Automated Protection on UCS with Trend Micro Deep Security

Transcription

1 Copyright 2014 Trend Micro Inc. Automated Protection on UCS with Trend Micro Deep Security Chris Van Den Abbeele Senior presales Engineer

2 Agenda 1. Industrialization of Cyber threats The boomerang of Project Olympic Games 2. How To Win the War Against Cyber crime? Holistic Protection for UCS, more than just Anti-virus 3. Trend Micro Deep Security: why it is different? Integration in the UCS stack 4. Fully automated agentless protection for UCS Do not rely on Operations to (forget to) protect your VMs 5. Fully automated (virtual) patching for UCS Patching windows XP after April 8th 6. Reducing scan overhead

3 Trend Micro What We Do How We Do It Who We Are Recognized global leader in server, virtualization and cloud security Innovative security solutions Protecting the exchange of digital information for businesses and consumers 1,200 threats experts in 12 TrendLabs locations around the globe; 1492 R&D engineers $400M USD and 500 engineers invested over last 4 years to develop cloud-related solutions Global Threat Intelligence Eva Chen: CEO and Founder Co-founded: 1988 Offices: 36 Global Employees: 4942 Revenue: $1.2B USD Cash Assets: $1.65B USD Operating Income: $330M USD Headquarters: Tokyo Trend Micro is the largest independent security provider Protecting 48 of 50 top global corporations 3

4 Trend Micro 31% Top ratings for Virtualization Security Source: Worldwide Endpoint Security Forecast and 2012, IDC 2013 Copyright 2013 Trend Micro Inc.

5 Industrialization of Cyber Threats

6 Damage caused by Cybercrime Today s Threat Landscape Evolution to Cybercrime CRIMEWARE Targeted Attacks Mobile Threats Intelligent Botnets Web Threats Spyware Vulnerabilities W orm Outbreaks Spam Mass Mailers Social Engineering Single Shot Malware BYOD Data Leakage Data Exfiltration Proximity Attacks

7 Targeted Attacks =The new-normal - IDC A Cyber Intrusion Every 5 Minutes according to US-CERT Trend Micro finds over 90% of enterprise networks contain active malicious malware

8 Most Targeted Attacks Start with a Spear- Phishing

9 The Children of Stuxnet

10

11 Demo: Hacking Toolkits: Backtrack / Kali / Metasploit / Armitage

12 How long do Targeted Attacks stay hidden? Most companies breached in minutes but not discovered for months! Source: Verizon Data Breach Investigations Report 2012

13 How to win the war against Cyber-crime?

14 Holistic protection for UCS, much more than just A.V. Reduces attack surface. Prevents DoS & detects reconnaissance scans Tracks credibility of websites and safeguards users from malicious urls Optimizes the identification of important security events buried in log entries Firewall Web Reputation Log Inspection Intrusion Prevention Anti-Virus Integrity Monitoring Detects and blocks known and zero-day attacks that target vulnerabilities Detects and blocks malware (web threats, viruses & worms, Trojans) Detects malicious and unauthorized changes to directories, files, registry keys 14

15

16

17

18 Trend Micro Deep Security: why it is different

19 The journey to virtualization and the cloud: a story of Resource Contention Physical hardware 3 10% utilization (indicative) Virtualized 70 % utilization (indicative) Cloud 95 % utilization (indicative)

20 Virtualized Environments: enters security We need: Anti-Virus / Anti-Malware Host-based Intrusion Detection/Prevention Host Based Firewall Integrity Monitoring

21 Virtualized Environments: enters security We need: Anti-Virus / Anti-Malware Host-based Intrusion Detection/Prevention Host Based Firewall Integrity Monitoring

22 VMware s #1 Security Partner Improves Security by providing the most secure virtualization infrastructure, with APIs, and certification programs Improves Virtualization by providing security solutions architected to fully exploit the VMware platform Integration with vcenter Integration with VCD Multi-tenancy

23 Virtualized Environments: agentless protection scanning appliance Anti-Virus / Anti-Malware Host-based Intrusion Detection/Prevention Host Based Firewall Integrity Monitoring

24 Deep Security Integration in the UCS stack

25 In Breadth and in Depth Reduces attack surface. Prevents DoS & detects reconnaissance scans Tracks credibility of websites and safeguards users from malicious urls Optimizes the identification of important security events buried in log entries Firewall Web Reputation Log Inspection Intrusion Prevention Anti-Virus Integrity Monitoring Detects and blocks known and zero-day attacks that target vulnerabilities Detects and blocks malware (web threats, viruses & worms, Trojans) Detects malicious and unauthorized changes to directories, files, registry keys 25

26 Fully automated agent-less protection for UCS

27 Fully automated agent-less protection for UCS Policy-based Security Automation: New VMs in vcenter are automatically detected by Deep Security and Security Profiles are assigned Provisioning new VMs Reconfiguring agents Rollout patterns Patch agents Checkpoint : Can you keep up with yet another new VM that needs to be secured? Can work Policy/Template-based accross VMs, or do you need to babysit your VM s one by one? Do new VMs that are created in vcenter, automatically show up in your security product, or do you have to manually define them?

28 Demo: Real-time, Agentless, HIPS VMs from vcenter appear in DSM and are automatically protected without touching the VM

29 Demo: Agentless Anti-virus protection

30 Fully automated Virtual Patching for UCS

31 Cost-savings by Virtual Patching Typical patch cycle without Virtual Patching 12 x patching /year Monthly Security Patching Half-yearly Full Patching

32 Cost-savings by Virtual Patching Typical patch cycle without Virtual Patching 12 x patching /year Monthly Security Patching Half-yearly Full Patching Typical patch cycle with Virtual Patching 2 x patching /year Automated, ongoing Security Patching Half-yearly Full Patching

33 Demo: Virtual Patching to protect against Exploits

34 Reducing Scan overhead

35 no more I/O Storms Anti-virus storm caused by: automatic antivirus scans signature updates agent-updates Typical AV Console 3:00am Scan Agentless operation by itself is not enough, the system needs to know which VMs are on which hypervisor (vcenter integration) Anti-virus Storm Checkpoint : Are you comfortable with the performance of your VMs, or does it feel like they are suffocated by the required security measures? Are your hypervisors occasionaly brought to their knees by Anti-Virus storms?

36 Scan de-duplication 1 st AM scan 2nd AM scan (cached) Scan time ~ 20x faster Significant CPU Reduction Huge IO Volume Reduction

37 To remember: In Breadth and in Depth Lower scan overhead Fully automated Agentless protection Automated virtual Patching: Higher security + Lower costs

38 Questions and Answers

39 Virtual Patching / hacking demonstration

40 Hacking demonstration This machine only runs Anti-virus This machine is is (automatically) virtuallypatched by by Trend Micro Deep Security.

41 Demo: Real-time, Agentless, HIPS

42

43

44

45

46

47 Anti-virus alone is no match against attacks

48 This machine is (automatically) virtuallypatched by Trend Micro Deep Security.

49

50 Questions and Answers