Automated Protection on UCS with Trend Micro Deep Security

Agenda 1. Industrialization of Cyber threats The boomerang of Project Olympic Games 2. How To Win the War Against Cyber crime? Holistic Protection for UCS, more than just Anti-virus 3. Trend Micro Deep Security: why it is different? Integration in the UCS stack 4. Fully automated agentless protection for UCS Do not rely on Operations to (forget to) protect your VMs 5. Fully automated (virtual) patching for UCS Patching windows XP after April 8th 6. Reducing scan overhead

Trend Micro What We Do How We Do It Who We Are Recognized global leader in server, virtualization and cloud security Innovative security solutions Protecting the exchange of digital information for businesses and consumers 1,200 threats experts in 12 TrendLabs locations around the globe; 1492 R&D engineers $400M USD and 500 engineers invested over last 4 years to develop cloud-related solutions Global Threat Intelligence Eva Chen: CEO and Founder Co-founded: 1988 Offices: 36 Global Employees: 4942 Revenue: $1.2B USD Cash Assets: $1.65B USD Operating Income: $330M USD Headquarters: Tokyo Trend Micro is the largest independent security provider Protecting 48 of 50 top global corporations 3

Industrialization of Cyber Threats

Damage caused by Cybercrime Today s Threat Landscape Evolution to Cybercrime CRIMEWARE Targeted Attacks Mobile Threats Intelligent Botnets Web Threats Spyware Vulnerabilities W orm Outbreaks Spam Mass Mailers Social Engineering Single Shot Malware BYOD Data Leakage Data Exfiltration Proximity Attacks 2001 2003 2004 2005 2007 2010 2011+ 6

Targeted Attacks =The new-normal - IDC A Cyber Intrusion Every 5 Minutes according to US-CERT Trend Micro finds over 90% of enterprise networks contain active malicious malware

Most Targeted Attacks Start with a Spear- Phishing Email

The Children of Stuxnet

Demo: Hacking Toolkits: Backtrack / Kali / Metasploit / Armitage

How long do Targeted Attacks stay hidden? Most companies breached in minutes but not discovered for months! Source: Verizon Data Breach Investigations Report 2012

How to win the war against Cyber-crime?

Holistic protection for UCS, much more than just A.V. Reduces attack surface. Prevents DoS & detects reconnaissance scans Tracks credibility of websites and safeguards users from malicious urls Optimizes the identification of important security events buried in log entries Firewall Web Reputation Log Inspection Intrusion Prevention Anti-Virus Integrity Monitoring Detects and blocks known and zero-day attacks that target vulnerabilities Detects and blocks malware (web threats, viruses & worms, Trojans) Detects malicious and unauthorized changes to directories, files, registry keys 14

Trend Micro Deep Security: why it is different

The journey to virtualization and the cloud: a story of Resource Contention Physical hardware 3 10% utilization (indicative) Virtualized 70 % utilization (indicative) Cloud 95 % utilization (indicative)

Virtualized Environments: enters security We need: Anti-Virus / Anti-Malware Host-based Intrusion Detection/Prevention Host Based Firewall Integrity Monitoring

VMware s #1 Security Partner Improves Security by providing the most secure virtualization infrastructure, with APIs, and certification programs Improves Virtualization by providing security solutions architected to fully exploit the VMware platform Integration with vcenter Integration with VCD Multi-tenancy

Virtualized Environments: agentless protection scanning appliance Anti-Virus / Anti-Malware Host-based Intrusion Detection/Prevention Host Based Firewall Integrity Monitoring

Deep Security Integration in the UCS stack

In Breadth and in Depth Reduces attack surface. Prevents DoS & detects reconnaissance scans Tracks credibility of websites and safeguards users from malicious urls Optimizes the identification of important security events buried in log entries Firewall Web Reputation Log Inspection Intrusion Prevention Anti-Virus Integrity Monitoring Detects and blocks known and zero-day attacks that target vulnerabilities Detects and blocks malware (web threats, viruses & worms, Trojans) Detects malicious and unauthorized changes to directories, files, registry keys 25

Fully automated agent-less protection for UCS

Fully automated agent-less protection for UCS Policy-based Security Automation: New VMs in vcenter are automatically detected by Deep Security and Security Profiles are assigned Provisioning new VMs Reconfiguring agents Rollout patterns Patch agents Checkpoint : Can you keep up with yet another new VM that needs to be secured? Can work Policy/Template-based accross VMs, or do you need to babysit your VM s one by one? Do new VMs that are created in vcenter, automatically show up in your security product, or do you have to manually define them?

Demo: Real-time, Agentless, HIPS VMs from vcenter appear in DSM and are automatically protected without touching the VM

Demo: Agentless Anti-virus protection

Fully automated Virtual Patching for UCS

Cost-savings by Virtual Patching Typical patch cycle without Virtual Patching 12 x patching /year Monthly Security Patching Half-yearly Full Patching

Cost-savings by Virtual Patching Typical patch cycle without Virtual Patching 12 x patching /year Monthly Security Patching Half-yearly Full Patching Typical patch cycle with Virtual Patching 2 x patching /year Automated, ongoing Security Patching Half-yearly Full Patching

Demo: Virtual Patching to protect against Exploits

Reducing Scan overhead

no more I/O Storms Anti-virus storm caused by: automatic antivirus scans signature updates agent-updates Typical AV Console 3:00am Scan Agentless operation by itself is not enough, the system needs to know which VMs are on which hypervisor (vcenter integration) Anti-virus Storm Checkpoint : Are you comfortable with the performance of your VMs, or does it feel like they are suffocated by the required security measures? Are your hypervisors occasionaly brought to their knees by Anti-Virus storms?

Scan de-duplication 1 st AM scan 2nd AM scan (cached) Scan time ~ 20x faster Significant CPU Reduction Huge IO Volume Reduction

To remember: In Breadth and in Depth Lower scan overhead Fully automated Agentless protection Automated virtual Patching: Higher security + Lower costs

Questions and Answers

Virtual Patching / hacking demonstration

Hacking demonstration This machine only runs Anti-virus This machine is is (automatically) virtuallypatched by by Trend Micro Deep Security.

Demo: Real-time, Agentless, HIPS

Anti-virus alone is no match against attacks

This machine is (automatically) virtuallypatched by Trend Micro Deep Security.

Questions and Answers