FROM PRODUCT TO PLATFORM

Transcription

1 FROM PRODUCT TO PLATFORM DATA EQUIPMENT 2016 Mikkel Bossen

2 Agenda Today s Challenges Data Growth, SSL encryption, Application Growth & SaaS What s hiding in under the surface? Legacy Security is that really the answer Security Requirement and the NEED for a Platform Approach

3 Today s Challenges Nir Zuk knew this +10 years ago and he wanted to change the Status Quo of Security

4 Challenge Data Growth

5 Challenge SSL/TLS encryption of Data

6 Challenge - Application Growth

7 Challenge SaaS SANCTIONED vs. UNSANCTIONED

8 What s hiding under the surface..

9 What s hiding under the surface.. Ports Applications IPs Users Application Growth SSL encrypted traffic Tunneling applications Evasive applications Malware Vulnerabilities Software Exploits Unknown applications Unknown users

10 Legacy Security Not going to cut it anymore

11 Failure of legacy security architectures Kill Chain & Point Products Limited visibility Lacks correlation Manual response DNS protection for outbound DNS DNS protection cloud Endpoint AV Enterprise Network UTM/Blades Anti-APT for port 25 APTs Anti-APT for port 80 APTs Internet Anti-APT cloud Network AV DNS Alert SMTP Alert Web Alert AV Alert Endpoint Alert DNS Alert SMTP Alert AV Alert Endpoint Alert Web Alert AV Alert DNS Alert Web Alert Vendor 1 Vendor 2 Vendor 3 Vendor 4 Internet Connection Malware Intelligence

12 Attacks have changed EXE Executable PDF Document Known signature? NO Known strings? NO Previously seen behavior? NO Legacy Endpoint Protection Malware direct execution Exploit vulnerability to run any code Targeted Evasive Evolving

13 Security Requirement and the NEED for a Platform Approach

14 Requirement Reduce and Control Risk Cloud FACILITATE ACCESS REDUCE AND CONTROL RISK Remove threats from wanted traffic Allow desired applications by user, limit high-risk features Visibility into all applications & users on the network

15 Core Security Concept of Palo Alto Networks Attacks should be PREVENTED BEFORE causing harm and not DETECTED AFTER causing harm

16 Delivering the next-generation security platform

17 Palo Alto Networks NextGen Firewall Disruptive Technology in 2005/ Identify and control applications regardless of port, protocol, evasive tactic or SSL 2. Identify and control users regardless of IP address, location, or device 3. Protect against known and unknown application-borne threats 4. Fine-grained visibility and policy control over application access / functionality 5. Multi-gigabit, low latency, in-line deployment

18 Threat Intelligence Cloud THE UNKNOWN REMEDIATION Automatically identified Automatically prevented 15,000 Anti-malware protections per day 24,000 URL protections per day 13,500 DNS protections per day Threat Prevention WildFire THREAT INTELLIGENCE CLOUD URL Filtering Forensics & Reporting Protections updated automatically every 5 minutes forensics reporting Rich and for quick, detailed investigation

19 Endpoint Protection

20 Introducing Traps /2014 Disruptive Endpoint Protection Prevent Exploits Including zero-day Exploits Prevent Advanced Malware Including unknown malware Collect Attempted-Attack Forensics For further analysis Lightweight, Scalable, User Friendly Must cover complete enterprise Integrate with Network and Cloud Security For data exchange and crossed-organization protection Traps Advanced Endpoint Protection

21 Introducing Aperture SaaS Security DETAILED CONTENT INSPECTION AND ANALYTICS CONTEXTUAL CONTROL OF DATA EXPOSURE PROGRAMABLE DOCUMENT CLASSIFICATION MALWARE DETECTION AND REMOVAL

22 AutoFocus: Actionable threat intelligence Highlight unique, targeted attacks and take action Find the important events Tags & statistical analysis highlight critical events Who is behind the attack Identify the actor and attack techniques Respond to the incident Block relevant indicators Empower Security Operations and Research Teams

23 The Center of our Platform - Threat Intelligence Cloud Network-based sandboxing and signature updates Actionable threat intelligence Traps endpoint anti-malware THREAT INTELLIGENCE CLOUD Vendor threat intelligence sharing SaaS security 3 rd party integrations , Palo Alto Networks. Confidential and Proprietary.

24 True Platform Integration an Example WildFire analyzes the unknown, renders a verdict, and shares its threat intelligence WildFire WildFire analyzes the unknown, renders a verdict, and shares its threat intelligence to NGFW automatically sends unknowns prevent the or suspicious unknown files on the and links NGFW to WildFire from that moment on Next-Gen Firewall to Traps automatically sends unknowns prevent the and suspicious unknown threat programs on all to endpoints WildFire from that moment on Traps

25 Palo Alto Networks is positioned as a Leader in the Gartner Magic Quadrant for enterprise network firewalls.* Palo Alto Networks is highest in execution and a visionary within the Leaders Quadrant. *Gartner Magic Quadrant for Enterprise Network Firewalls, Adam Hils, Greg Young, Jeremy D Hoinne, and Rajpreet Kaur, May Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

26 Thank You