ORGANIZADOR: APOIANTE PRINCIPAL:

Transcription

1 ORGANIZADOR: APOIANTE PRINCIPAL: Miguel Gomes

2 Alliances Portugal, Africa, Brasil Coverage One of the biggest CSP worlwide Tec. Inovator Strong Cloud Bet and investment World biggest Software security company worlwide coverage Consumer to Enerprise solution More than 10 years providing security on Cloud

3 Recentley Announced 06Nov Symantec announced today a new partnership with Cisco to integrate technologies into their Applications Centric Infrastructure (ACI), a new application and security service insertion framework that enables IT to deliver a more secure, compliant and highly available infrastructure for applications and data. Cisco's ACI enables applications to become more dynamic within the physical and virtual infrastructure -- if IT wants to roll out an HR application today, for example, it would need to decide in advance what server, network and software the application would use. With Cisco's ACI, this can be changed up or down depending on what the application needs. "Cisco's application-centric approach represents a big step forward for our industry, enabling IT to automate provisioning of applications down to the network layer, and monitor the health of those applications from the infrastructure up -- all through a single pane of glass," said Symantec CEO Steve Bennett. "Together, Symantec and Cisco can deliver a more secure, compliant and highly available infrastructure for applications and information."

4 Security Brands

5 Global Intelligence Network Calgary, Alberta Dublin, Ireland San Francisco, CA Mountain View, CA Culver City, CA Austin, TX Pune, India Chengdu, China Chennai, India Taipei, Taiwan Tokyo, Japan Worldwide Coverage Global Scope and Scale Rapid Detection 24x7 Event Logging Attack Activity 240,000 sensors 200+ countries Malware Intelligence 180M client, server, gateways monitored Global coverage Vulnerabilities 45,000+ vulnerabilities 15,000 vendors 105,000 technologies Spam/Phishing 5M decoy accounts 8B+ messages/day 1B+ web requests/day Preemptive Security Alerts Information 5 Protection Threat Triggered Actions

6 Symantec Managed Security Services Fast Facts Receive over 2 billion security alerts daily Over 1000 Enterprise Customers 92 of the Fortune 500 Over 40,000 device under management 4 Security Operations Centers worldwide Managed Services Delivery Team of 170 experts 100% GIAC Certification for Analysts Security Response Team over 200 strong Development Team of over 30 engineers Security Operations Centers are SAS70 Type II and ISO27001 compliant Symantec Managed Security Services - Confidential 6

7 Symantec Named as a Leader in Global Threat Intelligence Market Source: IDC, Worldwide and U.S. Security Services Threat Intelligence Forecast: Out of the Basement and into the Clouds. Christian A. Christiansen, Charles J. Kolodgy, Chris Liebert Cyber Security 7 7

8 Symantec Named as a Leader in Global Threat Intelligence Market National Cyber Security Alliance (NCSA) USA BSI Germany Italy cyber Defense UK Israel Cyber Sec Cyber Security 8 8

9 Challenge: Access to Validated Cyber Intelligence and Analytic Support to Substantiate Actions Security Requirements: Threat identification Intelligence gathering and validation Develop situational awareness o Assess nature of the threat Create and implement action CTAP Offers a Global View and Response Capability: Access to cyber intelligence Subject Matter Expertise Comprehensive Toolset o Access to Symantec s Infrastructure

10 ADD ON CTAP CORE Symantec Cyber Threat Analysis Program Building your Intelligence Access to Symantec Global Intelligence Network Dedicated on site Analyst Customized analysis response and action Dedicated on site malware analysis tool Security Response deep analysis capabilities Access to advanced Reputation feed Proactive Intelligence Cyber Threat Analysis Program - CTAP 10

11 Symantec Cyber Threat Analysis Program Balancing Customer Requirements with Symantec Value Requirements CTAP Create and implement action Assess nature of the threat Intelligence gathering and validation Threat identification Access to Symantec s Infrastructure Comprehensive Toolset Subject Matter Expertise Access to cyber intelligence Cyber Threat Analysis Program - CTAP 11

12 Symantec Cyber Threat Analysis Program Areas of Analysis Intelligence Analysis: Provides analysis on malware or attacks seen gathering information from Symantec Global Intelligence. Malware Analysis: Provides deep analysis on malware leveraging analyst or Security Response Capabilities. Network Security Support: Provides network or system support for security remediation in order to mitigate risks. Forensic Analysis: Provides support to Client's forensic investigation related to internal IT environments, systems, and infrastructure. Cyber Threat Analysis Program - CTAP 12

13 Intelligence Analysis Intelligence Analysis: Provides analysis on malware or attacks seen gathering information from Symantec Global Intelligence. Leverage proprietary Symantec data, customer provided and open source data to perform all-source fusion analysis. Assist Customer Operation team with identification of possible threats to network security. Advise on mitigation and remediation of threats to Customer s network security Advise on methods to counter specific hostile actors and persistent threats. Provide technical expertise to Customer in identifying, modeling and reporting on emerging threats. Develop and support briefings to senior leadership as a cyber intelligence subject matter expert. Cyber Threat Analysis Program - CTAP 13

14 Malware Analysis Malware Analysis: Provides deep analysis on malware leveraging analyst or Security Response Capabilities. Conduct a behavioral and code-based review of items identified as possible malware; dynamic and static analysis Reverse engineer items identified as possible malware. Verify malware attack vectors and testing potentially impacted security controls. Reverse engineer new vulnerabilities in order to build counter attack signatures against known and unknown threats. Research emerging malware capabilities and delivery techniques and assist with integration of appropriate countermeasures and mitigations into your organization s processes. Develop and support briefings to senior leadership as a malware analysis subject matter expert. Cyber Threat Analysis Program - CTAP 14

15 Network Security Support Network Security Support: Provides network or system support for security remediation in order to mitigate risks. Collect attack and investigation metrics and trending data from Symantec proprietary sources and Customer-provided information sources. Track trends associated with characteristics of network threats Prioritize identified threats to Customer s network. Develop graphical representations of social and physical networks, processes, and timelines associated with specific network threats or actors. Participate in planning defensive cyberspace operations as a subject matter expert Assist with development of organizational strategies and network architectures to facilitate creation of secure cyber environments. Provide leadership to cross-functional teams responsible for responding to network incidents and providing remediation against attacks. Cyber Threat Analysis Program - CTAP 15

16 Forensic Analysis Forensic Analysis: Provides support to Client's forensic investigation related to internal IT environments, systems, and infrastructure. Assist in investigating and analyzing Customer computer network intrusions. Assist in the collection and preservation of evidence Assist in the performance of forensic analysis of compromised systems. Provide guidance for the continued development and implementation of Customer s computer security incident management program. Develop and support briefings to senior leadership as a cyber forensic subject matter expert. Cyber Threat Analysis Program - CTAP 16

17 Symantec MSS Solution Progressive Threat Model Expert Query Engine Relational Database Data mine Security Analyst Symantec Managed Security Services - Confidential Secure Internet Interface (SII) Analyst Response Console 1 8

18 Incident Detection What comes from where Endpoint Security NIDS NIPS Firewall Real time alerting of known virus/ malware and heuristic detections Immediate recognition of malware Real time alerting and analysis of signatures, traffic volumes and scanners Malware behavior analysis (traffic) Real time alerting and analysis of communication attempts, brute force attacks, etc Malware behavior analysis (connections) Proxy http OS & Apss Real time alerting of known command and control and http specific signatures Recognition of malware by behavior Real time alerting of brute force attacks, failed logins, extraction of PCI specific reporting Symantec Managed Security Services Executive Overview 19

19 Thank you! SYMANTEC PROPRIETARY/CONFIDENTIAL INTERNAL USE ONLY Copyright 2011 Symantec Corporation. All rights reserved. Cyber Threat Analysis Program - CTAP 20