2013年の最新セキュリティ課題に組織的に対応するには？
•Download as PPTX, PDF•
1 like•1,541 views
2013年にスマートフォンの国内出荷台数は3,260万台に達し、加入者数は 5,000万人を超え、ほぼ2人に1人がスマートフォンを持つことになる*。しかし、スマートフォンユーザーのセキュリティ意識は低く、モバイル Web ブラウザーが、制限や制御のないアプリケーションの自由な侵入口となるリスクは非常に高まっている。また、悪意のあるアプリケーションによるデータの盗取や、不注意によるデータ損失など、さまざまなリスクを孕んでいる。本セッションでは、最新のモバイル向けセキュリティのトレンドや、2013年に流行しそうな攻撃の傾向について紹介します。 * 出典： IDC ブルーコートシステムズ アジア太平洋地域担当セキュリティアーキテクト 水品 巧 IT Forum http://www.itforum-roundtable.com/
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to 2013年の最新セキュリティ課題に組織的に対応するには？
Similar to 2013年の最新セキュリティ課題に組織的に対応するには？ (20)
Recently uploaded
Recently uploaded (15)
2013年の最新セキュリティ課題に組織的に対応するには？
- 2. ブルーコートの現在 プレゼンスを確立 年間収入；約5億ドル 世界32カ国に1,000人以上の従業員 顧客からの厚い信頼 世界各国の15,000 社以上の顧客 セキュアWebゲートウェイ分野の市場シェア： 44% 他社と一線を画す、 優れたテクノロジー 特許取得数：132 、申請中の特許件数：63 業界リーダーとしての高い評 価 「セキュアWebゲートウェイ」「WAN最適化」 の 両分野で、ガートナー社「マジッククワドランド *「Market Share: Security Software, Worldwide, （Magic Quadrant）」の「リーダー」に選出 2011」2012年3月29日、ガートナー社 © Blue Coat Systems, Inc. 2013 2 2
- 3. 企業が直面している課題 ゲストWi-Fi BYOD モビリティ （個人所有デイバスの職場持ち込み） Webの脅威からの保護 Web & クラウド アプリケーション © Blue Coat Systems, Inc. 2013 3
- 4. セキュリティのパラダイムシフト © Blue Coat Systems, Inc. 2013 4
- 5. ブルーコートが提供する価値 脅威に対する ユニバーサル 統合レポーティング グローバルな防御 ポリシー きめ細かく、 WebPulseの活用と コンテンツ、 App、アク カスタマイズ可能な方法 ネガティブデイディフェ セスの高度な制御 で ンス Webトラフィックを可視 化 © Blue Coat Systems, Inc. 2013 5
- 6. ブルーコートの統合セキュリティソリューション オンプレミス バーチャル クラウドサービス アプライアンス アプライアンス アプライアンスとSaaSのシームレスな統合による、統合セキュリティ の実現 © Blue Coat Systems, Inc. 2013 6
- 7. ブルーコートクラウドサービスの紹介 © Blue Coat Systems, Inc. 2013 7
- 8. グローバルフットプリント © Blue Coat Systems, Inc. 2013 8
- 9. Blue Coat Cloud Service 高度な防御 デバイス WebPulseと、業界唯一 デスクトップとノー マルウェア ポリシー管理 のネガティブデイディ トパソコン （ スキャン フェンス Windows/Mac）、 iデ バイス（iPhone、 iPadなど） Blue Coat アプリケーション 統合レポーティング Cloud Service 制御 ホスト型（アーカイブ ネイティブモバイル/ ）と自社運用型（デー モバイルブラウザー タプライバシー） アプリ向けの運用統 制 ユニバーサル セキュアな接続 ポリシー IPSec VPNまたは既存 ADを用いたユーザー のセキュリティインフ コンテンツ レポート機能 フィルタリン 、グループ、グロー ラからの転送 グ バルポリシーの管理 © Blue Coat Systems, Inc. 2013 9
- 10. ブルーコートクラウドソリューション モバイルデバイス Webセキュリティ ホスト型 セキュリティサービ サービス レポートサービス ス エンタープライズク すべての従業員、 保護と制御をモバイ ラスの保護と制御 デバイス、場所を ルデバイス向けに拡 カバーする 張 統合レポーティング © Blue Coat Systems, Inc. 2013 10
- 11. BYODのセキュリティに関する期待のギャッ プ ! 70% 88% 42% しか し 個人所有のデバイスで これらのデバイス使用 42%のIT管理者は、モバイ 社内ネットワークにア を「ある程度」または ルデバイスを通じたウィル クセスする従業員の割 「かなり」安全だと考 ス感染のリスクを「高い」 合は70% えている従業員の割合 または「極めて高い」と考 は88% えている 従業員の意見 IT部門の意見 社内データへのアクセスを 24% 記録すべき 41% Webコンテンツへのアクセ 19% 34% スをすべて記録すべき 特定のタイプのWebサイトやコ 12% ! 37% ンテンツへのアクセスを制限す べき *出典：IDG Global Mobility Study © Blue Coat Systems, Inc. 2013 11
- 12. アプリケーションのタイプ ネイティブモバイル モバイル向けWebブラウザー デスクトップ向けWebブラウ ザー m.facebook.com www.facebook.com モバイルアプリのギャップ モバイルWebブラウザーが、制限/制御のない アプリケーションの自由な侵入口に © Blue Coat Systems, Inc. 2013 12
- 13. モバイルセキュリティ モバイルブラウザー 悪意のある アプリの使用を通じた ベースの脅威 モバイルアプリ 不注意によるデータ損失 デスクトップ向け データの盗取や、 アプリケーションと Webブラウザー 「コールホーム」機能 運用を制御できず、 からの を悪用した実行や制御 潜在的なデータ損失 脅威と類似 を狙ったアプリケーシ につながる ョン © Blue Coat Systems, Inc. 2013 13
- 14. 様々なアプリケーションに共通する脅威 ネイティブモバイ モバイル向けWebブラウザー デスクトップ向けWebブラウ ル ザー m.facebook.com www.facebook.com 類似したマルウェアをすべての種類 のアプリケーションに配信可能 1種類のみのアプリケーションへの 対応では、企業の脆弱性をカバーで きない © Blue Coat Systems, Inc. 2013 14
- 15. 様々なアプリケーションに共通する脅威 ネイティブモバイ モバイル向けWebブラウザー デスクトップ向けWebブラウ ル ザー m.facebook.com www.facebook.com 類似したマルウェアをすべての種類 のアプリケーションに配信可能 1種類のみのアプリケーションへの 対応では、企業の脆弱性をカバーで きない © Blue Coat Systems, Inc. 2013 15
- 16. 様々なアプリケーションに共通する脅威 ネイティブモバイ モバイル向けWebブラウザー デスクトップ向けWebブラウ ル ザー m.facebook.com www.facebook.com 類似したマルウェアをすべての種類 のアプリケーションに配信可能 1種類のみのアプリケーションへの 対応では、企業の脆弱性をカバーで きない © Blue Coat Systems, Inc. 2013 16
- 17. きめ細かなアプリケーション制御の要件 ネイティブモバイル モバイル向けWebブラウザー デスクトップ向けWebブラウ ザー www.facebook.com あらゆる種類のアプリケーションに対処可能な セキュリティポリシー きめ細かなアプリケーション制御では、 アプリケーションの種類の明確な区別が不可欠 © Blue Coat Systems, Inc. 2013 17
- 18. モバイルデバイスへのセキュリティ拡張 脅威からの モバイル 柔軟な 保護 ブラウザー ポリシー アプリの 制御 © Blue Coat Systems, Inc. 2013 18
- 19. セキュリティ範囲を拡張し、あらゆるユーザー に対応 WebPulse s 本社 支店 支店 リモート ユーザー モバイル ユーザー 脅威からの ユニバーサル 統合レポーティング グローバルな保護 ポリシー © Blue Coat Systems, Inc. 2013 19
- 20. Webセキュリティの2013年の展望 http://www.bluecoat.com/ja/company/press- releases/20130122_security_prediction © Blue Coat Systems, Inc. 2013 20
- 21. マスマーケットへの攻撃は標的型攻撃の足がか りに • マスマーケット向けの攻撃で感染を広げる • 特定のIPレンジの感染端末（Bot）を貸出 • 標的型攻撃に悪用 © Blue Coat Systems, Inc. 2013 21
- 22. モバイルマルウェアが台頭 • これまでは「ミスチーフウェア」 • 有料SMSを勝手に送信、アドレス帳送信など • アプリの形式ではなく、機器自身の機器自身の 脆弱性をついた攻撃が出てくる © Blue Coat Systems, Inc. 2013 22
- 23. マルネットは引き続きエンハンスされる • マルネットは順調に拡張している • 進化に伴う調整・最適化が継続的に行われる • 翻訳者やコピーライターを雇うことで、より本 物の金融機関に近いWeｂページやメールを送 れるようになる © Blue Coat Systems, Inc. 2013 23
- 24. ビッグデータをセキュリティに • すべてのセキュリティとネットワーク・ソリュ ーションはログを出力する • ユーザの動向やトラフィックなどの重要な情報 が含まれる • 危険な動向のパターンを見つけることで、ネッ ト ワークの脅威と異常性に対する新しい防御を 構築することができる © Blue Coat Systems, Inc. 2013 24
Editor's Notes
- We have been in business for 15 years. We have a diverse, global customer base focused on the security and quality-of-service needs of the Global 5,000. Our core franchise is built around our secure web gateway where we have a 44% market share and where we orchestrate the securityprotection,controls, policies and integration of other security products at the Internet connection for our customers. Over the years, we have focused ontechnology leadership with nearly 200 current and pending patents.We are recognized leaders in both the Secure Web Gateway and WAN Optimization categories by Gartner and other Industry analysts. Earlier this year we became a private company through a syndicate led by Thoma Bravo, a 30 year old growth oriented private equity firm. Their investment in Blue Coat came from their new fund, which is at the beginning of a 10 year period of investments, meaning they are patient and long-term investors. Thoma-Bravo has an excellent track record in security and networking.Throughout this transition, we have continued to sustain our business growth and leadership position. As a private company, we can now more easily invest in technology and our customer relationships rather than having to focus on the demands of Wall Street analysts and public shareholders every 90 days. By way of example, we have shutdown our low-cost development operations in India and expanded our three R&D excellence centers in California, Utah and Canada. This allows us to more rapidly drive new innovations to market. We are now in position to also aggressively build out our global points-of-presence for our Cloud Service. Everyone at Blue Coat is energized and focused on delivering greater value to our customers. Let me give you a sense of the priorities we have at Blue Coat today.
- All of this converges to one main shift - In order to secure the network today – you need to secure the userIf IT organizations do not develop a strategy to define the policies and security controls for all user, users will define it for them. If companies do not get ahead of that wave, they will be pulled down underneath that wave and be crushed by recurring costs associated with downtime, corp reputation, data loss etc
- From a web security perspective, Blue Coat is provides the key capabilities required to secure your network by securing your users – across all devices and locations. Our global threat defense is trusted and used by 88% of the Fortune Global 500. <CLICK>The universal policy framework is a key requirement for IT leaders in order to stay ahead of user mandated web usage – driven by device, access and application proliferation. We provide the most granular web control of content, applications and access, used by top financials and government agencies. <CLICK>The unified reporting capability brings you actionable intelligencethat provides a unified view of ALL web and user traffic. <CLICK>And all of that is delivered with flexibility to your business built on high performance architecture for both our appliances and our web security saas
- From a web security perspective, Blue Coat is provides the key capabilities required to secure your network by securing your users – across all devices and locations. Our global threat defense is trusted and used by 88% of the Fortune Global 500. <CLICK>The universal policy framework is a key requirement for IT leaders in order to stay ahead of user mandated web usage – driven by device, access and application proliferation. We provide the most granular web control of content, applications and access, used by top financials and government agencies. <CLICK>The unified reporting capability brings you actionable intelligencethat provides a unified view of ALL web and user traffic. <CLICK>And all of that is delivered with flexibility to your business built on high performance architecture for both our appliances and our web security saas
- All of this value delivered now as an internet service allows you to put your valuable resources to strategic use, while providing your users with global coverage. Blue Coat has been operating an enterprise class cloud service for over 7 years now, with our WebPulse infrastructure, used by almost 90% of the Fortune 500 companies. With the Web Security Service, we are now extending that infrastructure out to provide you with the full web security solution via a streamlined interface, accessible from any location.This allows you to instantly add new users and location as needed without any on premises hardware software.The flexibility in deployment and budget, without compromising the protection and control.
- As we discussed earlier, Blue Coat provides Threat protection in a way that is both unique from the competition and much more effective. All Blue Coat products already utilize WebPulse to some decree, and we have a vision that WebPulse will continue to expand it’s scope in protecting our customers. Today, WebPulse has more than 75 million users and a number of techniques that we’ve already discussed providing proactive malnet tracking for negative day defenses against botnets, phishing, etc. Over the next 12 months our plan is to significantly expand our inputs to include not just Web traffic on port 80 and 443, but also other potentially malicious traffic. Specifically, PacketShaper will start sending non-web traffic, for example unknown traffic, SSL traffic without a certificate and Peer-to-peer traffic. Likewise mobile devices hooked into WebPulse will send all application traffic, so we not only get the web browser traffic, but also all of the user loaded applications. These increased inputs will significantly expand the scope of research to start identifying more traffic, malicious sites and applications, and interesting ties between applications and the malicious things on the Internet. This will allow for new levels of APT forensics that no other company will have the technology or data to understand and protect our customers. WebPulse will also add the GeoIP tagging to provide another important data point of information for customers to base policy decisions. Longer term, we fully expect WebPulse to provide protection across all traffic and all ports and provide deeper threat reporting. The last point on WebPulse around the certificate notary is that because the number of users and amount of data we receive Blue Coat is in a unique position to know where a certificate should be served from. If we see something change and get served from an unexpected location we can alert the customer that suspicious behavior is occurring.Moving on to ProxyAV, we currently support 5 leading AV engines – Kaspersky, Sophos, Panda, McAfee and Symantec on dedicated processing platforms. We also integrate with any 3rd party solution that supports ICAP or Secure ICAP. For users of our Cloud Security Service, we run every file through multiple AV engines to provide a higher level of security than a typical enterprise could afford with a single solution. In the next 12 months, we plan to offer ProxyAV as a virtual appliance and longer term, our target is to offer ProxySG and ProxyAV on a single hardware platform.Finally on the Threat Protection side, we talk about Reverse Proxy. Today, many customers deploy ProxySG in front of application servers to provide the flexible policy control that has made ProxySG a fixture in large enterprises with very high performance. In the next 12 months, you see a significant investment around reverse proxy where we will add GeoIP to the local level and continue to add more protections as well as an automated protection update service. Longer term, we are working on a Reverse Proxy specific User Interface to simplify the setup and management in reverse proxy deployments.
- Fix order
- As you know, we currently offer two cloud-based security solution to customers:Web security module which is an ideal Web security solution for remote office, branch office or retail locations. These locations usually have limited or no on-site IT staff and wiring closet making the cloud solution very attractive. Blue Coat Web Security Module is also ideal for remote workers. Insurance adjusters and realtors are good example of field workers.Hosted reporting is another cloud-based solution we offer. With the ability to create an enterprise-wide report encompassing on-premise and cloud security solutions, customers have consolidated report across all their users. No need for on-premise reporting server and leveraging the scalability of the cloud are additional benefits.We are now bolstering Blue Coat cloud solutions to include Mobile Security Module. This new product offers enterprise-grade security for smart phones as they access the Internet wherever they may be using whatever network infrastructure available such as 3G, 4G, Hot Spot and home WiFi.
- Today there’s really three kinds of applications that use the web.First there’s the traditional application that runs on a Desktop Web Browser, the one that you use on your PC or your laptop.Then there’s the native application on the smartphone and tablet. For example, there’s a specific Facebook application for iOS, and it shows up as a Facebook icon on your iPhone, iPad or iPod Touch.There’s also a third type of application, and that’s the one that runs inside a mobile web browser, for those users that either choose not to install the specific app. For most websites, they create specific page for mobile web browsers. Often the www page gets redirected to a “M-dot” page, like the one shown here for Facebook.
- When looking at these applications, really there’s an inherent risk with them regardless of the platform. For example, let’s look at a phishing attempt. <click>In your standard desktop browser, looking at the email though the web email application (in this case Yahoo Mail), you can click on message that’s phishing. This one’s rather obvious, they even misspelled “card”<click>The browser even tries to help you here, and you can quickly identify this is a phishing attempt, when you hover over the link, and it redirects you to something other than chase.com<click> Looking closely at the link you can see it’s obviously a phishing attempt. Even if we click it though, on a desktop or laptop, we should be protected from going to the site by BCWF and Webpulse.<click>But if we’re on a mobile device without BCWF and Webpulse, what happens?<click>First let’s look at the native email app, the icon that’s available to you on your smartphone to read email.Here’s the same email. Here, there’s no obvious signs to help you identify this as a phishing email. Without mobile protection, you’d click on the link and go to the phishing site.Note, these threats exist regardless of operating system and platform, and it’s a threat that a mobile solution like Blue Coat’s can help you address.<click>What if you protect the user by blocking the application (say using MDM).Well, the user can still get to the application using a mobile web browser. Here’s what the same email looks like using a mobile web browser, in this case Safari.Once again, no help in identifying this is phishing. Without BCWF/Webpulse, a user can easily go to the link and possibly lose personal identifiable information.
- When looking at these applications, really there’s an inherent risk with them regardless of the platform. For example, let’s look at a phishing attempt. <click>In your standard desktop browser, looking at the email though the web email application (in this case Yahoo Mail), you can click on message that’s phishing. This one’s rather obvious, they even misspelled “card”<click>The browser even tries to help you here, and you can quickly identify this is a phishing attempt, when you hover over the link, and it redirects you to something other than chase.com<click> Looking closely at the link you can see it’s obviously a phishing attempt. Even if we click it though, on a desktop or laptop, we should be protected from going to the site by BCWF and Webpulse.<click>But if we’re on a mobile device without BCWF and Webpulse, what happens?<click>First let’s look at the native email app, the icon that’s available to you on your smartphone to read email.Here’s the same email. Here, there’s no obvious signs to help you identify this as a phishing email. Without mobile protection, you’d click on the link and go to the phishing site.Note, these threats exist regardless of operating system and platform, and it’s a threat that a mobile solution like Blue Coat’s can help you address.<click>What if you protect the user by blocking the application (say using MDM).Well, the user can still get to the application using a mobile web browser. Here’s what the same email looks like using a mobile web browser, in this case Safari.Once again, no help in identifying this is phishing. Without BCWF/Webpulse, a user can easily go to the link and possibly lose personal identifiable information.
- When looking at these applications, really there’s an inherent risk with them regardless of the platform. For example, let’s look at a phishing attempt. <click>In your standard desktop browser, looking at the email though the web email application (in this case Yahoo Mail), you can click on message that’s phishing. This one’s rather obvious, they even misspelled “card”<click>The browser even tries to help you here, and you can quickly identify this is a phishing attempt, when you hover over the link, and it redirects you to something other than chase.com<click> Looking closely at the link you can see it’s obviously a phishing attempt. Even if we click it though, on a desktop or laptop, we should be protected from going to the site by BCWF and Webpulse.<click>But if we’re on a mobile device without BCWF and Webpulse, what happens?<click>First let’s look at the native email app, the icon that’s available to you on your smartphone to read email.Here’s the same email. Here, there’s no obvious signs to help you identify this as a phishing email. Without mobile protection, you’d click on the link and go to the phishing site.Note, these threats exist regardless of operating system and platform, and it’s a threat that a mobile solution like Blue Coat’s can help you address.<click>What if you protect the user by blocking the application (say using MDM).Well, the user can still get to the application using a mobile web browser. Here’s what the same email looks like using a mobile web browser, in this case Safari.Once again, no help in identifying this is phishing. Without BCWF/Webpulse, a user can easily go to the link and possibly lose personal identifiable information.
- On top of the ability to protect the user using Webpulse and BCWF against web threats, there’s also the ability to offer control of specific operations, across all the different variants of an application.In this example, here’s box.com in it’s various incarnations, reaching it through a web browser, the native box.com app, and through a mobile web browser. You’ll notice each has a slightly different appearance and uses different operations across the web.<click>Let’s say a user logs in and wants to download a file. With Blue Coat’s Mobile, Mobile Web and Web application controls, you can block the user from downloading a file to their device, either to prevent bandwidth usage abuse or possibly infecting their computer (Blue Coat can of course also scan the file with ProxyAV/in-the-cloud AV if desired).<click>The operational controls allow access to box.com but can prevent an operation like file download.And Blue Coat does this across all variations of the application.
- Let’s bring this all together and look at how this all deploys globally.With the products and capabilities that we bring together, you can have the appliances you need for example at the corporate office.Perhaps you have some branches where you choose to install an appliance for local control and caching advantages. This proxy, plus firewalls in place at other branches can be securely forwarded to the cloud. In addition mobile and remote users can be connected via the client connector.You now have the most robust choices for cloud connectivity that support your enterprise grade needs for secure deployments.All users, regardless of whether they are behind the Cloud service or an appliance, receive the Negative day defense from WebPulse. Real time rating are submitted from ALL users and immediate protection is delivered to ALL users, where ever they are located. And Intelligent Routing is applied as your users move. Location Aware Web Security…cloud sees where you are and routes your data the shortest route…all of the policies go with you as well…you’re getting to the closest datacenter for optimal performance. <CLICK>Once deployed, your administrator can set policy from any location and simply click and apply to all cloud service users. This same policy can be set on the appliances and deployed across all appliances, creating a consistent policy enforcement for universal policies that follow the user – i.e once they leave corporate and are accessing the cloud, a consistent policy is enforced.<CLICK>As traffic is being passed, real time reports can be accessed from any location to give a unified view of all users web traffic patterns and trends. This allows you to quickly see and drill down on any symptoms or data points of interest and determine whether your policy assignments need to be adjusted.