FROM PRODUCT TO PLATFORM DATA EQUIPMENT 2016 Mikkel Bossen
Agenda Today s Challenges Data Growth, SSL encryption, Application Growth & SaaS What s hiding in under the surface? Legacy Security is that really the answer Security Requirement and the NEED for a Platform Approach
Today s Challenges Nir Zuk knew this +10 years ago and he wanted to change the Status Quo of Security
Challenge Data Growth
Challenge SSL/TLS encryption of Data
Challenge - Application Growth
Challenge SaaS SANCTIONED vs. UNSANCTIONED
What s hiding under the surface..
What s hiding under the surface.. Ports Applications IPs Users Application Growth SSL encrypted traffic Tunneling applications Evasive applications Malware Vulnerabilities Software Exploits Unknown applications Unknown users
Legacy Security Not going to cut it anymore
Failure of legacy security architectures Kill Chain & Point Products Limited visibility Lacks correlation Manual response DNS protection for outbound DNS DNS protection cloud Endpoint AV Enterprise Network UTM/Blades Anti-APT for port 25 APTs Anti-APT for port 80 APTs Internet Anti-APT cloud Network AV DNS Alert SMTP Alert Web Alert AV Alert Endpoint Alert DNS Alert SMTP Alert AV Alert Endpoint Alert Web Alert AV Alert DNS Alert Web Alert Vendor 1 Vendor 2 Vendor 3 Vendor 4 Internet Connection Malware Intelligence
Attacks have changed EXE Executable PDF Document Known signature? NO Known strings? NO Previously seen behavior? NO Legacy Endpoint Protection Malware direct execution Exploit vulnerability to run any code Targeted Evasive Evolving
Security Requirement and the NEED for a Platform Approach
Requirement Reduce and Control Risk Cloud FACILITATE ACCESS REDUCE AND CONTROL RISK Remove threats from wanted traffic Allow desired applications by user, limit high-risk features Visibility into all applications & users on the network
Core Security Concept of Palo Alto Networks Attacks should be PREVENTED BEFORE causing harm and not DETECTED AFTER causing harm
Delivering the next-generation security platform
Palo Alto Networks NextGen Firewall Disruptive Technology in 2005/2007 1. Identify and control applications regardless of port, protocol, evasive tactic or SSL 2. Identify and control users regardless of IP address, location, or device 3. Protect against known and unknown application-borne threats 4. Fine-grained visibility and policy control over application access / functionality 5. Multi-gigabit, low latency, in-line deployment
Threat Intelligence Cloud - 2011 THE UNKNOWN REMEDIATION Automatically identified Automatically prevented 15,000 Anti-malware protections per day 24,000 URL protections per day 13,500 DNS protections per day Threat Prevention WildFire THREAT INTELLIGENCE CLOUD URL Filtering Forensics & Reporting Protections updated automatically every 5 minutes forensics reporting Rich and for quick, detailed investigation
Endpoint Protection
Introducing Traps - 2013/2014 Disruptive Endpoint Protection Prevent Exploits Including zero-day Exploits Prevent Advanced Malware Including unknown malware Collect Attempted-Attack Forensics For further analysis Lightweight, Scalable, User Friendly Must cover complete enterprise Integrate with Network and Cloud Security For data exchange and crossed-organization protection Traps Advanced Endpoint Protection
Introducing Aperture SaaS Security - 2015 DETAILED CONTENT INSPECTION AND ANALYTICS CONTEXTUAL CONTROL OF DATA EXPOSURE PROGRAMABLE DOCUMENT CLASSIFICATION MALWARE DETECTION AND REMOVAL
AutoFocus: Actionable threat intelligence - 2015 Highlight unique, targeted attacks and take action Find the important events Tags & statistical analysis highlight critical events Who is behind the attack Identify the actor and attack techniques Respond to the incident Block relevant indicators Empower Security Operations and Research Teams
The Center of our Platform - Threat Intelligence Cloud Network-based sandboxing and signature updates Actionable threat intelligence Traps endpoint anti-malware THREAT INTELLIGENCE CLOUD Vendor threat intelligence sharing SaaS security 3 rd party integrations 23 2016, Palo Alto Networks. Confidential and Proprietary.
True Platform Integration an Example WildFire analyzes the unknown, renders a verdict, and shares its threat intelligence WildFire WildFire analyzes the unknown, renders a verdict, and shares its threat intelligence to NGFW automatically sends unknowns prevent the or suspicious unknown files on the and links NGFW to WildFire from that moment on Next-Gen Firewall to Traps automatically sends unknowns prevent the and suspicious unknown threat programs on all to endpoints WildFire from that moment on Traps
Palo Alto Networks is positioned as a Leader in the Gartner Magic Quadrant for enterprise network firewalls.* Palo Alto Networks is highest in execution and a visionary within the Leaders Quadrant. *Gartner Magic Quadrant for Enterprise Network Firewalls, Adam Hils, Greg Young, Jeremy D Hoinne, and Rajpreet Kaur, May 2016. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
Thank You