In collaborazione con

Transcription

1 Scopriamo il Virtual Patching Alessandro de Simone Product Manager Security and Data Protection Roma, 28maggio 2014 In collaborazione con

2 Scopriamo il Virtual Patching

3 Lo Scenario Attuale Number of vulnerabilities on the rise Over 13,000 vulnerabilities reported in 2013, 32% increase from % of them are remotely exploitable over the network In July 2013, The New York Times reported that the average vulnerability sells from around $35,000 to $160,000 Exploits become available shortly after disclosure 74% on the same day 8% more than one day later Roaming endpoints are directly exposed to threats Connecting to the Internet from home, hotels, Wifi-Hotspots Not protected by security on the corporate network In February 2014, NBC reported that a new laptop & mobile phone were probed by hackers in less than one minute and the machine exploited just a few minutes later on the hotel wifi

4 Lo Scenario Attuale Patching di tutte le vulnerabilità Irrealistico Some vulnerabilities cannot be patched Systems need to be up 24/7 and cannot be rebooted Patches often do not exist for 52% of known vulnerabilites, no patch exists Average of 151 days for vendors to release patch (NSS Labs 2013) Patches if available are not deployed immediately Average time to patch in enterprises in 2013: 59 days! Endpoints remain vulnerable

5 Lo Scenario Attuale la fine di XP Desktop OS Market Share as of Feb 2014 Operating System Market Share Windows % Windows XP 28.44% Windows % Windows % Mac OS X % Windows Vista 3.15% Linux 1.59% Mac OS X % Mac OS X % Mac OS X % Mac OS X % Windows NT 0.17% Mac OS X % Windows % Mac OS X (no version reported) 0.01% Windows %

6 Lo Scenario Attuale Microsoft will end the Extended Support on April 8, 2014 for Windows XP with Service Pack 3 and Windows XP x64 Edition with Service Pack 2 But Customers will still be on XP for the time being because? 1. Cost Gartner estimates that the per-machine cost of migrating from XP to Windows 7, for example, in an organization with 10,000 desktops or more will vary from $1,274USD to $2,069USD The Camwood research found that while only 16% of IT decision makers stated that budgetary reasons were holding them back from migrating off XP, those in the throes of migration (25%) were more concerned about the amount of money needed to be spent to achieve a successful migration. 2. Migration Concerns Worry about migration was cited by over 1/5 of IT decision makers as another reason why they have not started migration. 3. Legacy Software Support Companies with in-house applications generally have a greater dependency on OSes, which will prohibited them from moving away

7 Lo Scenario Attuale Protezione delle vulnerabilità prima che possano venire sfruttate Centinaia di vulnerabilità software vengono scoperte ogni mese e l'applicazione puntuale delle patch è dispendiosa, soggetta a errori e spesso impossibile. Vengono così messi in evidenza i costi e le difficoltà della distribuzione di patch di emergenza, i cicli di patch frequenti e le costose interruzioni dell'attività di sistema.

8 La Soluzione Il Patching Virtuale Le soluzioni con patching virtuale assicurano la protezione immediata. Potete ottenere una consolidata tutela delle vulnerabilità che proteggerà i vostri server ed endpoint fino all implementazione delle patch, o indefinitamente per i sistemi privi di supporto o a cui non è possibile applicare patch. La protezione tramite patching virtuale puoi aiutarvi ad ampliare la vita dei sistemi e delle applicazioni preesistenti oltre a ridurre i costi amministrativi.

9 Deep packet inspection Come Funziona? Raw Traffic Over 100 applications shielded including: Operating Systems 1 2 Stateful Firewall Allow known good Exploit Rules Stop known bad Database servers Web app servers Mail servers FTP servers Backup servers 3 Vulnerability Rules Shield known vulnerabilities Storage mgt servers DHCP servers Desktop applications Filtered Traffic 4 Smart Rules Shield unknown vulnerabilities and protect specific applications Mail clients Web browsers Anti-virus Other applications

10 Virtual Patching Protezione Multilivello Data Center End Point Trend Micro DEEP SECURITY Trend Micro VULNERABILITY PROTECTION

11 Trend Micro Vunerability Protection

12 Trend Micro Vunerability Protection TMVP = TrendMicro Vulnerability Protection TMVP is focusing on vulnerability protection which using virtual patching to defense remote attacks. TMVP {DPI, FW} TMVP is based Deep Packet Inspection (DPI) and Firewall (FW) technologies to provide virtual patching and device control. TMVP OfficeScan Plugin TMVP is different to IDF because it integrates with Control Manager alongside all other endpoint products, is a standalone product, and does not require or have any dependencies on OfficeScan.

13 Features Multiple-Level Policy Inheritance A newly created policy can be configured to inherit all or some of its settings from a parent policy. This lets you create a tree structure of security policies. Complete IPv6 support IPv6 support. IPv6 specific rules can use IPv6 addresses and ICMPv6 support has been added. Generic rules like IP TCP allow port 80 apply to both IPv4 and IPv6 traffic. Standalone TMVP doesn t require OSCE for installation, it can operate with other major AV such as McAfee, Symmetric, Sophos, Kaspersky.

14 Features TMCM Integration: Central management of multiple TMVP servers in TMCM TMVP Status Log summary in TMCM Show Health Status New UI: Completely redesigned user experience, simplified management and navigation Refined options for device control related configurations Task-Based Navigation: Tabbed Dashboard to allow multiple dashboards with easy switch between them, provide many different views. Broader Browser Support: Included IE 10, Chrome, and Safari to the existing Firefox and IE 9 support CSV export

15 5 Punti di forza Reduce the need for patching (down-time, reboot) Extend the life of XP systems Protection against exploits Enable compliance with PCI 6.6 Control unauthorized network access

16 Interfaccia Grafica di amministrazione

17 Features Differentiation Comparison Key Capabilities Trend McAfee Symantec Sophos Kaspersky Automated protection against vulnerabilities Patch Deployment only Shields OS and apps from known and unknown attacks Protects from vulnerabilities before patches are deployed Visibility of vulnerabilities and CVE information Host Intrusion Prevention via App Control Supports Windows XP / Server 2003 and above No XP x64 support Blocks networking backdoors from penetrating the network (Interface Isolation) Device Control only Automatic location-based security configuration Detects malicious traffic for known protocols on dynamic ports EPP / AV Suite integration & pricing

18 System Requirements Vulnerability Protection Manager Memory: 4 GB (8 GB recommended) Disk Space: 1.5 GB (5 GB recommended) Operating System Microsoft Windows 2012 R2 (64-bit) Microsoft Windows 2012 (64-bit) Windows Server 2008 R2 (64-bit) Windows Server 2008 (32-bit and 64-bit) Windows 2003 Server SP2 (32-bit and 64-bit) Windows 2003 Server R2 SP2 (32-bit and 64-bit) Embedded SQL Server 2008 SP2 or SQL Server (2008/2012) or Oracle (10g/11g) Required 20GB Disk Space Vulnerability Protection Agent Memory: 128 MB Disk Space: 500 MB Operating System Windows 8.1 (32-bit and 64-bit) Windows Server 2012 R2 (64-bit) Windows 8 (32-bit and 64-bit) Windows Server 2012 (64-bit) Windows 7 (32-bit and 64-bit) Windows Server 2008 R2 (64-bit) Windows Server 2008 (32-bit and 64-bit) Windows Vista (32-bit and 64-bit) Windows Server 2003 SP1 (32-bit and 64-bit) patched with "Windows Server 2003 Scalable Networking Pack" Windows Server 2003 SP2 (32-bit and 64-bit) Windows Server 2003 R2 SP2 (32-bit and 64-bit) Windows XP (32-bit and 64-bit)

19 Trend Micro Deep Security

20 Cos è? Deep Security assicura una protezione server avanzata per server fisici, virtuali e in-the-cloud. Protegge le applicazioni e i dati aziendali da violazioni e interruzioni dell attività senza ricorrere alle patch di emergenza. Questa piattaforma completa a gestione centralizzata vi aiuta a semplificare le operazioni di sicurezza, garantendo allo stesso tempo la conformità normativa e incrementando il ROI dei progetti di virtualizzazione e cloud.

21 Più attacchi Più Mirati More Sophisticated More Targeted More Frequent More Profitable Advanced Persistent Threats Le tecnologie di protezione tradizionali non sono più adeguate De-Perimeterization

22 Perché Deep Security? Virtualization Security with Deep Security Agentless Security Platform for Virtual Environments Deep Security Virtual Appliance Intrusion prevention Firewall Anti-malware Web reputation Integrity monitoring The Old Way With Deep Security More VMs VM VM VM Security Virtual Appliance VM VM VM VM VM Higher Density Fewer Resources Easier Manageability Stronger Security

23 6 moduli Integrati 6 protection modules Reduces attack surface. Prevents DoS & detects reconnaissance scans Firewall Intrusion Prevention Detects and blocks known and zero-day attacks that target vulnerabilities Tracks credibility of websites and safeguards users from malicious urls Web Reputation Anti-Virus Detects and blocks malware (web threats, viruses & worms, Trojans) Optimizes the identification of important security events buried in log entries Log Inspection Integrity Monitoring Detects malicious and unauthorized changes to directories, files, registry keys

24 Architettura Single Pane Scalable Redundant Deep Security Manager Threat Intelligence Manager SecureCloud Reports Deep Security Agent Modules: Intrusion Prevention Firewall Integrity Monitoring Log Inspection Anti-malware Web Reputation Deep Security Virtual Appliance Includes: Intrusion Prevention Firewall Anti-malware Web Reputation Integrity Monitoring Hypervisor Integrity Monitoring

25 .Concludendo Una soluzione unica ed integrata per la protezione dei server L unica soluzione che offre protezione ad-hoc per ambienti virtuali e nel cloud Prima ed unica piattaforma di sicurezza Agentless(anti-malware, web reputation, firewall, intrusion prevention, VM & hypervisor integrity monitoring, virtual patching) per VMware Prima ed unica soluzione che estende la protezione dei Datacenter al public/hybrid cloud Trend Micro 22.9% Trend Micro 13% Trend Micro All Others 77.1% All Others Combined 87%

26 SEDI: Roma Milano Venezia Torino Novara Bologna CONTATTI: -