Securing the endpoint and your data

Transcription

1 #SymVisionEmea

2 #SymVisionEmea Securing the endpoint and your data Piero DePaoli Sr. Director, Product Marketing Marcus Brownell Sr. Regional Product Manager Securing the Endpoint and Your Data 2

3 Safe harbor disclaimer Any information regarding pre-release Symantec offerings, future updates or other planned modifications is subject to ongoing evaluation by Symantec and therefore subject to change. This information is provided without warranty of any kind, express or implied. Customers who purchase Symantec offerings should make their purchase decision based upon features that are currently available. 3

4 Agenda Changing Threat Landscape Protecting Endpoints Today Protecting Data on Endpoints with Encryption 4

5 Increase in targeted attacks % Increase in targeted attack campaigns Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

6 Targeted attack campaigns per campaign Recipient/campaign Campaigns 165 Duration of campaign 4 days 3 days 8.3 days Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

7 Protecting endpoints today 7

8 Symantec data analytics platform Raw features Big Data System Intelligence driven applications Examples: Downloads Web site visits Intrusion alerts Malware alerts Behaviors File appearance Crashes Symantec Data Analytics Platform trillion rows of data 55,000 rows added every second File URL Crash Behavior Forms SONAR engine File Insight Scam Insight URL Insight Crash Ratings Intelligence 8

9 Symantec IS Security Intelligence 7 Billion File, URL & IP 1 Billion+ Devices Protected 2.5 Trillion Rows of Security 2B+ events logged daily Monitors Threats in 157+ countries Securing the Endpoint and Your Data Classifications Telemetry Capturing previously unseen threats and attack methods More visibility across devices creates better context and deeper insight Putting big data analytics to work for every end user Over 100,000 security alerts generated annually 200,000 daily code submissions 14 Data Centers World Wide 550 Threat Researchers SYMANTEC VISION SYMPOSIUM

10 Security Technology and Response (STAR ) Layers of protection Reputation Network S TA R P R O T E C T I O N File Behavioral Repair 10

11 Star protection Network File Reputation Behavioral Repair Stops malware as it travels over the network and tries to take up residence on a system Protocol aware IPS Browser Protection Looks for and eradicates malware that has already taken up residence on a system Antivirus Engine Auto Protect Malheur Establishes information about entities e.g. websites, files, IP addresses to be used in effective security Domain Reputation File Reputation Looks at processes as they execute and uses malicious behaviors to indicate the presence of malware SONAR Behavioral Signatures Aggressive tools for hard to remove infections Boot to a clean OS Power Eraser uses aggressive heuristics Threat-specific tools 11

12 Network Threat Protection Reputation Network S T A R P R O T E C T I O N File Behavioral Repair 12

13 Network Threat Protection blocks todays most critical threats Protect Against Drive-by Downloads that install APTs Prevent Social Engineering Attacks Find Infected Systems with Post Infection Protection Prevent Social Media Attacks Protect Against Unpatched Vulnerabilities Hundreds of Millions of threats are stopped with this technology 13

14 Reputation Network S T A R P R O T E C T I O N File Behavioral Repair Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

15 File-based protection Malheur - Increased use of a new Artificial Intelligence engine File Extracts 100 s of attributes from each file Looks for suspicious combinations of attributes Endpoint uses predictive classifiers or rules derived from them and corroborates with leverages Insight Reputation Backend uses complex attributes to identify malware and releases definitions for them These heuristics can detect many variants and are specifically effective at polymorphic malware families Benefits Proactive catches new 0-day threats Proactive blocks threats before they have a chance to run Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

16 Reputation Network S T A R P R O T E C T I O N File Behavioral Repair Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

17 Reputation-based Security Insight - Reputation in a Nutshell Reputation Our Insight reputation system uses the wisdom of our hundreds of millions of users to automatically derive highly accurate safety ratings for every file on the internet It is an entirely different approach to that requires no traditional virus signatures Data Collection Opt in program to collect anonymous file usage data File Attribute Database World s largest nexus of data on executable content Reputation Engine Patent pending algorithms to compute safety reputations File Safety Reputations A measure of how good or bad a file is > 210 Million Contributing Users >3 B unique program files, growing continuously Updates every rating every 4 6 hours For all files, both good and bad It can accurately identify threats even if just a single Symantec user encounters them and it blocks them without any signatures Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

18 Superior Protection Our reputation system improves protection in three ways: It blocks entirely new malware that traditional fingerprints miss It ratchets up the resolution of our heuristics and behavior blocking Changes the game, killing mutated malware once and for all Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

19 Reputation Network S T A R P R O T E C T I O N File Behavioral Repair Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

20 SONAR Behavioral Protection Build an engine that ignores what the threat LOOKS LIKE But detects threats based on what the threat DOES Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

21 SONAR Behavioral Protection SONAR (5 th Generation) Behavioral Protection New Behavioral-detection engine with significantly improved effectiveness Same Enterprise UI but totally redesigned behavioral protection under the hood Now with 1390 Behaviors Proactively detects new threats based entirely on Behaviors Day-0 detection for Hydraq/Aurora and StuxNet Sophisticated Rootkits like TidServ Non-process Based Threats (NPT s) are stopped Behavioral Rules-based Customers get up-to-date protection automatically via Liveupdate Coverage for APT like Shamoon PoisonIvy Securing the Endpoint and Your Data High-Performance real-time engine Behaviors are monitored and assessed as they happen Sandboxing to insulate system from threats No measurable impact on performance SYMANTEC VISION SYMPOSIUM

22 Reputation Network S T A R P R O T E C T I O N File Behavioral Repair Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

23 Repair technology Additional options to help fix the problem: Repair 1. Symantec Power Eraser standalone & integrated 2. Bootable Recovery Tool A bootable recovery disk with full detection and repair capabilities 3. Threat Specific Tools Fix tools created for specific threats available from Security Response Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

24 Roadmap futures and near term 24

25 Near-term roadmap Enhanced Protection Improved Performance Extended Platform Support Ease of Use 25

26 Improved performance Client performance and content deltas Reduce disk space on SEPM by 85-95% Allow customers to cache more revisions -Reduces the number of full definitions delivered Improve boot time by more than 10% 26

27 Extended platform support Improved management of endpoints Linux client management -Single client package fully managed by SEPM -Auto update -Auto-compile kernels during install Mac client management -Client remote deployment -Device control -Firewall 27

28 IT Analytics 28

29 Enhanced protection Against advanced threats Integrated Power Eraser -Aggressively scan an infected endpoint to locate APTs -Reduce time to clean infected systems -Mitigate false positive 29

30 Customer participation opportunities SEP Program Just released Linux & Mac Client Management Client Performance Enhancements Better Control of Bandwidth to SEPM Scan Throttling for Virtualization SEP Customer Previews Q1, 2015 Embedded client updates, VDI System Lockdown enhancements Symantec Endpoint Security : ATP integration 30

31 Encryption 31

32 Causes of breaches Top Causes of Data Breach, 2013 Source: Symantec Hackers Accidentally Made Public Theft or Loss of Computer or Drive Insider Theft Unknown Fraud 6% 2% 2% 34% 29% 27% TOTAL Number of Incidents Average number of identities exposed per data breach for hacking incidents was approximately 4.7 million Theft or loss + accidental breaches accounted for 56% of data breach incidents 32

33 Symantec encryption portfolio Endpoint Encryption Encryption File & Folder Encryption Renders data-at-rest inaccessible to unauthorized parties on devices such as laptops, desktops and removable media Protects in transit and at-rest from unauthorized parties Protects individual files in transit and at-rest from unauthorized parties, allowing secure collaboration Endpoint Encryption Management Server Encryption Management Server Manage individual and group keys, create and set up encryption policies and report on encryption status 33

34 Symantec endpoint encryption Disk Encryption Removable Media Encryption - Also known as Full-Disk or Whole Disk Encryption - Used on laptops and desktops Additional benefits such as: Initial encryption happens in the background allowing users to keep working like normal Self-Recovery capabilities as well as Help Desk recovery Single Sign-On capability No end user interaction required - Used on USBs, portable hard drives, SD cards.. 34

35 Encryption strategy Enable customers to seamlessly protect sensitive information, wherever it resides, with Symantec Encryption E N C R Y P T I O N E N C R Y P T I O N E N C R Y P T I O N E N C R Y P T I O N Single Endpoint Encryption Offering 3rd Party Encryption Management Encryption Center of Excellence Next Generation Encryption Securing the Endpoint and Your Data SYMANTEC VISION SYMPOSIUM

36 #SymVisionEmea Thank you! Piero DePaoli Marcus Brownell Copyright 2014 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Securing the Endpoint and Your Data 36