Falling Through The Cracks: Detection Accuracy Without Compromising Performance

Falling Through the Cracks: Detection Accuracy Without Compromising Performance Wedge Networks Inc. Hongwen Zhang, PhD Co-founder and CEO Confidential

AGENDA • Falling Through the Cracks: Trends and Threats – End Point Protection, Trends and Limitations – Firewalls, UTMs, IPS/IDS and the ABC’s of Perimeter Security – Proxies and Secure Web Gateways • Sealing the Cracks and Case Studies – Protocol-Layered Protection – Network Layered Protection • About Wedge Networks • Conclusion Confidential

Falling Through the Cracks: Trends and Threats Confidential

MALWARE ATTACKS: 2009 • 73,619,767 malware attacks 15 million • Increase in outbreaks – bootkits (Sinowal), malware variants discovered in 2009 rootkits/backdoors (TDSS )and sophisticated encrypted communication (Clampi) 100% • Increase in severity – Kido (Conficker) Increase in new malware variants impacted over 7 million computers • New platforms – Ike Worms (iPhone), Backdoor.Win32.skimmer (ATM), Spyware for 90% Android/Symbian of malware originates from hidden download pointers from websites • Most malwares are distributed from web servers and application servers • A substantial amount of web pages are infected daily • Damage is severe – Reputation injury and political embarrassment – Loss of sensitive information – Loss of revenue: an infected enterprise will a sales reduction • Most Businesses have compliance requirements Confidential

MALWARE ATTACKS: 2010 SO FAR … • Similar numbers of malware attacks but potential to go widespread is extremely high • Affiliate programs to legalize malware traffic • Most malware will be distributed from web servers and application servers with a high frequency from ones that support file/application sharing • Continued sophistication: – New file-infecting/rootkit techniques – Increased use of modern file infection techniques/encryption – Tough year for iPhone/Android Top 20 Viruses Jan. 2010 • What virus experts are warning us: (for the first time, 5 new entries in the Top 20, – Threats that are able to evade security which is unusual for this list) solutions will become invulnerable (source: Kaspersky Labs) – Prevent threats from penetrating your network Confidential

ENDPOINT PROTECTION • Trends: – Web-based focus, especially multi- stage infections that install components after initial infection – Integration of Features – Platform instead of application • Host-Intrusion Prevention System • Personal Firewalling • Signature-based techniques augmented with Heuristics – Reputation-based techniques: Query in the Cloud – Data and Information Protection: DLP – Reporting and Single Point of Endpoint Protection Magic Quadrant (for the first time, cloud schemes were required for leadership Management position) (source: Gartner Group, April 2009) Confidential

ENDPOINT PROTECTION • Threats: – Endpoints – where both IT Operations and IT Security have to collaborate – Too many endpoint management consoles and clients: (3 – 5) – Too complex to setup/configure: feature fatigue – Result: malware outbreaks are the main security breach at 91% Confidential

ENDPOINT PROTECTION • The Cracks: – Product Selection • Usable and not ‘trending’ features • Accuracy/Performance especially with heuristics • Heuristics implementation for Zero day Protection – Product Configuration – Traveling Personnel Problem • Strategies to handle ‘outdated’ devices Leaders do not necessarily perform well in real-world tests Confidential

FIREWALLS, UTMS, AND THE ABC’S OF PERIMETER PROTECTIONS • Firewalls – Protect external access to internal resources • Trends - utm – Typically: Firewall + IPS/IDS + VPN + AntiVirus – Additional Features: + AntiSpam + Web Filter + Reputation Database Integration • Advantages – Reduces management and network complexity • Disadvantages/Cracks: – Resource Constraint – Primarily a Firewall – Malware scanning is typically packet/stream based Confidential (source: NSS Labs)

FIREWALLS, UTMS, AND THE ABC’S OF PERIMETER PROTECTIONS • Severe Cracks: – Resources constrained for 500+ install base – Primarily a Firewall and IPS – Malware Detection • Low accuracy – stream/packet based and can predominantly rely on reputation (source: NSS Labs) • Low performance – nearly 20% of capacity when activated Confidential

PROXIES AND SECURE WEB GATEWAYS • Secure Web Gateways – PROXY + Web filter + Malware + Application Control • New Trend – Application/Bandwidth control + Data Loss Prevention – Offered as a “Software as a Service” • Advantage: – Can be configured to protect remote end- devices • Cracks: – Requires network reconfiguration route traffic to proxy (either switch level/device- browser level) – Inherently Limited Malware Scanning Architecture (Retrieve, Store, Scan, Forward OR off-load to ICAP server) – Inherently difficult to protect devices other than end-devices (e.g., application servers, SAN devices, etc.) Confidential (source: NSS Labs)

PROXIES AND SECURE WEB GATEWAYS - Reputation ONLY Limitations • Reputation based Systems – Next Generation URL Lists – Trending traffic volumes – IP/DNS changes • Limitations of Reputation-ONLY systems – Good sites could include bad content (shown) – Good sites can be uncategorized (e.g., Manheim.com – largest used-car portal in North America (shown) – High False Positives/Negatives – Cannot be used alone Confidential (source: NSS Labs)

Sealing The Cracks and Case Studies Confidential

PROTOCOL-LAYERED PROTECTION Five Layer Network Model } 5. Application layer DHCP • DNS • FTP • HTTP • POP3 • WedgeOS (NDP) SMTP • SNMP • SSH • TELNET • IM BeSecure 4. Transport layer TCP • UDP 3. Network layer IP (IPv4 • IPv6) • ARP • RARP • ICMP • IPSec } Cisco ASA 2. Data link layer Ethernet • PPP 1. Physical layer Ethernet physical layer } ISS/IBM G100 (source: One of Our Customers) Confidential

NETWORK-LAYERED PROTECTION • Physical networks need to be secured • End Device Protection – End point protection platform • Usage Protection – Access Control: • “Non-aged” IP issue • VPN/SSL Virtual firewalls. Source: www.altornetworks.com • Wireless/Mobile through segregated LANs – Data-in-motion protection: • Confidentiality • Integrity • Network Applications and Services Protection – Public facing resources: • Web Services • DNS Poisoning Confidential • DDoS:

EXAMPLE: SERVER FARM/ NO HOST-BASED AV Operation Aggregation Layer C7609/ • Nationwide movie industry CSP NE40E • Issues with host-based AV solution: – Per node cost – 30%+ computing resources wasted Firewall – Energy waste – Bandwidth waste BeSecure Switch Reporter – Cost goes higher with the move to HDTV and 3D movies BeSecure BeSecure NDP-2040NX-1(HA) NDP-2040NX-2(HA) • Opportunity: Core Switch – Malware are transmitted only from the network – Deploy high performance, transparent anti-malware appliances Server Farm Protected Area Confidential

EXAMPLE: ONLINE PHOTO EXCHANGE • Largest online photo exchange site • Revenue from photo exchanges • Attacked by sophisticated hackers (with firewall, UTM, and host AV already deployed) • Need to protect against OWASP 10 • Need to make sure the photos are clean • Need to make sure the DR factor is considered Confidential

EXAMPLE: OIL FIELD SERVICES End-User: • One of the largest oil producing companies in the world • Rig-site users require high speed Internet and application access • Current solution does not protect the mobile devices BeSecure Functions: • Effective Protection Against Multi-Protocol Attacks • Security for wireless handhelds over WiMAX networks BeSecure Advantage: Confidential • Threat protection against multi-device, multi-protocol attacks

EXAMPLE: CAR DEALERSHIP End-User: BeSecure Deployment • Need to protect and enforce web-security policies for all of • Installed at the Edge of the “Network” their constantly increasing dealerships (through acquisition) • Support for High-Latency Networks from one location • Used a proxy approach, malware still goes through • Used firewalls with UTM function, malware still go through • Endpoint solution is impossible to manage BeSecure Functions • Anti-Virus, Anti-Spam, Web Filtering and Protection • Policies to prevent competitive information leaving site Confidential

CASE: TIER-1 PARTNERSHIP BANK End-User • Invested heavily in BlueCoat SG 8100 (proxy) product, but deploying BlueCoat AV was not successful since it slowed down traffic BeSecure Deployment: • A cluster of BeSecure appliances deployed in ICAP mode with ALL functions enabled BeSecure Advantage: • Seamless integration with the customer’s previous BlueCoat investment • In-depth content security without loss in performance or throughput, which, in a bank environment, translates into dollars. Confidential

EXAMPLE: SECURITY AS A PROFIT CENTER Network • MSSP: Netmarks Data Center – A $7.4billion large IT services company serving No power failure UPS system Japanese multinationals, government Private power generating system equipping organizations, and schools – 24x7 value-added security services Web browser Outlook etc… – A cluster of HAed BeSecures to protect email and web servers – “…Two key factors enabled us to select Wedge BeSecure…the cost is calculated based on the number of BeSecure systems while the Mail Box income is calculated based on the number of serviced users,…,no other technology can Control center OfficePlanet Center handle this large amount of web traffic…” Operation watch Full backup once a week The outside of office Administrative from Home etc … remotely Confidential

About Wedge Networks Confidential

COMPANY OVERVIEW • HQ in Calgary, Canada – Offices in Canada, USA, and APAC • A Strong Leader in a Hot Market – Key technology patented in the USA, Canada, Japan, and China – Outperforms leading products in the market (Expert reviewed) – A 2010 Hot Company Finalist by Network Products Guide – Global Security Product Excellence Awards Winner – Customer Trust by Info Security Products Guide • Global Support ability – Commercial production in late 2007, with world class customers – Revenue doubled in 2009; triple growth expected in 2010 – Hundreds of units installed globally in most industry verticals – 20+ distribution partners worldwide Confidential

PRODUCT “Wedge Networks’ high performance Deep Content based approach can see things (e.g. documents, images) that packet based inspections cannot. I’m impressed with this platform technology which differentiates the company from the other players.” – Ariel Avitan, Industry Analyst, Network Security Technologies, Frost & Sullivan Wedge BeSecure Web Security Appliance The Old Way The Wedge Way Confidential

PATENTED TECHNOLOGY Scan Archives(.gz) ms 350 300 250 200 k… 150 s… 100 50 0 500b 1Kb 2Kb 4Kb 32Kb 128Kb 1Mb size USPTO#7630379 Confidential

THIRD PARTY VALIDATION Confidential

UNIQUE TECHNOLOGY • SubSonic Engine™: patented (US7630379), highest performance deep content inspection engine •GreenStream technology: accurate content inspection with the lowest latency •Open Service Bus: an abstract security services model for highest precision – Signature, Heuristic and Reputation Scanning •Stealth Routing: non-intrusive, plug & play network integration technology Sustained HTTP throughput in C10K/162,000 users test Confidential

MARKET VALIDATION • Hundreds of devices installed globally Service Providers • 100% sales growth in 2009, same is expected in 2010 • Worldwide customer base • In most of the industry segments Large Enterprises Branch Offices/SMB Kuwait Oil Company Confidential

SUMMARY • Need to have in-depth understanding of limitations • Need to cross security anxieties that are caused by the “Unknowns” – both from malware and vendor products, by doing your homework • Need to define your requirements and develop a layered approach to security • Established and user-driven vendors do exist: e.g. Wedge Networks Confidential

To Learn More About How WedgeOS 4.0 Content Security Operating System Can Be Used to Help Fill the Cracks in Your Network Security… Please Sign Up for Wedge Networks’ Ongoing Series of Informative Webinars at: http://www.wedgenetworks.com/webinars.html Confidential

Thank You! Wedge Networks Inc. www.wedgenetworks.com Hongwen Zhang, PhD President &CEO hongwen.zhang@wedgenetworks.com Phone: (403) 441-2038 Please Sign Up for Wedge Networks’ Ongoing Series of Informative Webinars at: http://www.wedgenetworks.com/webinars.html Confidential

Falling Through The Cracks: Detection Accuracy Without Compromising Performance

by Wedge Networks on Apr 29, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

1 Embed 3

Statistics

Falling Through The Cracks: Detection Accuracy Without Compromising Performance — Presentation Transcript