FortiGuard. Global Security Research & Services.

Transcription

1 FortiGuard Global Security Research & Services

2 Fortinet s Own Threat Intelligence & Response for Real-Time Protection Fortinet is the only network security vendor to have its own global threat research & response team continuously monitoring the threat landscape and providing customers with real-time protection against the latest Internet threats. FortiGuard Labs expert team of threat researchers is located around the world to deliver security updates 24/7, with industryleading response times to new and emerging threats targeting your network, content and mobile devices. In a typical week FortiGuard Labs add or update approximately: 130,000 antivirus definitions 70 IPS signatures 600,000 URLs ratings for Web filtering with 69 languages supported 34,000,000 antispam signatures In addition, FortiGuard Labs deliver comprehensive protection with more than: 2,400 application control signatures 600 database security policies, 9,000 vulnerability management signatures 1,000 web application firewall attack signatures

3

4 FortiGuard Global Organization Fortinet has more than 175 dedicated research analysts, engineers, and forensic specialists. Operating in security labs around the globe, the FortiGuard Labs provide follow-the-sun worldwide coverage to assure industry-leading response times to new viruses, vulnerabilities, attacks, and malicious threats. Fortinet s FortiGuard Labs constantly analyze the threat landscape and delivers original research - including discovery and responsible disclosure of zero day vulnerabilities as well as rapid signature updates to provide practically instant protection from new and emerging threats. The team collects data from the FortiGate network security appliances and intelligence systems in production worldwide to identify threats. They are able to rapidly respond to discovered threats by pushing out signature updates to every Fortinet customer in the world within minutes. This is a unique Fortinet advantage since competing security companies do not have in-house security analysts and rely on third-party security companies to provide them with the latest malware signatures. In parallel, FortiGuard Labs constantly update its subscription services to proactively protect Fortinet s customers from network activities that may lead to vulnerabilities for their data and business assets. On the research side, FortiGuard Labs have individuals dedicated to proactively researching the latest rootkits, botnets, packers and malware for both computers and mobile devices, enabling synergistic security intelligence and true zero-day protection from new and emerging threats. Here, the team also collaborates with the world s leading threat monitoring organizations (such as FIRST, StopBadWare and Team Cymru) and contributes to the overall security industry by identifying and responsibly reporting vulnerabilities directly to vendors of hardware, operating systems, and applications (for more information, click here). EMEA AMERICAS APAC FRANCE CANADA CHINA UNITED STATES JAPAN The FortiGuard Distribution Network has data centers around the world located in secure, high-availability locations that automatically deliver updates to the Fortinet security platforms.

5 FortiGuard Security Subscription Services Fortinet s FortiGuard Security Subscription Services enable unified protection against multiple and blended threats. These services were designed from the ground up to optimize performance and maximize protection across the range of Fortinet s security platforms. FORTIGUARD ANTIVIRUS SERVICE FORTIGUARD APPLICATION CONTROL SERVICE FORTIGUARD ANTISPAM SECURITY SERVICE FORTIGUARD INTRUSION PREVENTION SERVICE FORTIGUARD WEB SECURITY SERVICE FORTIGUARD WEB FILTERING SERVICE FORTIGUARD SERVICES FORTIGUARD DATABASE SECURITY SERVICE FORTIGUARD VULNERABILITY MANAGEMENT SERVICE FORTIGUARD IP REPUTATION SERVICE FortiGuard Security Services are continuously updated by FortiGuard Labs and delivered via their global distribution network. Get the latest malware information from the FortiGuard Center: Threat reports Security blog and RSS feed Security advisories Interactive world map for country-level threat ranking Zero-day research Threat library and encyclopedia of vulnerabilities Mobile threat index Malware classifications Online virus scanner and submission

6 FortiGuard Your Network With the FortiGuard Subscription Services enabled, customers can rest assured that their Fortinet security platforms are performing optimally and protecting their corporate assets with the latest security technology. 'FortiGuard your network and benefit from: Industry-leading response time with optional Service Level Agreements (SLAs) to new and emerging threats targeting your network, content or mobile devices, 24x7x365 operations for real-time updates both push and pull against the latest threats, Multi-threat security research leveraging intelligence from multiple security disciplines for comprehensive protection against network, content, and application threats, Feedback from worldwide installed base plus cooperation with major infrastructure vendors for broadest protection against attacks and exploits, Automatic updates without any manual intervention to ensure that security platforms are performing optimally while freeing administrators time in keeping defenses up-to-date, Simple setup offering true "set and forget" functionality for easier deployment and management, Device-based licensing eliminates per-user fees for significantly lower entry and ongoing maintenance costs. FortiGuard Premier Signature Service For enhanced virus detection and threat analysis support Allows prioritized support with guaranteed response times for custom AV or IPS/Application Control signatures on a 24x7 basis Benefits include: Customized AV signature updates within 4 hours For IPS/Application Control: initial response in 4 hours, detailed response in 12 hours, and analysis in 48 hours 24x7 updates Virus description/analysis Proactive alert notification of possible new outbreaks Monthly AV and IPS activity reports Global support with regional service

7 FortiGuard Security Subscription Services FORTIGUARD ANTIVIRUS SERVICE Ensures protection against the latest content-level threats Employs advanced virus, spyware, and heuristic detection engines Proactive threat library for complete protection against content-level threats Real-time update response to new malware threats FORTIGUARD APPLICATION CONTROL SERVICE Protects managed desktops and servers by allowing or denying network application usage using protection profiles and policies Sophisticated detection signatures to identify enterprise applications, databases, web mail, social networking applications, IM/P2P, and file transfer protocols Automated content updates fuel ever-growing set of application identification signatures Application control signatures provided to all subscribers of IPS signatures Possibility to create whitelists, blacklists, or combinations Includes botnet IP reputation database FORTIGUARD INTRUSION PREVENTION SERVICE Arms with the latest defenses against network-based threats Shields against the latest application and OS vulnerabilities. Customizable library with over 5,100 IPS signatures to enable Fortinet appliances to stop attacks that evade conventional firewall defenses Flexible policies offer full control to suit the most demanding security applications Behavior-based heuristics enabling the system to recognize threats for which no signature has yet been developed FORTIGUARD WEB FILTERING SERVICE Block and monitor Web activities to enforce corporate Internet usage policies Automatic research tools and targeted research analysis, real-time updates for applying highly-granular policies Granular blocking & filtering provides policy-based access control based on categories, websites, and individual pages URL database with over 79 categories and 103 million rated websites - all continuously updated FORTIGUARD VULNERABILITY MANAGEMENT SERVICE Ensures quick discovery of vulnerabilities, measurement and mitigation of potential risks Continuous update of policies to ensure OS regulatory compliance Asset prioritization to most effectively reduce risk on critical systems Vulnerability signatures are automatically retrieved and applied to scan definitions. Hundreds of ready to use compliance policies available and regularly updated Quick identification of compliance exposures on hosts, servers and throughout the network Extensive libraries of templates for industry standard best practices FORTIGUARD ANTISPAM SECURITY SERVICE Detects and blocks spams coming from s or located on remote PCs and mobile devices Multiple collection techniques help develop and maintain accurate lists of spammers and spam content Advanced detection capabilities for greater protection than standard Real Time Blacklists (RBLs) Uses both a sender IP reputation database and a spam signature database, along with sophisticated spam filtering tools Dual-pass detection technology to reduce spam volume at the perimeter Updates to the IP reputation and spam signature databases provided several hundred times/week Customizable policies with ability to set antispam filtering policies for domains, group of users and individual users FORTIGUARD WEB SECURITY SERVICE Protects against the latest application layer threats Covers SQL injection, cross-site scripting and a range of other attacks Employs hundreds of vulnerability scan signatures, data type patterns, web robot and suspicious URL patterns Automated content updates and real-time update response to new application threats FORTIGUARD DATABASE SECURITY SERVICE Enables enterprise database hardening and compliance with regulations and policies Cover known exploits, configuration weaknesses, OS issues, operational risks, and data access privileges Automatic updates with the latest regulatory and industry best practices Policy versioning to keep track of pre-defined policies and generate reports based on original scan FORTIGUARD IP REPUTATION SERVICE Advanced protection against automated phishing, spamming, and DDoS attacks Aggregates reputation data from multiple sources around the world Conducts forensic analysis of botnets Blocks large-scale DDoS attacks from known infected sources Defends against access from anonymous and open proxies Delivers daily IP reputation updates from FortiGuard s distributed cloud network Provides analysis tools to better understand origin of attack using Geo IP location and configurable actions per attack category

8 About Fortinet Fortinet is a global provider of high-performance network security solutions that provide our customers with the power to protect and control their IT infrastructure. Our purpose-built, integrated security technologies, combined with our FortiGuard security intelligence services, provide the high performance and complete content protection our customers need to stay abreast of a constantly evolving threat landscape. More than 125,000 customers around the world - including the majority of the Global 1,000 enterprises, service providers and governments - are utilizing Fortinet s broad and deep portfolio to improve their security posture, simplify their infrastructure, and reduce their overall cost of ownership. From endpoints and mobile devices, to the perimeter and the core - including databases, messaging and Web applications - Fortinet helps protect the constantly evolving networks in every industry and region around the world. AMERICAS HEADQUARTERS EMEA HEADQUARTERS APAC HEADQUARTERS 1090 Kifer Road Sunnyvale, CA United States Tel Fax rue Albert Caquot Sophia Antipolis France Tel Fax Beach Road The Concourse Singapore Tel Fax Copyright 2012 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, and FortiGuard, are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance metrics contained herin were attained in internal lab tests under ideal conditions, and performance may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet's General Counsel, with a purchaser that expressly warrants that the identified product will perform according to the performance metrics herein. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet's internal lab tests. Fortinet disclaims in full any guarantees. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.