Metascan = additional anti-malware engines. Detect and prevent known and unknown threats. VirusBlokAda

Transcription

1 Metascan = VirusBlokAda additional anti-malware engines Detect and prevent known and unknown threats

2 300M 250M Cyber-attacks are becoming more common and more complex, and new malware is emerging daily. For any organization, using multiple anti-malware engines significantly increases detection rates of new malware. Leveraging malware signatures from around the world as well as many heuristic algorithms improves detection of both known and unknown threats. 0M 150M 100M 50M Total known malware source: 19 Metascan is a powerful and flexible security solution for ISVs, IT admins and malware researchers. It provides simultaneous access to multiple anti-malware engines residing on a single system via a rich set of APIs, along with document sanitization, archive scanning, and many other features providing the capability to detect and prevent both known and unknown threats. Incoming data from various sources can be analyzed to determine whether it should be allowed or blocked, providing simple control over data flow. Detect known and unknown threats with multi-scanning 95 How does Metascan work? Detection time by six anti-malware engines for 75 outbreaks over three months Advanced Threat Detection Only by combining engines in a multi-scanning solution are outbreaks detected quickly. Increased detection rates Metascan dramatically increases the threat detection rate the most difficult challenge for every anti-malware vendor. AV1 Decreased time to detect an outbreak Get protection from the newest threats as soon as at least one included engine is able to detect them through heuristics or signatures. AV2 AV3 AV4 Decreased likelihood of total system failure If one engine goes down, another included engine will remain available for scanning. AV5 AV6 Metascan Zero hour detection 5 min to 5 days No detection at 5 days source: Comparisons of scan results from different anti-malware engines Verify how many of the included engines, as well as which particular engines, detect a threat.

3 Key Features Beyond providing advanced threat detection and static file analysis, Metascan offers the following features to enable customization of the solution to fit your needs: Interfaces Seamlessly integrate the multi-scanning capabilities of Metascan within your own security solution through several available APIs including COM, REST, ICAP, JAVA, and CLI. Post actions Define what actions will occur after a file has been scanned by result, file type, and more. For example, send clean files to a secure FTP, convert files to a standard format, and send alerts regarding infected files. Proxy integration Integrate Metascan ICAP with existing proxy servers like Blue Coat or Squid to scan network traffic for malware. Scan endpoints Scan endpoints for malware, key loggers and other threats using multiple anti-malware engines with Metascan Client, a component included in all Metascan packages. Document sanitization Sanitize documents and eliminate advanced threats by converting potentially dangerous file types to other file formats. Embedded Anti-malware Engines Files to Scan Metascan API Custom Engines Scan Results Post Action Scripts Additional Customer Licensed Engines Scanning Process Package Options OPSWAT offers pre-built packages of Metascan with 1, 4, 8, 12, or 16 engines optimized to scan simultaneously. Metascan can be integrated with a previously licensed anti-malware engine, or with additional engines of your choice. The built-in engines in Metascan packages are fully licensed and integrated at the API level to ensure the fastest possible scanning. Additional Engines If the pre-built packages don t fit your organization s particular needs, customize your Metascan package by choosing additional anti-malware engines from vendors including McAfee, Symantec, and many others. Metascan custom packages enable you to tailor Metascan to your organization s security and work flow requirements. Database View the detailed package and engine options at

4 How is Metascan used? Metascan helps organizations secure data workflow into and through their networks. By adding Metascan to your security architecture you can analyze incoming data at various entry points to your organization and detect and prevent threats. Workplace File Management Many Metascan customers use the technology to implement scanning and data management on a file upload server. Each file that is uploaded by employees, partners, customers or others is scanned by Metascan s many anti-malware engines. Custom engines and post actions can further customize the scanning process, as well as the flow of data after scanning, and customers can integrate Metascan with managed file transfers and other file management solutions. Security Customers use the Metascan Mail Agent to add threat protection to their Microsoft Exchange Server. Using this plug-in, Metascan can scan all incoming and outgoing attachments for malware, protecting one of the most targeted entry points to an organization. Metascan also integrates with Policy Patrol Mail Security, which provides comprehensive content security, anti-spam and antiphishing protection. INCOMING ATTACHMENTS 34 Malware Research Metascan is used by several prominent computer crime research teams to speed their process of evaluating computers for malicious files. Not only can they automate and expedite the process, but by using multiple anti-malware engines, they can ensure more reliable detection of malware. Many customers also integrate Metascan with 3rd party sandbox / dynamic analysis solutions (such as Threat Track, Norman, FireEye and others) to enhance the workflow with a secondary, deeper analysis of suspicious files. 5 7 KNOWN PASSWORD FILES ATTACHMENTS MALWARE PROTECTED SANITIZED OUT OF 412 INCOMING ATTACHMENTS KNOWN PASSWORD ATTACHMENTS MALWARE PROTECTED FILES SANITIZED OUT OF 245 OUTGOING ATTACHMENTS 49 File Upload Protection Large banks and insurance brokerage firms use Metascan to prevent viruses, worms, trojans and other malware from entering their network in files sent by customers, claimants, agents and others. Multiple anti-malware engines scan each file before it is accepted by the firm, and Metascan s post actions offer several options such as the quarantine of infected files and notifications to the sender with a request to send a clean file. 3 OUTGOING ATTACHMENTS 18 INCOMING THREATS OUTGOING THREATS DETECTED DETECTED KNOWN MALWARE PASSWORD PROTECTED KNOWN MALWARE PASSWORD PROTECTED FILES SANITIZED FILES SANITIZED Secure File Transfer Policy Patrol Secure File Transfer allows you to easily and securely send and receive large and confidential files. With integration to Metascan, you can scan incoming and outgoing files for malware with multiple anti-malware engines, ensuring that malicious files are blocked and the administrator is notified. EXTERNAL NETWORK Scanned by Metascan Policy Patrol SFT Portal INTERNAL NETWORK Learn more about the use cases for Metascan at

5 Metadefender External Media and Device Protection Examples of Metadefender in use Metadefender is the industry leader in safeguarding networks in government, military, nuclear, and other high-security environments. An easy-to-deploy client that can communicate with a Metascan server to act as a checkpoint at the entrance to a facility, Metadefender allows you to prevent incoming threats and establish control over the flow of data into and out of your organization. A kiosk, PC, or other hardware can be placed at the entrance to a facility to evaluate devices before they connect to an internal network. Additional rules can be set, so that files above a certain size can be blocked, file types can be checked, and vulnerable file formats can be converted into safer ones. Role-based settings and workflows can be customized for different types of users, depending on the identifying information they enter at the checkpoint into the facility. Metadefender can also digitally sign files, copy them to a designated location, and print a report of the scan results. All of these options are configurable so that Metadefender can address each organization s specific data security needs. When the scan has finished, Metadefender can print a receipt and perform a full system restore to prevent attacks on the system and adds the record to an ongoing log of all the files that have passed through the checkpoint. U.S. public electric utilities, operating both fossil-fuel and nuclear facilities, use Metadefender kiosks at their facilities to comply with NEI Rev6 by monitoring of all portable media brought to the facility by contractors and other visitors. They can quickly verify whether malicious files are present before allowing the device into the facility where it would be connected to their internal networks. User authentication Device initiates scanning process Media processed according to user s profile Metadefender reports whether threats are detected and what actions were taken! Peripheral media inserted Learn more about the technical features of Metadefender at Metadefender is also used at bank headquarters to prevent threats from being exposed to the internal network. In order to strip out embedded objects in documents, workflows in this environment will often incorporate Metadefender s file type conversion capabilities. For example, a.doc file can be converted to a.pdf then back to a.doc before it enters the bank s network.

6 Metascan Online Online Multi-scanning Metascan Online is a cloud-based implementation of OPSWAT s Metascan multi-scanning technology. You can use the Metascan Online web interface to upload and scan files with more than 40 different anti-malware engines simultaneously. The result for each engine is provided so that you can see exactly which engines detect threats in the file. Metascan Online also provides the ability to look up a file by its hash value to see if it has been scanned before, and if so, what the results of that scan were. These static file analysis features are also available through the Metascan Online REST API, enabling you to integrate the power of Metascan Online with your data security processes. Evaluating Metascan To see our multi-scanning products in action and to get a technical view of how they can be integrated to your solution, sign up for an evaluation through the OPSWAT Portal. Visit portal.opswat.com to register for a free account to access evaluation materials and documentation for Metascan, Metascan Client, Metadefender and other OPSWAT technologies. To learn more about the Metascan Online API, please visit metascan-online.com. Purchasing Metascan Licenses Licenses for Metascan, Metadefender and Policy Patrol are available for purchase directly from OPSWAT or from our authorized resellers. Please contact sales@opswat.com for more information about licensing our technologies. Appliances Examples of Metascan Online in Use Independent Software Vendors (ISVs) use the Metascan Online API to quickly test their binaries against all of the included anti-malware engines. The results from these many engines allow vendors to proactively find and address any issues with their binaries so that their product is not flagged as malicious by any anti-malware engine when released to the general public. Metascan Online is also implemented in Gears, OPSWAT s cloud-based platform for managing device security and compliance. Using the Metascan Online API, Gears scans devices' running processes and DLLs once a day to find threats that are not detected by the user s installed anti-malware software. Learn more about Gears at opswatgears.com. Learn more about Metascan Online and the REST API by visiting metascan-online.com. OPSWAT s multi-scanning technologies are available as software packages delivered electronically or on hardware. Metascan appliances are available directly from OPSWAT; also ask us about scanning terminals for Metadefender. Support OPSWAT is dedicated to delivering the best service possible to our customers. We provide an exceptional Standard customer support package, and we also offer Premium support packages for customers with additional needs. Learn about our Standard and Premium Customer Support offerings at

7 Metascan Customers About OPSWAT OPSWAT s Metascan products are being used by hundreds of customers, including large corporations, financial institutions, and government and defense related agencies. Metascan customers include: OPSWAT is a San Francisco based software company that provides solutions to secure and manage IT infrastructure. Founded in 02, OPSWAT delivers solutions that provide manageability of endpoints and networks, and that help organizations protect against zero day attacks by using multiple anti-malware engine scanning and document sanitization. OPSWAT s intuitive applications and comprehensive development kits are deployed by SMB, enterprise and OEM customers to more than 100 million endpoints worldwide. 15 OPSWAT, Inc. All rights reserved. OPSWAT, Metascan, Metadefender and the OPSWAT logo are trademarks of OPSWAT, Inc. All other trademarks, trade names, service marks, service names, and images mentioned and/or used herein belong to their respective owners.