Presentación del fundador y CTO de Palo Alto Networks, Nir Zuk, sobre las amenazas de seguridad actuales, como ha evolucionado el ciberterrorismo, y las formas de controlarlo con el FW de Nueva Generación de Palo Alto Networks.

1. Modern
Malware
Nir
Zuk
Founder
and
CTO

3. data
breach
mythology

4. we
invest
in
protec>ng
our
data
centers

5. rarely
the
datacenter
is
a?acked
directly

6. no
more
vulnerability
scanning

7. the
new
a?acker

8. the
a?acker
is
not
a
bored
geek

9. na>on
states
and
organized
crime

10. data
breaches
in
2011

11. step
one:
bait
an
end-­‐user

12. step
one:
bait
an
end-­‐user
spear
phishing

13. step
one:
bait
an
end-­‐user

14. step
two:
exploit
a
vulnerability

15. step
three:
download
a
backdoor

16. step
four:
establish
a
back
channel

17. step
five:
explore
and
steal

18. the

state
of
malware
protec>on

19. protec>on
is
needed
at
all
stages
back
bait
exploit
download
steal
channel

20. 
bait
protec>on

21. 
exploit
protec>on
exploits
come
in
thru
many
applica>ons

22. 
exploit
protec>on
many
months
pass
between
black-­‐hat
discovery,
white
hat
discovery,
and
protec>on
being
available

23. 
download
protec>on
targeted
a?acks
mean
few
instances
in
the
wild

24. 
download
protec>on
an>-­‐malware
vendors
take
several
days
to
come
up
with
a
signature

25. 
back
channel
protec>on
+ +
not
only
a?acks
are
targeted
and
IPS
signatures
take
>me
to
develop,
back
channels
are
oNen
encrypted

26. 
explore-­‐and-­‐steal
protec>on
minimal
internal
security
means
that
once
inside,
an
a?acker
can
roam
the
network
freely

27. blueprint
for
stopping
modern
malware

28. need
to
protect
all
applica>ons

29. response
>me
is
key

30. automa>on
is
a
must

31. a
sandbox
at
the
core

32. perform
the
analysis
for
all
devices
centrally

33. automa>cally
generate
mul>ple
signatures
•
An>-­‐malware
download
signatures
•
IPS
back-­‐channel
signatures
•
Malware
URLs
•
IPS
signatures
for
iden>fied
new
vulnerabili>es

34. deliver
signatures
with
one
hour

35. stopping
modern
malware
in
prac>ce

36. need
to
protect
at
all
stages
back
bait
exploit
download
steal
channel

37. bait
protec>on

•
Block
unneeded
applica>ons
•
Control
file
transfers
by
user,
applica>on,
and
file
type
•
Block
access
to
Malware
URLs

38. exploit
protec>on

•
Discover
vulnerabili>es
before
the
bad
guys
•
IPS
signature
for
newly
iden>fied
vulnerabili>es

39. discovering
MicrosoN
vulnerabili>es
Palo
Alto
Tipping
Check
Point
Juniper
&
McAfee
Sourcefire
Networks
Point
So9ware
Cisco
20
7
7
3
1
0
number
of
vulnerability
discoveries
credited
to
each
vendor
over
the
last
4
years
Source:
OSVDB;
as
of
June
15th
2011

40. discovering
Adobe
Flash
vulnerabili>es
Palo
Alto
Tipping
Check
Point
Juniper
&
McAfee
Sourcefire
Networks
Point
So9ware
Cisco
12
1
1
0
0
0
number
of
vulnerability
discoveries
credited
to
each
vendor
over
the
last
4
years
Source:
OSVDB;
as
of
June
15th
2011

41. download
protec>on

• An>-­‐Malware
signatures
available
to
the
en>re
par>cipant
base
within
one
hour
of
first
discovery
• Generic
drive-­‐by-­‐download
protec>on
for
HTTP/S
downloads

42. back-­‐channel
protec>on

• Block
unknown
applica>on
traffic
• Use
heuris>cs
to
detect
back
channel
communica>on
• C&C
signatures
available
for
newly
discovered
malware

43. explore-­‐and-­‐steal
protec>on

• Network
segmenta>on
• Control
access
to
data
by
user
and
applica>on

44. the
role
of
NGFW
in
stopping
modern
malware

45. solu>on
has
to
be
enterprise-­‐wide

46. protec>on
has
to
be
real-­‐>me,
inline

47. needs
user-­‐based
access
control

48. needs
high-­‐speed
IPS
and
AV

49. need
to
perform
across
all
applica>ons

50. need
to
block
the
unknown

51. conclusion:
advanced-­‐malware
protec>on
belongs
in
a
next
genera>on
firewall

52. Thank
You