Symantec Endpoint Protection 12.1 Symantec Protection Center 2.0 Let me phone a friend Jimmy Sandberg Presale Engineer
What s new in Symantec Endpoint Protection 12.1 Unrivaled Security Blazing Performance Built for Virtual Environments Powered by Insight Real Time Behavior Monitoring with SONAR Up to 70% reduction in scan overhead Smarter Updates Faster Management Tested and optimized for virtual environments Higher VM densities
Research Powered by Global Intelligence Network Identifies more threats, takes action faster & prevents impact Calgary, Alberta Dublin, Ireland San Francisco, CA Mountain View, CA Culver City, CA Austin, TX Pune, India Chengdu, China Chennai, India Taipei, Taiwan Tokyo, Japan Worldwide Coverage Global Scope and Scale Rapid Detection 24x7 Event Logging Attack Activity 240,000+ sensors 200+ countries and territories Malware Intelligence 150M client, server, gateways monitored Global coverage Vulnerabilities 35,000+ vulnerabilities 11,000 vendors 80,000 technologies Spam/Phishing 5M decoy accounts 8B+ email messages/day 1B+ web requests/day Preemptive Security Alerts Information Protection Threat Triggered Actions
Traditional Signatures The changing threat landscape - An explosion of malware 7000000 In 2010 >50,000 signatures a day 6000000 5000000 Expected in the end of 2011: >100.000 unique signatures a day 4000000 3000000 2000000 1000000 In 2000 5 signatures a day In 2007 1,500 signatures a day 0 4
Malware authors have switched tactics From: A mass distribution one worm hits millions of PCs Storm made its way onto millions of machines across the globe To: 75% of malware infect less than 50 machines A micro distribution model. Hacked web site builds a trojan for each visitor The average Harakit variant is distributed to 1.6 users!
The Idea Only malware mutates So... if an executable is unique, it s suspicious... but how to know if a file is unique?
Unrivaled Security
Foundation of reputation based security Reputation: Game-changing approach Leverages data on hundreds of millions of files Reduces reliance on signatures Amplifies current protection Shifts the odds in our favor
The protection stack Network IPS Insight Heuristics & Signature Scan Real time behavioral SONAR Firewall Network & Host IPS Monitors vulnerabilities Monitors traffic Application & Device ctrl. Stops stealth installs and drive by downloads Focuses on the vulnerabilities, not the exploit (GEB) Improved firewall supports IPv6, enforces policies
Insight Provides Context Network IPS & Browser Protect Insight Insight: Before we scan check the reputation Heuristics & Signature Scan Real time behavioral SONAR Identifies new and mutating files Feeds reputation to our other security engines Only system of it s kind
How Symantec Insight works 2 Rate nearly 3.0 billion every file on files* the internet (* Sept 2011) 4 Check the DB during scans 1 Build 175 a collection million network PCs Is it new? Bad reputation? Prevalence Age 5 Provide actionable data 3 Look for reputation Source Behavior
Insight - Reputation Protection Allow the customization of a policy for end user experience Threshold can be set for age and prevalence Log and report on infection source Includes protection for browsers, peer to peer apps, email, and chat
Policies based on Risk Finance Dept Help Desk Developers
So what is special about Insight? Symantec Insight Ranks all executable files Tracks prevalence Tracks age Signatures for new malware Only Insight can answer: How old is the file? How many copies are there? Is the file associated with infections? Only Insight can use reputation to identify mutating threats
File Scanning Network IPS & Browser Protect Insight File Scanning Cloud and Local Signatures New, Improved update mechanism Heuristics & Signature Scan Real time behavioral SONAR Most accurate heuristics on the planet. Uses Insight to prevent false positives
SONAR (TruScan) Completes the Protection Stack Network IPS & Browser Protect Insight SONAR Monitors processes and threads as they execute Rates behaviors Feeds Insight Heuristics & Signature Scan Real time behavioral SONAR Only hybrid behavioralreputation engine on the planet Monitors 400 different application behaviors Sonar is formerly known as TruScan
SONAR - Reputation Protection Enhanced by Insight to keep False Positive detects to a minimum Analyzes file system and network behavior Tamper Protection utilizes same technology
Browser Intrusion Protection Can be updated in the field to protect against new browser vulnerabilities Protection for Internet Explorer, Firefox and Chrome
File-Based Signatures are NOT Enough 2009 33% Insight -blocking 90,000 downloads 2010 /day Sonar 53,000 malicious files and processes blocked /day This is an increase of 50% >3.000% since 2008 Insight helping convict >1000,000 files / day AV Detection AV Detections IPS Dections IPS Detections
Blazing Performance
Faster Scans with Insight On a typical system, 70% of active applications can be skipped! Traditional Scanning Has to scan every file Insight - Optimized Scanning Skips any file we are sure is good, leading to much faster scan times 24
Improved client performance: ScanLess and Scan on Idle Use reputation to whitelist Symantec trusted and community trusted files Provide administrator with choices to use the information or run in paranoid mode Scan when system is idle Applicable to scheduled and on demand scans Chart for Demonstration Purposes Only And tons of new features and performance enhancements under the hood
Built for Virtual Environments
SEP 12.1 is built for Virtual Environments Optimized for VMware, Citrix and Microsoft virtual environments Easy to identify and manage physical and virtual clients Maximizes performance and density without sacrificing security Best in class performance and security Hypervisor Scan Cache
Virtualization Features Image Exception Used on cloned images Excludes all files Reduces scan impact Shared Insight Cache Clients share scan results Scan files once Leverages Insight Enhances Management Reduces Disk I/O up to 90% Virtual Client Tagging Identifies hypervisor Set group specific policy Search for virtual clients Resource Leveling Used for all virtual systems Reduce overlap of events Scans and def updates
Shared Insight Cache - High Level Shared Insight Cache Server (SIC) File Hash Def Ver Result AE32D 2011.1... Clean B923E 2011.1 Clean F9123 2011.1 Clean C3FDA 2010.2 Clean VM VM VM VM VM VM ESX Server VM Cluster* *Works for ESX, Citrix and Hyper-V VM VM VM VM VM VM ESX Server
But, what about agent-less installations? If we take the scanner out of the VM clients it would work. However, it won t support a full endpoint protection package No client-based packet inspection No client-firewall (HIPS/NIPS) No application control or device control No system integrity monitoring No real-time behavioral protection (SONAR)
What s needed to defend the Virtual Endpoint Signature and Heuristic File Scanning Insight Network and Host IPS Browser Protection SONAR Application and Device Control
Simplified Administration
A Friendly Welcome Screen Provide guidance with a welcome screen that highlights the common tasks Features: Deploy SEP client Run LiveUpdate Product tour License status Adjust the server configuration
The new SEPM home page Features: Allow administrators of all signature deployments Launch of common tasks like client deployment Simplified endpoint status Simplified ThreatCon License status
New and improved email notifications Features: Can be viewed on a smartphone (HTML) License renewal and partner messages New client software is available Detecting unprotected clients Policy changes
Package deployment: Include latest Virus Definitions Provides an option that reduces signature impact on network Option to include latest signatures Option to limit signatures
Installation status reporting Register client in console as soon as installation starts Features: Report includes detailed client installation status Populates for all installation methods Reboot commands initiated from the report
Enhanced Disaster Recovery Solution: Allow a SEPM reinstall to use existing backed-up certificates so that clients just reconnect. Notes: This was the #1 supportability request
In Product Licensing Supports Trialware conversion In product activation License status, reports and notification reminders (content enforcement for SBE)
Symantec Protection Center 2.0
Key Buyer: Security Operations Customer Objectives Internal Threat Reporting Prioritized Actions Implement commands to products based on role Symantec Solution Protection Center 2.0 Single Sign On Data collection Action Existing Tools!!!!!
What s New in SPC 2.0? Three levels of integration- Single Sign on, Data collection, Action Symantec GIN Integration Basic event correlation Cross Product Reportingmalware, email, asset Dashboard Notifications Prebuilt workflow templates- Symantec Endpoint Protection STEP 3 rd Party Program
Protection Center Console Reports Dashboards Notifications Settings Technical Architecture Information Flow Symantec Services DeepSight SPC Data https://servername/symantec/protectioncenter Symantec Protection Center Server Security Event Data Storage Exchange Event Channel Event Event Channel Channel Event Summarizer Workflow Event Trigger Asset Processor Data Collection Service Registration Wizard Event Event Archives Event Archives Archives CMDB Integration Web Services Data Feed Registration
Protection Center 2.0 Integrated Products Symantec Endpoint Protection Symantec Messaging Gateway Symantec Mail Security for Microsoft Exchange Symantec Data Loss Prevention Suite PGP Encryption from Symantec Symantec Control Compliance Suite VeriSign Managed Public Key Infrastructure (PKI) for SSL Deepsight Intelligence Services Bay Dynamics IT Analytics Bit 9 Parity Suite: Endpoint Protection
Symantec Protection Center for ipad
Protection Center for the ipad Relevant, Actionable Security Intel for Executives Role Based Dashboard. Executive summary of corporate risk posture relative to your organization Real-time Threat Intelligence. Global threat data from one of the largest sources of external threat intelligence Location aware compliance. Cross product reporting for internal and external IT compliance policies
Welcome Dashboard
What s New in Symantec Endpoint Protection 12.1 Unrivaled Security Blazing Performance Built for Virtual Environments Powered by Insight Real Time Behavior Monitoring with SONAR Up to 70% reduction in scan overhead Smarter Updates Faster Management Tested and optimized for virtual environments Higher VM densities
Thank you! http://www.emea.symantec.com/blackmarket/sv Copyright 2011 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice.