This document discusses how Bluecoat's Advanced Threat Protection solution works at the network perimeter to block known threats and analyze unknown threats. It uses optimized content analysis, dual malware signature engines, and third-party sandboxing to pre-filter known good files, block known bad downloads, and discover and analyze zero-day threats in an unknown file. Analysis results are shared with Bluecoat's Global Intelligence Network to update threat protections.

1. Security
Empowers
Business
For More Information:
www.bluecoat.com/
ATPlifecycle
Strengthen your Defense with
Block Known Threats and Understand the Unknown with
Advanced Threat Protection at the Perimeter
Next-Generation Malware Analysis
HOW OPTIMIZED CONTENT AND MALWARE ANALYSIS
WORK TOGETHER FOR ADVANCED THREAT PROTECTION
FILE
WHITELISTING
DUAL MALWARE
SIGNATURE ENGINES
MALWARE ANALYSIS
APPLIANCE
INTERNET
GLOBAL
INTELLIGENCE
NETWORK
DELIVER NON-MALICIOUS FILES
Block Known Web Threats
Block all known malicious
sources/malnets and threats
before they enter the network
ProxySG
SECURE WEB GATEWAY
Allow known Good
Free up resources to focus on
advanced threat analysis with
pre-filtering of known good files.
Whitelisting shown to recognize
29% of files as 'good'.
Block known Bad Downloads
Adding additional anti-malware
engine increases coverage
by a double-digit percentage
Analyze Unknown Threats & Update
Gateways
Discover & analyze zero-day
threats with dynamic sandboxing
then update Global Intelligence
Network with data on malicious
files for future blocking.
CONTENT ANALYSIS SYSTEM
Encrypted and Un-Encrypted Content
?
1
2
3
4
3RD PARTY
SANDBOX
THE IMPACT OF ADVANCED THREATS TO YOUR ORGANIZATION
200,000+ new malware samples
appear every day
(Kaspersky Lab)
Modern day threats and targeted
attacks evade signature-based
defenses
Current solutions cannot detect
many types of encrypted,
embedded and morphed
malware
Need advanced threat blocking,
detection, analysis and
response to improve security
Today’s one-box sandbox solutions
result in gateway bottlenecks, too
many false positives and irrelevant
alerts
These products cannot closely
mimic the enterprise’s production
environment
... and do not take advantage of the
pre-filtering of previously known
good and bad files
Malware is becoming
even more evasive
Traditional anti-malware
is not enough
Enterprises are looking for
effective solutions
x
DATA ON MALICIOUS FILES
File HASH
URL
Time Stamp
File Name
DEFENSE-IN-DEPTH, FULLY INTEGRATED WITH A COMPLETE SET OF ATP SOLUTIONS
Real-time Pre-filtering
Fewer files sent to sandbox, for improved
efficiency and high-accuracy malware
scanning
Dynamic Hybrid Sandboxing
Combined with optimized sandbox brokering
for more effective and accurate malware
analysis
Blue Coat Global Intelligence Network
Uniting 75 million users in 15,000 enterprises
for unrivaled threat protection