Integrated Protection for Systems. João Batista Territory Manager

Transcription

1 Integrated Protection for Systems João Batista Territory Manager

2 2 McAfee Overview Proven Expertise And what it means to you Proof of Expertise Impact of Expertise ,000, ,000,000 Focus Years in Business Patents Researchers Employees Online Subscribers End-users Protected 1 st to provide true network-layer IPS 1 st to provide host-level IPS 1 st to integrate HIPS into enterprise AV 1 st to integrate VA and IPS 1,000,000 viruses blocked last year #1 dedicated security company

3 3 Nearly 20 Years of Single-Minded Focus on a Moving Target Spam, Phishing, Spyware Corporate Data Theft Security Risk Management Integration Zombies Polymorphic Viruses Mass Mailer Viruses Denial of Service Blended Threats Proactive & Automated Comprehensive layers Multiple point products Anti-virus

4 1. Integrated Protection for Systems

5 5 Security Risk Management Scope The CSO Challenge What s my risk? Am I compliant? CEO/CIO Audit RISK MANAGEMENT SYSTEM SECURITY NETWORK SECURITY CSO SYSTEM INFRASTRUCTURE What remediation path should I choose? NETWORK INFRASTRUCTURE IT Operations

6 6 McAfee Security Risk Management Process Applies business discipline by linking people, process and technology to enable organizations to proactively manage security risk Enables customers identify critical assets, assess risks, comprehensively block threats, and minimize compliance exposure Establish POLICY Manage COMPLIANCE Assess RISK Implement PROTECTION

7 7 The Point-Based Approach to System Security Scan and block (NAC) Mgmt. Console 5 Host intrusion prevention Mgmt. Console 4 Inefficient and Ineffective Anti-virus Mgmt. Console 1 Anti-spyware Mgmt. Console 2 Desktop firewall Mgmt. Console 3

8 8 Integrated Protection: The Power of M View in slide show mode Best in class protection for all threats Comprehensive, integrated protection leveraging a common agent and management console for efficient and effective security Extensible agent for the future platform for security risk management The Power of M

9 McAfee Total Protection for Enterprise Reduce the complexity of managing security

10 10 History and Future of Attacks Increased Number and Complexity Targets are Evolving From consumers, to businesses, to nations. The Latest Target Data theft Malicious Infection Attempts (M) Malicious Infection Attempts Network Intrusion Attempts Polymorphic Viruses Mass Mailer Viruses (Love Letter/Melissa) Zombies Denial of Service (Yahoo!, ebay) Blended Threats (CodeRed, Nimda) Corporate Data Theft (CardSystems TitanRain) Spam, Phishing, Spyware (MyDoom, Sasser) (K) Network Intrusion Attempts Source: IDC, ICSA, CERT, CSI/FBI, McAfee

11 11 There is Less Time to React The vulnerability-to-worm cycle is shrinking rapidly Median Days Trended Foundstone, 2004 (represents automated worms January 1999 through May 2004)

12 12 The Challenges with Traditional Anti-Virus Traditional Anti-Virus Reactive approach Creates Window of Vulnerability Not Effective against Newer Security Risks High TCO for Outbreak Response

13 13 Complex and Evolving Threats Require Comprehensive Protection Virus, Worm, Net Worm Worms Containment/Response or Remediation Application/Process Hijack Protection, DDOS Attack Virus, Worm, Malware Buffer Overflow, Exploit Windows/IE/App Vulnerability, Exploit Browser Hijack, Keylogger, Rogue Dialer Trojan, Backdoor Known Threats/Cleaning Outbreak Malware/PUPs Network Exploits/Zero-Day Anti-virus Anti-spyware Firewall Host intrusion prevention AV server Anti-spam Network Access Control Security Management Solutions Threats

14 Next-Generation Anti-Virus for PCs and Servers: Delivering innovation, integration and intrusion prevention to the Enterprise

15 15 Windows of Vulnerability Security Behavior Vulnerability Identified Security Fix Posted 1 st Attack Starts AV Fix Posted Attack Behavior Traditional AV Update CUSTOMER Vulnerability Gap Traditional Anti-Virus Security Vulnerability McAfee VirusScan Attack Vulnerability Time Proactive 0 Reactive Security Issues and Malware Discovered Providing Zero Day Protection!

16 Spyware and Potentially Unwanted Programs What your business needs to know

17 17 The Spyware Epidemic

18 18 What Are Spyware and Potentially Unwanted Programs (PUPs) Any piece of software which a reasonably security- or privacy-minded computer user may want to be informed of, and, in some cases, remove Alter the security state of the computer on which they are installed, or the privacy posture of the user using the computer Include: Spyware Adware Dialers Jokes Remote Administration Tools Password Crackers Other PUPs Source: AVERT Whitepaper Potentially Unwanted Programs, Feb. 2005

19 19 The Unique Challenge of PUPs They are very hard to eradicate after they install First PUP pulls others from Web PUPs often transmit data in addition to downloading other applications and files Other PUPs often from multiple companies and sites May share components

20 20 The McAfee Desktop Defense On-Access scan catches the initial downloader, prevents subsequent installs; logs should be small Real-time scan shows lots of activity as it reacts to infections that just occurred; may leave unknown/new variants that escape notice

21 21 Total Protection Anti-Virus & Anti-Spyware Features Benefits On-Access Scanning Stops malware and PUPs from installing on a system. Prevents malicious code from compromising and infecting systems. Helps protect from new and unknown threats that may not have Behavior-based Detection be detected by a signature. Allows system files and folders to be locked down to prevent malware from further propagating. Reduced exposure to vulnerabilities means not needing an update every time a new exploit is created Buffer Overflow Protection Port Blocking Protection against exploit attacks like WMF, Sasser, SQL Slammer, etc Protects critical productivity applications, i.e. IE, MS Offices, Windows OS services, Media Player, etc. Prevent further propagation of malware by block outbound communications Prevent spyware and other PUPs from sending confidential information to third parties

22 22 Total Protection Anti-Virus & Anti-Spyware Features Benefits Enterprise Management Improve security management with epolicy Orchestrator with complete management of all functions including, deployment, configuration, updating and reporting Discover and report the IP address of the end-point system that Infection Trace & Block Application Protection sent malicious code Reduces outbreak response time Reduce propagation of malware by identifying source of infection Block all mass mailing viruses containing SMTP engines or connect to a SMTP server Prevent infect machines from propagating malware Enterprise Reporting Develop enterprise reports on all malware and PUP activity Provides a holistic view of end point security posture Produce executive-level reports for compliance reporting

23 23 Total Protection Server Anti-Virus Features Anti-virus, anti-worm Central reporting and management via epo Advanced content filtering Benefits Prevent viruses from propagating from one system to another on your network via Save administrative time and effort Minimize cost of ownership Prevent sensitive data from leaving your organization Reduce corporate liability by preventing inappropriate or abusive use of your system

24 Anti-Spam Roger Wood Senior Product Manager

25 25 Total Protection Anti-Spam Features Benefits Highly accurate spam detection over 95% Minimize wasted employee productivity Minimize wasted server storage space Domain name reputation scoring Automatic streaming updates Blacklists and whitelists Proactive technology blocks a large percentage of day zero spam that has never before been seen in the wild. Reactive technology updates SpamKiller rules every 10 minutes for highest effectiveness Over 95% spam accuracy, zero false positives according to independent testing Lets you optimize the system to meet your unique definition of what is spam

26 Host Intrusion Prevention Roger Wood Senior Product Manager

27 27 McAfee Host Intrusion Prevention Resource Protection Application Protection Behavioral Protection epo Signature Protection Firewall Protection Vulnerability Signatures Specific Attack Protection Generic Buffer Overflow Protection Reduces the urgency of patching systems Blocks known and unknown attacks Application Protection Connection Aware Rules Port Blocking Protect against SQL injection attacks Blocks USB Drives

28 28 The Anatomy of an Exploit The Pain of Patching 1 Existing Windows vulnerability yet to be exploited A Crack in the Window Exploit is written to take advantage of the Windows vulnerability Windows Desktop or Server 2 Exploit overflows buffer and writes 3 code to memory Corporate Network Sensitive Data Firewall 4 Once in memory, exploit can perform any number of actions: create admin users, propagate, install remote access tools, steal data Internet Remote Workers Host IPS Vulnerability Shielding protects and gives you time to assess impact of vendor patch rollouts Customers Sales Force Firewall Appliance Router Server Laptop Desktop

29 29 System Call Interception Program A Program B Program C McAfee Host IPS validates system calls made into the different layers of the OS and kernel Calls are matched to a constantly updated database of both specific and generic attack behaviors. If an attack is found, pre-emptive action is automatically taken ranging from Log Event to Prevent are taken. All activity on the host is seen and analyzed, and is not impaired by encryption, switched data or reliance on system log information User Mode Kernel Mode.EXE.EXE.EXE OS Kernel System Call Table Network Driver Disk Driver Other Driver

30 30 Application Blocking: Control What Applications Can Do 1 User Launches Application X 2 Application Blocking Policy permits creation Application X can load and run Memory 3 But Policy prevents Application X from hooking Y.DLL to prevent exposure to known vulnerability in Y.DLL App. X Y.dll Disk McAfee Host IPS Application Blocking lets you control what applications can run, and with which other processes they are allowed to interact

31 31 Shielding and Enveloping: Keep Applications Honest 1 Applications are allowed to access their own files, data, registry and services 2 Shielding - Applications, registry and services are locked down against malicious activity 3 Enveloping Applications are not permitted to access data, registry and services outside their own application envelope App 1 App 2 Memory Memory Registry Files Registry Files

32 32 No Compromise Total Protection The Forrester Wave : Client Security Suites, 2006 McAfee leads the market with its comprehensive functionality set and robust management capabilities McAfee is best suited for companies that require comprehensive protection McAfee leads the pack

33 33 No Compromise Anti-Spyware The Forrester Wave : Enterprise Antispyware, Q Forrester Wave Leader in Enterprise AntiSpyware Spyware Certification McAfee s distinguishable strength is its protection against unknown spyware

34 34 No Compromise Anti-Virus Gartner Magic Quadrant for Enterprise Antivirus 2006 McAfee's main technical strength is its management console epolicy Orchestrator (epo) and secondarily, host-based intrusion detection capabilities. This Magic Quadrant graphic was published by Gartner, Inc. as part of a larger research note and should be evaluated in the context of the entire report. The Gartner report is available upon request from McAfee, Inc.

35 35 What s on our Customer s Mind? Am I at Risk? From Threats? From non-compliance? CSO Ensure compliance with internal and external policies Provide metrics Proactively identify threats Prioritize risks CIO Achieve acceptable level of risk Safeguard critical data Reduce costs of security and compliance management Minimize business disruptions Business Challenges IT Operations Avoid downtime Prioritize remediation tasks Efficiently use of scarce resources Improve workflow Audit Reduce audit costs Automate access to security data Automate risk and regulatory reporting

36 Obrigado!