Symantec Endpoint Protection 12.1 Symantec Protection Center 2.0

Transcription

1 Symantec Endpoint Protection 12.1 Symantec Protection Center 2.0 Let me phone a friend Jimmy Sandberg Presale Engineer

2 What s new in Symantec Endpoint Protection 12.1 Unrivaled Security Blazing Performance Built for Virtual Environments Powered by Insight Real Time Behavior Monitoring with SONAR Up to 70% reduction in scan overhead Smarter Updates Faster Management Tested and optimized for virtual environments Higher VM densities

3 Research Powered by Global Intelligence Network Identifies more threats, takes action faster & prevents impact Calgary, Alberta Dublin, Ireland San Francisco, CA Mountain View, CA Culver City, CA Austin, TX Pune, India Chengdu, China Chennai, India Taipei, Taiwan Tokyo, Japan Worldwide Coverage Global Scope and Scale Rapid Detection 24x7 Event Logging Attack Activity 240,000+ sensors 200+ countries and territories Malware Intelligence 150M client, server, gateways monitored Global coverage Vulnerabilities 35,000+ vulnerabilities 11,000 vendors 80,000 technologies Spam/Phishing 5M decoy accounts 8B+ messages/day 1B+ web requests/day Preemptive Security Alerts Information Protection Threat Triggered Actions

4 Traditional Signatures The changing threat landscape - An explosion of malware In 2010 >50,000 signatures a day Expected in the end of 2011: > unique signatures a day In signatures a day In ,500 signatures a day 0 4

5 Malware authors have switched tactics From: A mass distribution one worm hits millions of PCs Storm made its way onto millions of machines across the globe To: 75% of malware infect less than 50 machines A micro distribution model. Hacked web site builds a trojan for each visitor The average Harakit variant is distributed to 1.6 users!

6 The Idea Only malware mutates So... if an executable is unique, it s suspicious... but how to know if a file is unique?

7 Unrivaled Security

8 Foundation of reputation based security Reputation: Game-changing approach Leverages data on hundreds of millions of files Reduces reliance on signatures Amplifies current protection Shifts the odds in our favor

9 The protection stack Network IPS Insight Heuristics & Signature Scan Real time behavioral SONAR Firewall Network & Host IPS Monitors vulnerabilities Monitors traffic Application & Device ctrl. Stops stealth installs and drive by downloads Focuses on the vulnerabilities, not the exploit (GEB) Improved firewall supports IPv6, enforces policies

10 Insight Provides Context Network IPS & Browser Protect Insight Insight: Before we scan check the reputation Heuristics & Signature Scan Real time behavioral SONAR Identifies new and mutating files Feeds reputation to our other security engines Only system of it s kind

11 How Symantec Insight works 2 Rate nearly 3.0 billion every file on files* the internet (* Sept 2011) 4 Check the DB during scans 1 Build 175 a collection million network PCs Is it new? Bad reputation? Prevalence Age 5 Provide actionable data 3 Look for reputation Source Behavior

12 Insight - Reputation Protection Allow the customization of a policy for end user experience Threshold can be set for age and prevalence Log and report on infection source Includes protection for browsers, peer to peer apps, , and chat

13 Policies based on Risk Finance Dept Help Desk Developers

14 So what is special about Insight? Symantec Insight Ranks all executable files Tracks prevalence Tracks age Signatures for new malware Only Insight can answer: How old is the file? How many copies are there? Is the file associated with infections? Only Insight can use reputation to identify mutating threats

15 File Scanning Network IPS & Browser Protect Insight File Scanning Cloud and Local Signatures New, Improved update mechanism Heuristics & Signature Scan Real time behavioral SONAR Most accurate heuristics on the planet. Uses Insight to prevent false positives

16 SONAR (TruScan) Completes the Protection Stack Network IPS & Browser Protect Insight SONAR Monitors processes and threads as they execute Rates behaviors Feeds Insight Heuristics & Signature Scan Real time behavioral SONAR Only hybrid behavioralreputation engine on the planet Monitors 400 different application behaviors Sonar is formerly known as TruScan

17 SONAR - Reputation Protection Enhanced by Insight to keep False Positive detects to a minimum Analyzes file system and network behavior Tamper Protection utilizes same technology

18 Browser Intrusion Protection Can be updated in the field to protect against new browser vulnerabilities Protection for Internet Explorer, Firefox and Chrome

19 File-Based Signatures are NOT Enough % Insight -blocking 90,000 downloads 2010 /day Sonar 53,000 malicious files and processes blocked /day This is an increase of 50% >3.000% since 2008 Insight helping convict >1000,000 files / day AV Detection AV Detections IPS Dections IPS Detections

20 Blazing Performance

21 Faster Scans with Insight On a typical system, 70% of active applications can be skipped! Traditional Scanning Has to scan every file Insight - Optimized Scanning Skips any file we are sure is good, leading to much faster scan times 24

22 Improved client performance: ScanLess and Scan on Idle Use reputation to whitelist Symantec trusted and community trusted files Provide administrator with choices to use the information or run in paranoid mode Scan when system is idle Applicable to scheduled and on demand scans Chart for Demonstration Purposes Only And tons of new features and performance enhancements under the hood

23 Built for Virtual Environments

24 SEP 12.1 is built for Virtual Environments Optimized for VMware, Citrix and Microsoft virtual environments Easy to identify and manage physical and virtual clients Maximizes performance and density without sacrificing security Best in class performance and security Hypervisor Scan Cache

25 Virtualization Features Image Exception Used on cloned images Excludes all files Reduces scan impact Shared Insight Cache Clients share scan results Scan files once Leverages Insight Enhances Management Reduces Disk I/O up to 90% Virtual Client Tagging Identifies hypervisor Set group specific policy Search for virtual clients Resource Leveling Used for all virtual systems Reduce overlap of events Scans and def updates

26 Shared Insight Cache - High Level Shared Insight Cache Server (SIC) File Hash Def Ver Result AE32D Clean B923E Clean F Clean C3FDA Clean VM VM VM VM VM VM ESX Server VM Cluster* *Works for ESX, Citrix and Hyper-V VM VM VM VM VM VM ESX Server

27 But, what about agent-less installations? If we take the scanner out of the VM clients it would work. However, it won t support a full endpoint protection package No client-based packet inspection No client-firewall (HIPS/NIPS) No application control or device control No system integrity monitoring No real-time behavioral protection (SONAR)

28 What s needed to defend the Virtual Endpoint Signature and Heuristic File Scanning Insight Network and Host IPS Browser Protection SONAR Application and Device Control

29 Simplified Administration

30 A Friendly Welcome Screen Provide guidance with a welcome screen that highlights the common tasks Features: Deploy SEP client Run LiveUpdate Product tour License status Adjust the server configuration

31 The new SEPM home page Features: Allow administrators of all signature deployments Launch of common tasks like client deployment Simplified endpoint status Simplified ThreatCon License status

32 New and improved notifications Features: Can be viewed on a smartphone (HTML) License renewal and partner messages New client software is available Detecting unprotected clients Policy changes

33 Package deployment: Include latest Virus Definitions Provides an option that reduces signature impact on network Option to include latest signatures Option to limit signatures

34 Installation status reporting Register client in console as soon as installation starts Features: Report includes detailed client installation status Populates for all installation methods Reboot commands initiated from the report

35 Enhanced Disaster Recovery Solution: Allow a SEPM reinstall to use existing backed-up certificates so that clients just reconnect. Notes: This was the #1 supportability request

36 In Product Licensing Supports Trialware conversion In product activation License status, reports and notification reminders (content enforcement for SBE)

37 Symantec Protection Center 2.0

38 Key Buyer: Security Operations Customer Objectives Internal Threat Reporting Prioritized Actions Implement commands to products based on role Symantec Solution Protection Center 2.0 Single Sign On Data collection Action Existing Tools!!!!!

39 What s New in SPC 2.0? Three levels of integration- Single Sign on, Data collection, Action Symantec GIN Integration Basic event correlation Cross Product Reportingmalware, , asset Dashboard Notifications Prebuilt workflow templates- Symantec Endpoint Protection STEP 3 rd Party Program

40

41

42

43

44

45

46

47 Protection Center Console Reports Dashboards Notifications Settings Technical Architecture Information Flow Symantec Services DeepSight SPC Data Symantec Protection Center Server Security Event Data Storage Exchange Event Channel Event Event Channel Channel Event Summarizer Workflow Event Trigger Asset Processor Data Collection Service Registration Wizard Event Event Archives Event Archives Archives CMDB Integration Web Services Data Feed Registration

48 Protection Center 2.0 Integrated Products Symantec Endpoint Protection Symantec Messaging Gateway Symantec Mail Security for Microsoft Exchange Symantec Data Loss Prevention Suite PGP Encryption from Symantec Symantec Control Compliance Suite VeriSign Managed Public Key Infrastructure (PKI) for SSL Deepsight Intelligence Services Bay Dynamics IT Analytics Bit 9 Parity Suite: Endpoint Protection

49 Symantec Protection Center for ipad

50 Protection Center for the ipad Relevant, Actionable Security Intel for Executives Role Based Dashboard. Executive summary of corporate risk posture relative to your organization Real-time Threat Intelligence. Global threat data from one of the largest sources of external threat intelligence Location aware compliance. Cross product reporting for internal and external IT compliance policies

51 Welcome Dashboard

52

53

54 What s New in Symantec Endpoint Protection 12.1 Unrivaled Security Blazing Performance Built for Virtual Environments Powered by Insight Real Time Behavior Monitoring with SONAR Up to 70% reduction in scan overhead Smarter Updates Faster Management Tested and optimized for virtual environments Higher VM densities

55 Thank you! Copyright 2011 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice.