Downloaded 27 times
Uploaded byAdrian Sanabria
451 and Cylance - The Roadmap To Better Endpoint Security
The document discusses the complexities of malware prevention, highlighting the importance of endpoints as critical points of vulnerability within organizations. It outlines a roadmap for improving endpoint security, including developing better detection techniques and enhancing system visibility while addressing non-malware threats. Additionally, it emphasizes the need for root cause analysis and process improvements to effectively tackle the evolving landscape of cybersecurity threats.
More Related Content
![[Webinar] Building a Product Security Incident Response Team: Learnings from ...](https://cdn.slidesharecdn.com/ss_thumbnails/us-16-price-building-a-product-security-incident-response-team-learnings-from-the-hivemind-160812153709-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to 451 and Cylance - The Roadmap To Better Endpoint Security
451 and Cylance - The Roadmap To Better Endpoint Security
- 1. Why is malwareso difficult to defeat? • We no longer have one perimeter: we have many • Market currently unstable (still consolidating) • Endpoint is a blind spot • Blaming the user (aka “stop clicking links”) • Discarding useful tech because it couldn’t solve the problem by itself • Many, many more... 1
- 2. Why is theendpoint important? 1. This is where work happens 2. One of the easiest paths into a company 3. BYOD and ShadowIT are unsolved problems
- 3. How I seethe market Prevention (pre-execution) Detection and Data Collection (post-execution) Platform Hardening 80+ Vendors 50/50 split complementary/ primary
- 4. Buzzword Bingo: NGAVand EDR definitions NGAV: The ability to stop threats without prior knowledge of them EDR: Endpoint Data Recorder (a slight acronym modification)
- 5. NGAV NEED: a better malware mousetrap WHAT:Automated detection of unknown threats WHY: auto- generated malware gets through EDR NEED: endpoint visibility; serious blind spot otherwise WHAT: Record detailed endpoint data WHY: detect attacks that defeat 1st layers of defense Hardening NEED: More permanent, resilient solutions WHAT: Wide variety of approaches WHY: Passive defenses reduce pressure on frontline defenses Remediation NEED: Contain and clean up threats WHAT: Containment and automated remediation WHY: Reduce expense and labor of dealing with threats Endpoint categories: What’s driving them?
- 6. My roadmap forthe industry 1.Build a better malware mousetrap 2.Threat-driven hardening 3.Detect/Stop Non-Malware attacks 4.Full-system visibility (EDR) 5.Data visibility 6.More resilient host 6
- 7. Ready for aMalware Relief Program? Before we tackle the roadmap... let’s explore how we got into this fix... 7
- 8. Where did wego wrong? 8
- 9. Where did wego wrong?
- 10. Where did wego wrong? $$$
- 11. Where did wego wrong? 12
- 12. Where did wego wrong? 1.Not enough root cause analysis 2.Not enough process improvement (if any) 3.Even when we do succeed, we force the attacker to change tactics. Are we ready for that?
- 13. Step1: Build abetter mousetrap
- 14. MY definition forNGAV The ability to detect and stop threats without prior knowledge of them 15 What is prior knowledge? • Signatures • IoCs • Malware analysis sandbox • Blacklisting Most common NGAV strategies • Machine learning models • Static behavior analysis • Dynamic behavior analysis
- 15.
- 16. Step2: Threat-driven hardening Mostinfections occur due to vulnerabilities in a handful of apps, like: 1. The Java browser plugin 2. Flash 3. Browsers 4. Operating Systems 5. MS Office The Point: You don’t have to fix EVERYTHING. Fix the things most likely to result in malware infections first. Threat Intel* Root-cause analysis Process Improvement * - Not the “here’s 1 billion hashes and IP addresses, good luck” ‘threat intel’. We’re talking high level, “
- 17. Step3: Stop anddetect non- malware attacks
- 18. Step3: Stop anddetect non-malware attacks
- 19. Step4: Full systemvisibility (EDR)
- 20. Why EDR? Blindspots. 22 Endpoint East-West Traffic Cloud/SaaS Data
- 21. EDR: Endpoint Detectionand Response Many use cases: • detection • forensics • incident response • source for automation event triggers Ultimately, EDR is a sensor that provides rich, forensic data before you need it 23
- 22. Examples: Ransomware prevention 1.Kill any process attempting to stop the volume shadow service (VSS) 2. If a powershell or CMD process is created shortly after opening an office document, inspect and/or quarantine the office document. 3. Create a folder sure to be the first in an alphabetical list (__aardvarks). Trigger a containment action (e.g. isolate machine). 24
- 23.
- 24. 7 million records? 7000records? 7 records? Nothing? No clue = assume the worst What was breached?
- 25. Step6: A moreresilient endpoint
- 26. Prevention: AV/NGAV versusHardening Think of AV/NGAV as active prevention, whereas hardening is passive. AV/NGAV knows it prevented something; a more hardened system may not. Example?
- 27.
- 28. What about remediationand response? • Remediation = cleaning up after the attack • Containment = isolating the incident • Automated Endpoint Remediation: can we stop reimaging PCs yet??? 30
- 29. What about remediationand response? 31
- 30. Post-Roadmap: Malware is solved!Right? 32
- 31. Solving malware =solving endpoint security? 33 0% 5% 10% 15% 20% 25% 30% 35% 40% 2012 2013 2014 Error Hacking Malware Misuse Social How big a part of the breach problem is malware? 15% in 2012 24% in 2013 33% in 2014 Source: Verizon Enterprise Solutions
- 32. What are yourendpoint security pain points and goals? Pain Points 1. Cleaning up infections 24/7 2. Catch attacks that bypass preventative controls 3. Catch/prevent non-malware threats 4. Catch insider threats 5. Did a breach actually occur? Goals 1. Better prevention; hardening 2. Better detective controls, better endpoint visibility 3. Better endpoint visibility; hardening 4. Better endpoint visibility 5. Visibility into file movement, data exfiltration 34
- 33. Recommendations 1.Think through andact out worst-case scenarios 2.(Combined with #1) Test and fail repeatedly. Learn from failures. 3.Don’t turn security products to 11 until they’ve been thoroughly tested 4.Include security software/systems in your threat mapping 5.Don’t break the user. 6.Consider time-to-value and labor-to-value ratios 36
- 34.
Editor's Notes
- #2 This is still VERY much a Windows problem.
- #3 It is where work happens It is one of the easiest paths into a company BYOD and ShadowIT is still an unsolved problem
- #4 Three Categories Prevention Detection/Data collection Platform Hardening Privilege Management Application Control Removing attack surface Dynamic attack surface reduction Hey, we see you don’t EVER USE X, Y or Z, so we’re going to turn them off, okay? OR, how about we do like Android 6? You don’t get permissions until they’re needed and then you get prompted to turn them on, and decide then and there whether or not you need them.
- #5 And you know what? I like Endpoint Data Recorder better anyway, because a lot of EDR products out there have little to no detection or response capabilities.
- #11 Our entire IT and security strategy focused on keeping people out, not discovering them once they’ve gotten in. It wasn’t just that the center was “chewy”, it was that it was dark too. This resulted in a number of blind spots: east/west cloud data endpoints/hosts
- #13 Leap frog vs chess analogy – when we succeed, we create change in attacker tactics and behavior
- #14 We typically don’t have the skills or spend the time to do root cause analysis When we succeed, we force the attacker to change behavior. Lack of root cause analysis and process improvement We need durable 5 year solutions, not 6 month solutions Ransomware example
- #15 Build a better malware mousetrap Threat-driven hardening Stop/Detect Non-Malware attacks Full-system visibility (EDR) Data visibility More resilient host
- #16 However, that doesn’t mean signatures, IoCs, analysis sandboxes aren’t important! They’re just not effective for frontline detection/prevention. We still need them for malware analysis and R&D.
- #17 Build a better malware mousetrap Threat-driven hardening Stop/Detect Non-Malware attacks Full-system visibility (EDR) Data visibility More resilient host
- #20 Build a better malware mousetrap Threat-driven hardening Stop/Detect Non-Malware attacks Full-system visibility (EDR) Data visibility More resilient host
- #22 Build a better malware mousetrap Threat-driven hardening Stop/Detect Non-Malware attacks Full-system visibility (EDR) Data visibility More resilient host
- #26 Build a better malware mousetrap Threat-driven hardening Stop/Detect Non-Malware attacks Full-system visibility (EDR) Data visibility More resilient host
- #28 Build a better malware mousetrap Threat-driven hardening Stop/Detect Non-Malware attacks Full-system visibility (EDR) Data visibility More resilient host
- #29 Explain quickly why mobile operating systems have an easier time of it
- #31 Remediation vs containment
- #32 Remediation vs containment
- #34 Perhaps not as big as you’d think, but growing at an alarming rate! This data comes courtesy of the team that puts Verizon’s DBIR together.
- #36 What can you do with what you already have? Take the easy wins!
- #37 if you couldn’t patch and couldn’t use endpoint security software, what would your anti-malware strategy look like? --- test and enable AV/NGAV/EDR functionality a bit at a time Security products are far from infallible Any product that prevents the user from getting the job done will fail or be bypassed. How long before you get it up and working? How much effort/people do you need to get there and keep it there?