Downloaded 11 times
More Related Content
Intro To ECAT
- 1. ECAT – EnterpriseCompromise Assessment Chad Loeven, VP Sales and Marketing Pascal Longpre, Founder and CTO
- 2. Enterprise security today AV on desktop and server Firewall • Bluetooth and WiFi can bypass in-line devices • Inline devices can’t identify what happened on the host in a compromise IPS SIEM
- 3. Kaspersky – Rated#1 AV overall >42% of all new malware passed through undetected
- 4. ECAT fills thedetection gap Incident -> Rapid breach detection Recovery Forensics
- 5. The ECAT solution:no signatures • Host-based Deep Scan • Network traffic • Live Memory Analysis • Machine Suspect Level
- 6. ECAT Overview –server and agent Server-side analysis of the endpoint
- 7. ECAT – Baselinesand whitelists Whitelisting: • Bit9 Global Software Registry (GSR) • NIST database of known-good hashes • ECAT whitelist including Microsoft MSDN • Server-side Cert validation • Opswat Metascan scans against 6 or more AV engines
- 8. ECAT – EnterpriseCompromise Assessment Network Traffic analysis Multi-engine AV scan Application Whitelisting Certificate Validation • Rapid Breach Detection Direct physical disk inspection • Signature-less Live Memory Analysis • Fills the gap in desktop defense Full System Inventory • Actionable information -fast • Remediation
- 9. ECAT – EnterpriseCompromise Assessment Finding an evil in a haystack www.siliciumsecurity.com
Editor's Notes
- #2 Welcome to Silicium Security, the makers of ECAT, an Enterprise Compromise Assessment Tool for signature-less malware detection.We’ve been delivering security solutions to large enterprises, government and military for over a decade and work with a global network of partners to deploy and support ECAT worldwide.In this brief video we’ll explain why current signature-based security solutions come up short and how ECAT can bridge the detection gap.
- #3 Virtually every enterprise today has in-line and host based security solutions blocking, monitoring and remediating threats at multiple levels. However, most of these solutions share one common trait in that they overwhelmingly rely on signatures. In other words, they can only block or detect what they already know about. In line and network-based solutions also have major blind spots. Laptops and remote workstations are often invisible. Bluetooth and WiFi can be hijacked to bypass network controls.
- #4 So what’s the problem with signatures?An advertised 99% detection rate sounds great, but that stat is measured over an entire body of mostly old threats. The 1% not detected is overwhelmingly new, and targeted, attacks. Even minor variants of existing threats can bypass AV, IPS.As an example, let’s take a closer look at the best AV on the market and see how it fares…..Kaspersky was recently ranked as the Product of the Year by a respected independent testing agency – but what does that mean? Unfortunately, when we drill down into the details of the report, ‘winning’ meant only failing 42% of the time on new threats. Which was still better than virtually all other AV products on the market!
- #5 ECAT fills the gap between traditional signature-based security tools and forensics, delivering rapid breach detection and compromise assessment.
- #6 The solution is not to depend on signatures, but rather do a deep analysis of the endpoint combining multiple technologies and approaches. Host-based analysis is key, signature-less network-based solutions will not identify what process is infected or how. No assumptions can be made about the integrity of the endpoint prior to a scan, and analysis must be independent of the end user and done on the server, not the target machine. By assigning a suspect level to each component of the machine, we can build an overall Machine Suspect Level to determine if there has been a compromise and take action.
- #7 ECAT can be deployed as an incident response tool, as part of a security audit or for ongoing monitoring of the enterprise machines.Each ECAT server can handle up to 20K agents. Each agent scans silently in the background with no user interaction. The load is minimal as all information is gathered and sent back to the server, where the analysis is done. The ECAT server verifies the system integrity, and builds a holistic view of the endpoint.
- #8 An important feature of ECAT is the ability to set an enterprise-wide baseline from a clean machine. This process eliminates background noise and false positives, and means truly suspect behaviour will be highlighted.As a 1st step, ECAT conducts server-side Certificate validation to avoid any possible compromise of the cert validation process on the endpoint. Next, ECAT compares every file against 3 powerful whitelists from NIST, Microsoft and Bit9. Combined, every file found is scanned against a database of billions of files. Custom homegrown applications can also be whitelisted system-wide.Finally, each file can be run against OpswatMetascan’smuti-AV scanner to quickly identify known bad files that the desktop AV may have missed. By quickly sorting found files into known good, and known bad, ECAT brings to the fore in the console machines that need immediate attention.
- #9 To summarise, ECAT fills the gap between existing solutions. It delivers accurate, actionable information quickly to the people that need it. ECAT does this by layering on multiple approaches and technologies, starting with aFull system inventory,Live memory analysisPhysical disk analysisCertificate validationWhitelistingMulti-AV scansNetwork Traffic monitoring and statistical Analysis.No other approach delivers detection results like ECAT can.
- #10 Thank you for watching. Consult our website or youtube channel to view ECAT in action, or contact us for more information.