UP L13: Leveraging the full protection of SEP 12.1.x

Transcription

1 UP L13: Leveraging the full protection of SEP 12.1.x Martial RICHARD Principal Field Enablement Manager Endpoint Security UP L13 1

2 Threat landscape (ISTR Vol.18 April 2013) for more details. UP L13 SYMANTEC VISION

3 UP L13 SYMANTEC VISION

4 Attack vectors Application Vulnerability Network Removable devices Social engineering 5

5 Protections layers Intelligence Devices Network Browser Insight File AV IPS Feedback IPS & Firewall Device control 6

6 Detection per technology Anti-Virus, 49% IPS, 42% Insight, 9% Proactive, 14% SONAR, 5% UP L13 SYMANTEC VISION

7 Benefits of Insight 0 Day protection 5+ Billions files Largest community in the market False positive mitigation Performance increase 8

8 Under the hood Behavior.EXE.SCR.DLL Submitter s Hygiene Digital certificate Reputation Score Source Domain Prevalence 9

9 Insight onboard Reputation store on each SEP 12.1 client Requires internet connection Requires a paid license to submit new sample and feedback 10

10 SONAR behavioral detection Artificial Intelligence Based Classification Engine Human-authored Behavioral Signatures Behavioral Policy Lockdown 11

11 SONAR Features Feature #1 - Artificial Intelligence Based Classification Engine Modify a USB Drive NO DETECTION Read/Write sensitive areas of the Registry NO DETECTION Modify DNS Settings NO DETECTION SONAR Classification Engine Rules Create executables Create other threats (Antivirus Engine) Bot-like activities (IPS Engine) NO DETECTION NO DETECTION DETECTED! Evidence Store 12

12 SONAR Features Feature #2 Behavioral Signatures Detects a sequence of behaviors exhibited by a specific threat-family Consider the PC Scout Family.. Always exhibits the following behaviors.. Launches from the Temp Folder Writes AVE to registry Modifies the Browser Home Page Creates a file hostinfo.txt 13

13 SONAR Features Feature #2 Behavioral Signatures Threat Analyst can write a Behavioral Signature to detect the PC Scout Family Advantages: If we see: 1. A file launch from the temp folder 2. Writes AVE to Registry 3. Creates a file hostinfo.txt THREAT ANALYST Then Block It!! LIVEUPDATE SYMANTEC CUSTOMERS Faster to write, test and release faster Response time Even lower false positives 4. Modifies the Browser Home Page Detection has actual threat name. e.g. PC Scout Family Detected along with threat write-up on Symantec Security Response site 14

14 SONAR Features Feature #3 Behavioral policy lockdown UP L13 SYMANTEC VISION

15 LAB TIME 16

16 SETUP SEP Client& SEPM SEPSTRESS 17

17 Exercises & infos Open SEPSTRESS site on the SEP client (windows 7): Follow the lab guide instruction and trigger each protection technology Look at the logs on the client. Increase the security posture by customizing policies Windows & SEPM Logins: User: admin Pwd:Symc4now! 18

18 One Louder: SEPM Reporting Protection Technology AV & Insight IPS & Browser Protection Firewall SONAR Reporting Section Risk Network Threat Protection Network Threat Protection SONAR 19

19 Thank you! Martial RICHARD Martial_richard[at]symantec.com Copyright 2012 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. UP L13 20