More Related Content
Similar to Check point presentation june 2014
Similar to Check point presentation june 2014 (20)
More from David Berkelmans
More from David Berkelmans (7)
Check point presentation june 2014
- 1. 1©2014 Check Point Software Technologies Ltd.
Cyber Attacks: Protecting against the
Unknown Unknowns
Keith D. Holtham
Check Point Software Technologies Australia
- 3. 3©2014 Check Point Software Technologies Ltd.
The Internet of everything BRINGS WITH IT new challenges
- 4. 4©2014 Check Point Software Technologies Ltd.
Adobe breach hit more than 150
million usernames and passwords
According to foreign media the organization behind the attack is suspected to be
an unnamed government organization...
Target credit card hack reveals
need for updated security
The U.S. is the juiciest target for hackers hunting credit card information. And …
4.6 Million Snapchat usernames
and phone numbers leaked
A new website called SnapchatDB! Has allegedly leaked 4.6 million Snapchat..
- 6. 6©2014 Check Point Software Technologies Ltd.
Value of a Hacked PC
http://krebsonsecurity.com
- 7. 7©2014 Check Point Software Technologies Ltd.
ASD Top 35 – Top 14 Mitigation Strategies
1. Application white listing
2. Application patching
3. OS Patching
4. Restrict Admin privileges
5. User application configuration hardening
6. Automated dynamic analysis of email and web content (Sandboxing)
7. Operating system Generic exploit mitigation
8. Host based Intrusion Detection/Prevention
9. Disable Local Admin accounts
10.Network Segmentation
11.Multi-Factor Authentication
12.Software-Based Application firewall - Incoming
13.Software-Based Application firewall – Outgoing
14.Non-Persistent virtualised sandboxing
- 18. 18©2014 Check Point Software Technologies Ltd.
TARGET attack
RAM-scraping kit: BlackPOS (VBScript – 207kB)
Created in March 2013
Kit author: Rinat Shabayev, 23 years old
Cost: 1800-2300$
- 20. 20©2014 Check Point Software Technologies Ltd.
Critical Infrastructure at Risk!
Critical and industrial systems
make our modern world
Like other IT systems, they are
prone to attacks
The consequences of such attacks
are much greater:
- Power failures
- Water pollution or floods
- Disruption of transportation systems
- Malfunction of Production Lines
- 21. 21©2014 Check Point Software Technologies Ltd.
Important Attacks
Stuxnet, Duqu, Flame
Pacific Energy,
Saudi Arabia Aramco
German Power Utility, 50Hertz
Queensland, Harrisburg and
Willows Water System
- 23. 23©2014 Check Point Software Technologies Ltd.
FIND THE
WEAKEST
LINK
GET
ACCESS
EXTRACT
DATA
3 steps of modern attacks
- 26. 26©2014 Check Point Software Technologies Ltd.
Top Vulnerable Applications
list of leading vulnerable applications in 2012
Adobe Reader
Adobe Flash Firefox
Java Microsoft Office
Internet Explorer
30 Critical
vulnerabilities
17 Critical
vulnerabilities
16 Critical
vulnerabilities
57 Critical
vulnerabilities
91 Critical
vulnerabilities
14 Critical
vulnerabilities
- 27. 27©2014 Check Point Software Technologies Ltd.
WOULD YOU OPEN
THIS ATTACHMENT?
“Over 90% of targeted emails use malicious file
attachments as the payload or infection source”
Wall Street Journal Nov, 2012
- 29. 29©2014 Check Point Software Technologies Ltd.
Gathering Intelligence
First Name
Last Name
Likes
Gender
Email
Phone Number
Topic of Interest
Usernames
Social Profile Technical Profile
IP Address
Browser Type
Plug-ins deployed
OS Type
Patch History
Anti-Virus Brand
Applications
User permissions
- 30. 30©2014 Check Point Software Technologies Ltd.
Choosing the right weapon
Zero-Day
Exploits
Patched
Vulnerabilities
- 31. 31©2014 Check Point Software Technologies Ltd.
In reality, it’s impossible to patch everything
- 33. 33©2014 Check Point Software Technologies Ltd.
WHAT ABOUT
NEW ATTACKS?
Block download of
malware infested files
Detect and prevent
bot damage
Stops exploits of
known vulnerabilities
Multi-Layered Threat Prevention
IPS
Anti-Bot
Antivirus
- 34. 34©2014 Check Point Software Technologies Ltd.
ONLY DEALS
WITH THE
KNOWN
Multi-Layered Threat Prevention
IPS
Anti-Bot
Antivirus
- 35. 35©2014 Check Point Software Technologies Ltd.
HOW TO DEAL
WITH THE
UNKNOWN ?
Multi-Layered Threat Prevention
IPS
Anti-Bot
Antivirus
- 36. 36©2014 Check Point Software Technologies Ltd.
Known Unknowns –
Top Vulnerable Applications
list of leading vulnerable applications in 2012
Adobe Reader
Adobe Flash Firefox
Java Microsoft Office
Internet Explorer
30 Critical
vulnerabilities
17 Critical
vulnerabilities
16 Critical
vulnerabilities
57 Critical
vulnerabilities
91 Critical
vulnerabilities
14 Critical
vulnerabilities
We know that in the upcoming year
200–300 new currently unknown
vulnerabilities will be discovered in
popular business applications
- 37. 37©2014 Check Point Software Technologies Ltd.
TARGETED ATTACKS BEGIN
WITH ZERO-DAY EXPLOITS
Duqu Worm Causing Collateral Damage in a
Silent Cyber-War
Worm exploiting zero-day vulnerabilities in a Word document
- 38. 38©2013 Check Point Software Technologies Ltd.
Threat Emulation
Discover and STOP new threats based-on
threat behavior
[Confidential] For designated groups and individuals
INSPECT EMULATE
PREVENTSHARE
- 39. 39©2014 Check Point Software Technologies Ltd.
That’s why we need to
segment networks
Initial
infection on
laptop
Only pathway across
network controlled
through
security gateway
Infection can’t
spread if there’s
no open path
- 40. 40©2014 Check Point Software Technologies Ltd.
Hierarchical Lines of Defense
“Establish hierarchical lines of defense that provide protections for data
and systems hosted within the corresponding segment boundaries”
Site
(Host, Network)
Mobile
Cloud
- 42. 42©2014 Check Point Software Technologies Ltd.
ASD Top 35 – Top 14 Mitigation Strategies
1. Application white listing
2. Application patching
3. OS Patching
4. Restrict Admin privileges
5. User application configuration hardening
6. Automated dynamic analysis of email and web content (Sandboxing)
7. Operating system Generic exploit mitigation
8. Host based Intrusion Detection/Prevention
9. Disable Local Admin accounts
10.Network Segmentation
11.Multi-Factor Authentication
12.Software-Based Application firewall - Incoming
13.Software-Based Application firewall – Outgoing
14.Non-Persistent virtualised sandboxing
- 43. 43©2014 Check Point Software Technologies Ltd.
How do you manage the unknown in 2014?
Use of unknown malware exploded in 2013
Integrated malware sandboxing is a must-have1
Malware exposure and infections increased
Anti-bot and antivirus must have global intelligence
2
High-risk applications expanded in the enterprise
Policy-driven application control must be integrated
3
Data loss events grew across industries and data types
Data loss prevention must expand across the network
4