Palo Alto Networks October 6
Agenda Malware Trends by the numbers Protect Locally Share Globally
Delivery methods 21.5% ~14% OF MALWARE HAS BEEN DELIVERED OVER APPS OTHER THAN WEB AND EMAIL IN 2015 8.2% 7.5% i.e. SharePoint IAN..15 APR..15 IUL..15
Decryption ~ 40% OF WEB MALWARE HAS BEEN DELIVERED OVER SSL DAY-TO-DAY IN 2015 50% 46.5% 43.5% 24% i.e. Webmail File hosting Social media IAN..15 APR..15 IUL..15
File Types EXE files are known to be toxic/malicious for years DLL files became more toxic last year APK files became more toxic last year Office documents with Macro s Office with embedded executable
AV is dead? OF MALWARE IS NOT DETECTED BY ANY ANTI-VIRUS VENDOR
Agenda Malware Trends by the numbers Protect Locally Share Globally
CONTENT USERS APPLICATIONS KNOW WHAT S ON YOUR NETWORK AT ALL TIME BASED ON APPLICATIONS, USERS, AND CONTENT Classify all traffic by application (layer 7) with App-ID Tie users and devices to applications, regardless of location, with User-ID Scan content and protect against all threats, both known and unknown, with Content-ID
Structural Reduction of Attack Surface Provide true visibility Enable business-relevant apps & users Known threats Prevention TCP 223 427 * Discover unknown threats End Point Prevention 83 UDP unknown OLD FW APP/USER VISIBILITY & CONTROL URL/AV/IPS /DNS APT SANDBOX PROTECT ENDPOINT SHARED THREAT INTEL AUTOMATED LOOPBACK PROTECTION INVESTIGATE THE RELEVANT
Zero-Day discovery with WildFire Advanced threat visibility and prevention on all traffic, all ports (web, email, ftp, etc.) including SSL Global intelligence and protection delivered to all users Anti-malware signatures DNS intelligence Malware URL database Anti-C2 signatures Malware run in the cloud with open internet access to discover C2 protocols, domains, URLs and staged malware downloads Malware, DNS, URL, and C2 signatures automatically created based on WildFire intelligence and delivered to customers globally Stream-based malware engine performs true inline enforcement On-premises WildFire appliance available for additional data privacy Command-and-control Staged malware downloads Host ID and data exfil WildFire TM WildFire Users Soak sites, sinkholes, 3 rd party sources WildFire Appliance (optional) 32,000+ 7,500+ Customers NGFWs 10 2015, Palo Alto Networks. Confidential and Proprietary.
Agenda Malware Trends by the numbers Protect Locally Share Globally
Founding Members: Purpose: The Cyber Threat Alliance is a group of cyber security practitioners that have chosen to share threat information with each other for the purpose of improving defenses against advanced cyber adversaries across member organizations and their customers. 12 2014, Palo Alto Networks. Confidential and Proprietary.
Founding Members: Membership: Open to any organization that can share a minimum volume of threat intelligence designed by the Alliance. 13 2014, Palo Alto Networks. Confidential and Proprietary.
AutoFocus Palo Alto Networks Threat Intelligence Service
What AutoFocus provides Prioritize important events Context around indicators and incidents Quick and proactive response 223.144.191.23 Adversary Lotus Blossom Related indicators Connection: 101.55.121.171:443 DNS: gagalist.net Targets Government & Military Automatically export high-value indicator sets to security controls Prevent future attacks 15 2015, Palo Alto Networks. Confidential and Proprietary.
AutoFocus Architecture Intelligence with context 900M sessions 540M samples 110B artifacts WildFire TM Palo Alto Networks Threat Intelligence Cloud URL intelligence Dynamic DNS 60+ 3 rd party feeds WildFire intelligence correlated WildFire detects unknown threats on NGFW & Traps +32,000 devices worldwide 5M samples per day 70k unique malware per day 16 2015, Palo Alto Networks. Confidential and Proprietary.
Adding Context Intelligence on actors, campaigns and attack methods Context Analytics 17 2015, Palo Alto Networks. Confidential and Proprietary.
18 2015, Palo Alto Networks. Confidential and Proprietary.
19 2015, Palo Alto Networks. Confidential and Proprietary.