Endpoint Protection Solution Test Plan

Transcription

1 Endpint Prtectin Slutin Test Plan This test plan is intended t lay ut high-level guidelines fr testing and cmparing varius endpint prtectin and investigatin slutins. It specifies test envirnments, cnnectivity methd, scale and key endpint prtectin functinality that must be validated fr each slutin.

2 FishNet Security Endpint Prtectin Slutin Test Plan 2 Envirnment Prvide a testing envirnment representative f envirnments fund in the wild. Operating Systems - test capabilities f endpint slutins n each f the fllwing perating systems: Windws (XP-8) Mac (Use variants apprpriate t custmer envirnment.) Linux (Red Hat, Suse, Debian and/r ther variants applicable t custmer envirnment) Unix (AIX, HP-UX, Slaris, BSD and/r ther variants applicable t custmer envirnment) Netwrk Cnnectivity test capabilities f endpint slutins using bth n and ff LAN access: On-LAN (LAN cnnected devices) Off-LAN / Remte (Raming devices nt cnnected t the LAN) Scale test capabilities at scale f endpints in rders f magnitude: ,000 10,000 Test Cases (Cntent Extracted frm Endpint Prtectin Cmpetitive Matrix) The fllwing are high-level capabilities that are imprtant fr endpint prtectin, investigatin and malware identificatin. Identify/validate each f the fllwing capabilities as they pertain t the respective prducts. Nt all test cases apply t each perating system type r are perating system, scale r netwrk cnnectivity specific. Nn-envirnment/scale specific tests: Market Data lss preventin Advanced malware prtectin Endpint cnfiguratin management Enterprise frensics Applicatin restrictin Vulnerability identificatin Management Rle-based access cntrl (RBAC) Supprt fr separatin f duties Dual factr authenticatin Plicy-based administratin Crprate Headquarters / 6130 Sprint Parkway / Ste. 400 / Overland Park, KS /

3 FishNet Security Endpint Prtectin Slutin Test Plan 3 Centralized administratin Active directry integratin Endpint agent deplyment functinality Endpint Accessibility Clud-based endpint crrelatin ability Fully accessible and mnitred anywhere an Internet cnnectin is present Partially accessible and mnitred anywhere an Internet cnnectin is present On-premise accessible nly Threat Intelligence IOC Surces IOCs frm vendr subscriptin IOCs frm netwrk f devices in vendr frm cmmunity IOCs frm pen cmmunity feeds Manually created IOCs Threat Intelligence YARA Rule Surces YARA rules frm vendr subscriptin YARA rules frm netwrk f devices in vendr frm cmmunity YARA rules frm pen cmmunity feeds Manually created YARA rules Integratin Autmatically detects endpint threats autnmus frm external device integratin Integrates with netwrk devices fr additinal cverage and functinality Integrates with netwrk devices as primary methd f event triggering and endpint actin N integratin Endpint Agent Replacement HIPS/HIDS Antivirus Envirnment/Scale-Specific Tests Platfrm Windws Mac Linux Unix Andrid IOS Analysis, Lgging, Alerting and Reprting Timeline-based visualizatins Event crrelatin User activity crrelatin Artifact crrelatin Applicatin chain visualizatins Crprate Headquarters / 6130 Sprint Parkway / Ste. 400 / Overland Park, KS /

4 FishNet Security Endpint Prtectin Slutin Test Plan 4 Threat spread based visualizatin Text-based event / lg entries Mbile device alerting capability (SMS, , etc.) Search alerts / activity per device Search alerts / activity per subnet Search alerts / activity per physical lcatin Search alerts / activity per external site Search alerts / activity per destinatin cuntry Search alerts / activity per user Search alerts / activity per grup Search alerts / activity per perating system Search alerts / activity per applicatin / prcess Search alerts / activity per file Search / view behavir by resurce utilizatin Search / view behavir by least prevalence Search / view behavir by netwrk activity Search / view behavir by applicatin / functin activity Search / view behavir by file activity Search / view behavir by device Search / view behavir by subnet Search / view behavir by physical lcatin Search / view behavir by external site Search / view behavir by destinatin cuntry Search / view behavir by user Search / view behavir by grup Search / view behavir by perating system Search / view behavir by applicatin / prcess Search / view behavir by file Search / view by Publisher / Cmpany Search / view by Trust Factr Search / view by signed / unsigned binaries Search / view by Malware rating Search fr IOCs Search fr YARA rules Investigatr / user administratin activity auditing Custm activity reprting Exprt reprts via pdf, csv, xml, etc. Reprt Scheduling with Exprts ( , Share, SCP, etc.) Endpint Mnitring / Inspectin Methd Cntinuus / real-time activity mnitring Malicius activity detectin Unauthrized change detectin Unauthrized access detectin Scans triggered by external device(s) Scheduled scans Manually triggered scans Netwrk share activity Crprate Headquarters / 6130 Sprint Parkway / Ste. 400 / Overland Park, KS /

5 FishNet Security Endpint Prtectin Slutin Test Plan 5 Detectin Methds / Triggers System mdificatins autmatically identified System mdificatins identified by triggered scan prcess System mdificatins identified by manual scan prcess File retrspectin Prcess retrspectin Cnnectin retrspectin Netwrk activity anmaly Prcess activity anmaly File anmaly Prcess executin File access Registry access Prcess change File system change Registry change Permissin change / privilege escalatin Dmain generatin algrithm (DGA) File trajectry Prcess trajectry Cnnectin trajectry Device trajectry Changes t endpint / heuristics / behaviral analysis Crss-categry threat searching Least Prevalence IOCs YARA Rules Netwrk cnnectin crrelatin Attack chain weaving Sandbxing / virtual executin Exact cntent matching Partial cntent matching Fuzzy Hash SHA hash MD5 hash Publisher / Cmpany Trust Factr Signed / Unsigned binaries Malware rating Web script activity Shell script activity Blacklists Whitelists Operatinal Mdes Full Remediatin - reimage affected device t pristine state Surgical Remediatin - eliminate threats and assciated artifacts Crprate Headquarters / 6130 Sprint Parkway / Ste. 400 / Overland Park, KS /

6 FishNet Security Endpint Prtectin Slutin Test Plan 6 Partial Remediatin - kill prcesses Prcess Cntainment - prevent malicius prcess executin Full Netwrk Cntainment - prevent netwrk cnnectins t nly allwed lcatins Partial Netwrk Cntainment - prevent netwrk cnnectins t malicius sites Audit Only - bserve but nt mdify Blcking Triggers / Methds Applicatin heuristics File analysis Netwrk heuristics Netwrk destinatin reputatin Exact cntent matching Partial cntent matching Device Cntrl File/prcess whitelists Fuzzy hash SHA hash MD5 hash Publisher / Cmpany Trust Factr Signed Malware rating File/prcess blacklists Fuzzy hash SHA hash MD5 hash Publisher / Cmpany Unsigned Trust Factr Malware rating Stp / kill prcess executin Stp netwrk access t knwn malicius sites Stp netwrk access by knwn malicius applicatins Stp netwrk access by suspicius activity Stp netwrk access by netwrk driver replacement Applicatin Prtectin / Restrictin Restrict applicatin updates t legitimate surces Restrict internet cnnectins t knwn legitimate sites Restrict applicatin functins t knwn legitimate peratins Applicatin sandbxing / micr-virtualizatin Hst Interrgatin Methd Memry analysis (physical examinatin) File system analysis (physical examinatin) Memry analysis (lgical examinatin) File system analysis (lgical examinatin) Netwrk traffic cllectin / interceptin Crprate Headquarters / 6130 Sprint Parkway / Ste. 400 / Overland Park, KS /

7 FishNet Security Endpint Prtectin Slutin Test Plan 7 Windws API queries Endpint Frensics Preview and remte analysis File system Registry Memry Vlatile data Netwrk traffic data Remte cllectin / acquisitin File system Registry Memry Vlatile data Netwrk traffic data Cnnectrs Netwrk shares Cnnected shares FileNet Server Ggle Drive OpenTest ECM Server Sharepint Dcumentum Server DcuShare Server evault Exchange Server Exchange Online / 365 Server Dmin Server Crrelatin and scheduled events Cmprehensive timeline analysis Peridic snapshts in time Event-based snapshts in time User crrelatin Artifact crrelatin Vlatile data cllectin Disk preview Memry preview Vlatile data analysis Disk cntent searching and analysis Memry cntent searching and analysis Netwrk cntent searching and analysis Crprate Headquarters / 6130 Sprint Parkway / Ste. 400 / Overland Park, KS /