Table of Contents. White paper. Executive Summary

Transcription

1 White paper Network Security Malicious threats to corporate networks are becoming more sophisticated than ever, and the consequences of downtime and security breaches have never been more severe. This white paper examines product solutions of four leading network security companies: McAfee, Symantec, Trend Micro and Websense. Table of Contents 1 Executive Summary 2 Market Overview 2 What Are the Threats? 3 What Are the Strategies? 3 Getting Started 4 What Are the Solutions? - McAfee - Symantec - Trend Micro - Websense 7 Summary 7 Partnering with CDW Executive Summary Business users are becoming more mobile and are using a wider variety of devices than ever before. While this makes for a more flexible and productive workforce, it also creates significant challenges to the security of corporate networks for businesses of all sizes. It s not just the increase in endpoints; it s what people are doing at the endpoints. Innovations such as social networks and cloud computing are opening up pathways to new security threats all the time. According to a recent article in The Washington Post, online attackers created more malware in 2009 than in the previous 20 years combined. And Google reported that in a single 18-month period, more than 3 million unique URLs on more than 180,000 websites were automatically installing malware. At the same time the threats are increasing, so are the consequences of failing to adequately address those threats. According to a recent report by the Ponemon Institute, the average cost of a security attack among 45 companies studied was nearly $18,000 per day, including costs for detection, investigation, recovery and post-response operations. With each attack averaging 14 days to resolution, the total cost of a single attack on average was more than $252, Every company surveyed experienced some type of web-based attack during a sample four-week period, and approximately 80 percent encountered attacks from viruses, worms or Trojan horses. With threats increasing and companies becoming more exposed, it is more important than ever that businesses of all sizes address network security with a comprehensive, coordinated and strategic approach to securing endpoints and the corporate network. This white paper examines the product strategies of four leading security companies: McAfee, Symantec, Trend Micro and Websense. The focus is on how each of them addresses security threats including viruses, Trojan horses, spyware and rootkits as part of an overall strategic approach to security for midsize and large enterprises. 1 The First Annual Cost of Cyber Crime Study, Ponemon Institute, July 2010

2 2 NETWORK SECURITY Market Overview Unfortunately, the threats to network and data security are everywhere, from organized hackers out to make money by selling Social Security numbers and credit card information in high volume, to careless employees leaving laptop computers in taxicabs, hotel lobbies or airplanes. What s more, the threats are increasing exponentially. More and more employees are using smaller and more powerful devices to communicate with the corporate network think of the proliferation of smart phones and ipads and each of those devices poses a new security threat. In addition, the explosion of social networking has given new sources of entry for those who would do harm to the corporate network and its data. How prevalent are security threats? The Digital Forensics Association studied 2,807 data breach incidents over a five-year period between 2005 and the end of During that period, more than million known records were disclosed. Hackers were the biggest threat: Although they accounted for only 16 percent of the reported incidents, they accounted for 45 percent of all the records disclosed an average loss of more than 715,000 records per incident. Laptops were responsible for the most breaches 49 percent but only 6 percent of records lost. In the case of laptop breaches, 95 percent of the time, they were the result of stolen devices: 33 percent of the time from offices and 28 percent of the time from vehicles. Outsiders were responsible for nearly 50 percent of the incidents and about half of the records that were lost. 2 The costs involved in dealing with cybercrime are equally staggering. Data breaches can damage business productivity, cause significant downtime, harm a company s reputation and result in stiff fines imposed by regulatory bodies. For the 45 companies studied in the Ponemon Institute report, the annual cost of cybercrime was $3.8 million per year for each company. In fact, each of the 45 companies studied experienced more than one successful attack per week on average. The most costly of the cybercrimes were those caused by web attacks, malicious code and malicious insiders, accounting for more than 90 percent of all cybercrime costs per organization on an annual basis. What Are the Threats? Organizations are more vulnerable to outside attacks because: 1. There are more points of vulnerability than ever a situation that will become only more challenging in the future, with more devices doing more things, holding more information and communicating more often with the corporate network. 2. The rise of Internet communications and social networking is adding significant new threats every single day. In a ninemonth period, the number of websites carrying malware increased by more than 400 percent, to more than 5,000 new sites discovered each day, according to a survey by Osterman Research There is money to be made, unfortunately, in cybercrime. Credit card numbers can fetch $2 to $3 each on the black market and significantly more in cases where they are accompanied by additional information that would lend to their authenticity. Outsider threats include hacking, viruses, Trojan horses, spyware, rootkits and other forms of malware designed to either steal information from the corporation or cause harm for any number of reasons, from revenge to the sheer challenge of breaking through security barriers. These threats are increasing in volume and becoming more sophisticated at the same time. In 2009, the Conficker worm threat created an hysteria in the Windows world that was akin to the predictions of a Y2K meltdown. In addition, malware kits, client-side vectors and zero-day exploits are continuing to grow as well. In fact, 80 percent of IT managers said they expect network-borne threats to increase throughout 2010 and 2011, according to a study by security and event management provider netforensics. 4 Insider threats are also increasing due to malice, negligence, a lack of policies, insufficient technology or any combination of these factors. According to the Ponemon report, more than 62 percent of companies surveyed experienced attacks related to malicious insiders. The average cost of these attacks was more than $100,000 each. The Ponemon research shows that the most costly attacks were those by viruses and worms, followed by malicious insiders. Figure 1 shows the percentage of annualized cybercrime cost by type of attack. (See Figure 1 on next page.) There are some experts who believe that the threat of attacks from malicious insiders will increase as a result of the challenges with the economy. In this economy, people are going to be more tempted to steal inside data, to sell it or use it for their own purposes, according to Jody Westby, adjunct distinguished fellow at Carnegie Mellon University s CyLab and CEO of Global Cyber Risk, a Washington, DC-based cyberintelligence firm. The insider threat will be more prevalent than in the past because there will be more desperate players out there. 5 2 The Leaking Vault, Five Years of Data Breaches, Digital Forensics Association, July Protecting Your Network Against the Growing Danger of Web Attacks, Osterman Research, Study Reveals 80 Percent of Respondents Feel Network Threats Will Increase in 2010 and 2011 While Budgets To Manage Them Are Reduced, netforensics, June New Insider Threat Emerges in the New Economy, Lumension White Paper, January 2009

3 CDW.com 3 Figure 1 Percentage of annualized cybercrime cost by attack type 25% 20% 21% 19% 17% 16% 15% 12% 10% 8% 6% 5% 0% Viruses & worms Malicious insider Web-based attack Malicious code Phishing & social engineering Botnet Malware What Are the Strategies? For IT professionals, one of the biggest threats to network security is not doing enough to secure the network. While 85 percent of IT professionals believe that their organization s security environment will grow more complex during 2010 and 2011, more than half of these professionals believe that their organization is not budgeting enough for security to manage these threats, according to the netforensics research. In addition, more than 65 percent of the respondents said they do not feel confident that their organization has complete visibility into its security posture at any point in time. There are many ways to approach network security. One way is to start at the endpoints, where you can install, at the very least, devices that block access to malicious websites, scan all and web downloads for malware, and apply the latest releases and patches in antivirus/antimalware/antispyware software. There are also a number of solutions at the endpoint to protect and prevent the loss of data at the device level, from whole disk encryption to content-filtering solutions to biometric tools that use fingerprinting to authenticate users. For most midsize and large organizations, however, managing security at the endpoint should be part of a broader network security solution that entails a comprehensive enterprise wide approach to security, including: 1. Dealing with threats at the endpoint 2. Incorporating endpoint security as part of a larger strategy that also includes: a. Web security b. Data center security c. Messaging/ security d. Data loss prevention 3. Dealing with new technology innovations as part of an overall network security strategy, including cloud computing, intrusion detection and virtualization The ideal roadmap for network security would be the following: Bake in security as part of the IT and business culture; tie security to the business, and view security as a cycle (see sidebar on page 4, A Roadmap for Network Security Success). Getting Started Building a threat-prevention strategy will enable you to create a multilayer security protection plan that prevents malicious attacks from entering your environment and corrupting your systems and data. There are five key areas of the infrastructure to consider when developing a threat prevention strategy: 1. Gateway and Network: Effective threat prevention solutions include antivirus, antispam, content filtering, intrusion detection, firewall and virtual private network services, and network access control. 2. Server Security: For those who would cause harm to the network, servers are the keys to the kingdom. Even if the

4 4 NETWORK SECURITY A Roadmap for Network Security Success One of the challenges for IT executives in managing security is that too often security isn t integrated as a core part of every IT project and product. Security is usually an add-on to already designed networks, applications and processes. And security features and functions aren t built in they are often treated as overhead, with no clear contribution to return on investment. CDW offers IT professionals a new model that serves as a roadmap to an effective security strategy. Bake in Security: Security must be baked into systems, applications and data. Whether it is identity access management, security information management or integrated threat management, security is rarely effective or efficient when it is added as an afterthought. Security can t be layered on at the end it has to be built in, at the beginning, to every piece of the business. Tie Security to the Business: By proactively mapping out risks to the business, both IT and business decision-makers can see where security is needed and where it isn t making it easier to plan and justify security investments. Good information security practice measures that risk and then finds a cost-effective way to mitigate it. View Security as a Cycle: Security should be thought of as a continuous process. The threat landscape is changing continuously, which means new products might be required to provide the right protection. Likewise, businesses are changing, too. The risks that may have caused concern in the past may have declined or they may have gotten worse. In addition, new applications could have become mission-critical in the interim and need to be adequately protected. Finally, it is important to have clear visibility into the performance of security tools so their effectiveness can be continually measured. server doesn t contain the information that is being sought, it can provide a means of accessing it. Antimalware protection, authentication, IP security and contenting filtering can help minimize this threat. 3. Client Security: As mentioned, threat prevention tools at the client level include antivirus, personal firewalls, threat protection and antispyware. 4. Data Loss Protection: Data loss or theft can come from outside attacks and malicious or negligent insiders. With data loss prevention solutions, organizations can use technologies and policies to identify and protect data, prevent breaches and minimize the chances of losing sensitive information. 5. Application Security: Attackers can exploit vulnerabilities in application code to access or manipulate the information within it. Employing firewalls and authentications to protect applications along with implementing enforceable security policies can mitigate these risks. Before analyzing and assessing the various network security solutions available to you, it is necessary to go through a specific process to define what types of solutions you need and where you need them. In conducting this process, it helps to work with an independent third party that has a wide breadth of knowledge and experience in developing security solutions and working with all of the leading security vendors. CDW delivers the skills, knowledge, expertise and vendor independence to partner with any business through this process and deliver the most comprehensive, cost-effective solution, no matter what your business needs. The first step in this process is to conduct a security audit and review of your existing environment, with a careful examination of where you are vulnerable. It s also critical to determine what information and applications are absolutely vital to protect the crown jewels, so to speak so your organization doesn t run the risk of exposing customer credit card information or employee Social Security numbers to potential intruders. You want to know where your most sensitive data resides, where and how it moves, and where your infrastructure is most vulnerable. After you have done the audit and review of the existing environment and risks, you should then go through a process of defining the project requirements. Once you get into vendor choices, having CDW as an independent thirdparty partner will be invaluable, because inevitably you will be deploying a suite of products, possibly from one vendor, possibly from several vendors. Many vendors bundle several threat protection technologies into sets, enabling cost savings and improved interoperability, as discussed below. What Are the Solutions? In examining the product strategies of the leading vendors, you will immediately see why it is important to have CDW as a partner to sort out the choices. Each of the vendors has a comprehensive list of products for just about any challenge from antimalware and antispyware to encryption and sophisticated data loss prevention solutions and tools to remove specific viruses, such as the Conficker worm. For most midsize and

5 CDW.com 5 large enterprises, it is far more likely that a bundled suite will be the answer because such solutions are not only more costefficient, but also enable the organization to take a more holistic approach to network security, tying in a number of different methods to address different challenges and potential points of attack. In comparing the solutions offered by the leading vendors, we will look at how they package their suites for midsize and large businesses. McAfee McAfee offers dozens of security solutions for midsize and large businesses, any of which can be integrated and delivered in multifunction suites, applications and services. The solutions are positioned to eliminate system threats, data breaches and data loss; protect and web traffic; and defend networks inside and out. Products for any security challenge from endpoint encryption to data loss prevention and monitoring to all levels of security management are available individually or as part of packages. Here are some of the packages a midsize or large enterprise might consider: McAfee Total Protection for Secure Business: This is designed as a full solution for midsize businesses, featuring data protection, web gateway security, security and desktop protection that includes antivirus, antimalware, host intrusion prevention, antispyware and desktop firewall. It provides full endpoint security, plus encryption for data wherever it is stored. Multiple layers of technology include IP reputation, domain name reputation, sender authentication and grey listing. Streaming updates are available to ensure that the latest releases and patches are up-to-date on all devices, applications and services across the enterprise. It also includes three levels of protection for the web, including URL filtering, which allows organizations to monitor and control web usage and enforce acceptable use policies. Security-as-a-Service: McAfee offers several Security-asa-Service (SaaS) solutions that address all levels of network security across the enterprise as a service, providing automatic updating of the security environment and 24x7 online access to monitoring and reporting. Solutions include SaaS Endpoint Protection, SaaS Vulnerability Assessment, SaaS Web Protection, SaaS Protection and Continuity, and SaaS Total Protection. The SaaS Total Protection package offers all of the benefits of Total Protection for Secure Business as a cloudbased managed service, including encryption, vulnerability scanning, continuity, web protection and URL filtering, among many other features. McAfee MOVE Anti-virus: McAfee Management for Optimized Virtual Environments (MOVE) is a security, virus protection and management solution that is optimized for virtual environments. It enables IT organizations to schedule scanning functions based on the overall load of the hypervisor for virtual servers. MOVE Anti-virus also enables IT to decrease the individual virtual machine resources required to support traditional antivirus processing and achieve policy management and reporting for all types of endpoint and server environments, regardless of whether the endpoints are physical or virtual. Symantec Symantec offers a full range of individual, packaged and hosted solutions to address any security issue for midsize or large enterprises. Its solutions comprise state-of-the art technology that can be optimized for virtualized and cloud environments, and include functionality for security management, endpoint security, messaging security and web security, among other capabilities. The following are among some of Symantec s more strategic offerings: Symantec Protection Suite: This solution addresses the most pressing endpoint, messaging and backup protection requirements for small and midsize businesses. It features protection at the endpoint, including antivirus and antispyware solutions that offer deep protection against rootkit malware; a hostbased firewall that protects the network by enforcing traffic rules; a rules-based engine that provides proactive threat protection; and single-agent and single-console management to keep endpoint computing loads and administrative burdens manageable. Other key features include scanning of outbound and inbound traffic; content filtering; signature-based spam protection; and features for backup and recovery, including background operation, centralized monitoring, application protection and full system recovery. Symantec Protection Suite Enterprise Edition: This solution is designed to create a protected endpoint, messaging and web environment that is secure against malware, data loss and spam threats and is quickly recoverable in the event of failure. Key features include proactive protection for laptops, desktops, servers, mobile devices and messaging and web environments; advanced content filtering and data loss prevention; antispam and antivirus protection for and instant messaging (IM); web gateway security that protects against threats from spyware, botnets, viruses and other types of malware; rapid data and system recovery; granular control over policies and features; and integrated protection technologies such as network

6 6 NETWORK SECURITY access control, antivirus, antispyware, desktop firewall, intrusion prevention, and application and device control technologies. In addition, Symantec offers separate Enterprise Editions for endpoints, gateways and servers. Symantec Hosted Services: Among the advantages of Symantec s hosted or SaaS solutions are capabilities to block spam and virus threats before they reach the corporate network, the combination of commercial and proprietary malware scanning engines, as well as the ability to address converged threats across , web and IM protocols. Packages are available for hosted security and hosted management. Hosted security solutions are for endpoint protection and , web and IM security. Hosted management solutions are for encryption, continuity and archiving. Trend Micro Trend Micro offers five suites for midsize businesses, a fully integrated Enterprise Security suite for larger enterprises as well as a full line of hosted solutions for any size enterprise requiring any type of security solution, from antispam and antimalware to data loss prevention to fully integrated, fully managed enterprise-wide security. Trend Micro s enterprise solutions are also positioned to deliver specific benefits for virtualization, compliance and cloud computing. Solutions for Midsize Businesses: Trend Micro s solutions for midsize businesses include the Enterprise Security Suite, which is discussed in more detail below. Other suites are Enterprise Security for Endpoints, which provides immediate antimalware protection for every endpoint in the organization; Enterprise Security for Endpoints and Mail Servers, which is a single integrated solution to protect mail servers, file services, desktops, laptops and mobile devices against viruses, spyware, phishing, inappropriate content and blended threats; Enterprise Security for Gateways, which integrates virtualized web and messaging gateway security with antispam, antivirus and URL filtering; and Enterprise Security for Communication and Collaboration, which protects , collaboration and IM systems by stopping threats in real time. Enterprise Security: This is a fully integrated suite that combines a variety of solutions, including endpoint security, with antimalware, web threat protection, intrusion defense and data loss prevention; data center security, with firewall, IPS, file and system integrity monitoring and application protection to ensure security and compliance for physical, virtual and cloud servers; data protection, with identity-based encryption and content filtering solutions; web security, with cloud-based reputation services, content scanning and URL filtering; messaging security that blocks spam, malware, phishing and data leaks at the gateway, mail server, IM server and collaboration server; solutions and services to reduce risk, protect against evasive threats and simplify security; and central management, which provides platforms for security management and unified security and systems management. Hosting Solutions: Trend Micro offers businesses three packages for hosted security: Hosted Security is designed to stop spam and viruses and improve mail server performance; Worry-Free Business Security Services, designed for small offices, protects multiple PCs and notebooks located in or out of the office, with the ability to centrally manage security from any location; and Secure Site is a fully integrated solution that provides website security by scanning for vulnerabilities that can emerge as website content is added or modified. Websense Websense offers a wide range of security solutions under the general categories of web security, data security and security. It also offers a full complement of hosted solutions as well as Websense Triton, which provides a full suite of security solutions under a unified architecture for midsize and large businesses. Web Security Solutions: Websense offers Web Security Gateway solutions that can be deployed with appliances, as an SaaS solution or as a unified hybrid mix of any platform combination. Web Security Gateway solutions include dynamic and scripted malware protection against legacy file-based attacks as well as web scripts and dynamic threats that evade traditional antivirus solutions. In addition, Websense offers security for social networking sites through its Defensio Web service, a security application for Facebook. Constant ThreatSeeker Network cloud-based security updates block access to pages known to host web exploits. Data Security Solutions: These are offered as part of the Websense Triton solution, which is discussed in further detail below. Websense data security solutions support a wide range of deployment options and enable organizations to deploy the data loss prevention solution that best meets their needs. The features offered enable organizations to identify and monitor sensitive data and help prevent loss through data transmission and exchange, including , web, USB and other channels. Built-in templates for regulated industries such as financial and healthcare simplify the task of ensuring compliance. Hosted Security Solutions: These solutions are offered in several forms, including Hosted Web Security and Hosted Security. With Hosted Web Security, SaaS custom-

7 CDW.com 7 ers gain all the benefits of Websense s web security without having to deploy and support on-premises hardware or remote client software. Features also include dynamic malware protection and a database of more than 90 customizable web categories that enable organizations to manage acceptable use policies and block access to sites associated with spyware, phishing, keylogging and other threats. Hosted Security is also offered as an SaaS platform and includes all of the features Websense offers for multipurpose protection, including protection from spam, viruses, phishing, malicious web links in , employees who confidential information, as well as new and ever-evolving attack strategies. Websense Triton: Triton is a unified approach that combines web security, security and data loss prevention technologies into one architecture. It enables organizations to use SaaS to lower their total cost of ownership by streamlining their content security appliance infrastructure requirements. Websense s TruHybrid solution reaches across global enterprises to unify deployment of high-performance appliances at corporate headquarters with SaaS at branch and remote offices. With Websense Triton, organizations can safely use the web as an application platform while protecting organizations in real time from blending and emerging threats, no matter where their employees reside. Websense TruContent intelligence unifies content visibility and analysis all the way to the data level as it flows into, within and out of an organization. Summary The threats to networks and corporate data are not going away any time soon. Unless your organization has done an audit and threat analysis, you may not know how vulnerable you really are and where those vulnerabilities may be most egregious. For many organizations, the results of this type of audit can be eye-opening, with companies exposing critical data to the threat of theft, loss or corruption far more frequently than they would like. According to the report from the Digital Forensic Association, the number of records disclosed over a five-year period was the equivalent of twice for every single person in the United States. It is fortunate, indeed, that industry-leading vendors are ahead of those who would harm corporate networks. Companies such as McAfee, Symantec, Trend Micro and Websense offer innovative, state-of-the-art technology solutions that address any of the security challenges facing businesses today. But if businesses are not using the right technology in the right places with the right controls and policies, then all of the technology in the world won t provide ample protection. Getting started with an audit and assessment and working with a thirdparty partner to independently assess both your challenges and possible solutions is a necessary starting point. And it s not something to put off you certainly don t want to wait until you ve been hacked or valuable data has been compromised to get started. Partnering with CDW CDW works with midsize and large enterprises to assist with every phase of choosing and leveraging the right threat prevention solution for your IT environment and budget. CDW s approach includes: An initial discovery session to understand your goals, requirements and budget. An assessment review of your existing environment and definition of project requirements. Detailed vendor evaluations, recommendations, future environment design and proof of concept. Procurement, configuration and deployment of the final solution. Ongoing product lifecycle support. In addition, CDW offers a hosted solution that helps organizations implement and maintain their network security a defense-in-depth security strategy that conforms to industry best practices. Our hosted solution helps you secure your business network and protect valuable resources by providing: Comprehensive Service: CDW can provide comprehensive network security through deployment and management of several key infrastructure systems. Expert Experience: CDW engineers are uniquely qualified to help you implement and maintain security solutions. Our extensive background in operating systems, networking, programming and system administration complements our expertise in security. A Clear Purpose: We understand the interplay of all network layers, spot and eliminate single points of security failure, and design solutions with a clear purpose and awareness of total security policy and network infrastructure. The threats are out there. So are the solutions. Contact CDW to get started or visit cdw.com/security for more information.

8 8 NETWORK SECURITY About CDW CDW is a leading provider of technology solutions for business, government, healthcare and education. Ranked No. 41 on Forbes list of America s Largest Private Companies, CDW features dedicated account managers who help customers choose the right technology products and services to meet their needs. The company s technology specialists offer expertise in designing customized solutions, while its technology engineers and solution architects can assist customers with the implementation and long-term management of those solutions. Areas of focus include notebooks, desktops, printers, servers and storage, unified communications, security, wireless, power and cooling, networking, software licensing and mobility solutions. CDW was founded in 1984 and as of March 31, 2010, employed approximately 6,150 coworkers. In the 12 months trailing March 31, 2010, the company generated sales of $7.6 billion. Intently focused on responding to customers technology needs with a sense of urgency, CDW helps customers achieve their goals by providing the right technology products and services they need when they need them _101221