hidden and Zero Day Malware Dynamic Sandbox Malware Analysis versus Static technique: Checking fingerprints for known bad criminals (similar to antimalware scanning) Dynamic technique: Observing criminal behavior with a surveillance camera (similar to virtual sandbox analysis) 23

24 Find Hidden and Zero Day Malware Dynamic Sandbox Analysis Leverages technology from Trend Micro Deep Discovery: 24

25 Central Visibility with Control Manager User centric threat and DLP visibility across web, endpoint, , cloud security layers Single viewpoint into hybrid Office 365 & on-premises Exchange architectures 25

26 Complementing Office 365 and other services built in security for Better Overall Protection Built in security blocks known threats Trend Micro Cloud App Security finds hidden and unknown threats 27 Cloud App Security scanned 70M /files and detected an additional 500,000 malicious files/urls for Office 365 customers between July and Dec 2015

27 How is it different from Microsoft s Advanced Threat Protection Service? Better Protection Protects + SharePoint Online and OneDrive as well as Box, Dropbox, Google Drive Experienced with sandboxing since 2012 Leverages top rated Deep Discovery technology Avoids unnecessary delays Risk assessment before sandboxing avoids delaying >98% of attachments More efficient sandbox technology AV-Test.org Jan-Jun 2015 testing of endpoint security products shows the effectiveness of security technologies against unknown malware 28

28 Why Trend Micro Cloud App Security? Control & Protection Advanced protection for Office cloud file sharing Leverages top rated Deep Discovery detection technology Trusted Security Vendor 26 years focused on security Trusted by 48 of top 50 global corporations Microsoft Gold Partner for 20 years Hybrid Cloud Experience 15 years experience with on-prem Exchange protection Central visibility across multiple security layers 29

29 30