The document discusses challenges in modern endpoint security and strategies to address them. It outlines how attackers have changed their tactics to take advantage of outdated defenses. The key moves discussed to regain control include implementing defense-in-depth endpoint security, shifting to trust-based security focused on preventing execution rather than detection, focusing on operational basics like patching and asset management, and managing devices to limit local admin risks and unwanted applications. It also provides an example of how one company addressed their security issues by implementing the Lumension Endpoint Management and Security Suite.

1. It’s Your Move: The Changing Game of Endpoint Security

2. Today’s Speakers Paul Henry Security & Forensics Analyst MCP+I, MCSE, CCSA, CCSE, CFSA, CFSO, CISSP,-ISSAP, CISM, CISA, CIFI, CCE Paul Zimski VP of Solution Strategy Lumension Doug Walls CIO EMSolutions Jason Brown Network Engineer EMSolutions

3. Today’s Agenda How the “Bad Guys” Changed the Rules Key Moves We Can Make to Regain Control Real World IT Security Experience Q&A

4. How the “Bad Guys” Have Changed the Rules

5. Current Day Recipe For Disaster Perform below steps 1 to 5. Bait an End User with Spear Phishing Exploit a Vulnerability Download a Back Door Establish a Back Channel Explore and Steal Select another victim. Repeat.

6. Advanced Persistent Threats Highly skilled Cyber Armies unleashing new Advanced Malware…. While many of these attacks are well organized, they have simply taken advantage of the same old mistakes we’ve been making for years.

7. Our Flaw Remediation Is Missing The Target Since 2009 the most hacked software was 3rd party apps and browser add-ons like Adobe and Quicktime. Yet we still today focus our attention on patching Microsoft OS/Applications. The bad guys know it… and are taking full advantage

8. Traditional AV Can No Longer Keep Up More than 73,000 new malware instances every day. Obfuscation has effectively rendered traditional signature based defenses useless. Polymorphic malware that alters its signature with each infection has become commonplace. Our defenses must evolve!

9. What Did We Expect Was Going To Happen? We are using the same defenses that failed us for the last decade… Focused on the gateway - and we have neglected our endpoints. Focused on blocking the delivery of malware - not preventing its execution. Unless we make a definitive change in our defenses, we can expect the same results…

10. Next Generation Malware Has Arrived Instead of the infected machine waiting for a connection to be made from outside, the infected machine makes the connection itself. Introduces a new technique of code injection – Flux writes code directly into a host process and executes it there. Circumvents several desktop firewalls and makes it nearly invisible to current anti-malware software. Flux is a new Trojan spreading covertly through the internet.

11. If a “bad guy” can… Persuade you to run his program on your computer... Alter the operating system on your computer… Gain unrestricted physical access to your computer… Upload programs to your website… Crack your passwords… … it’s not your computer, website or data anymore.

12. At the End of the Day… It doesn’t matter what attack vector is used… the “bad guys" are trying to install and run code on your machines to gain unauthorized control!

13. Key Moves We Can Make Against the “Bad Guys” to Regain Control

14. Implement Defense-in-Depth Endpoint Security Shift from Threat-Centric to Trust-Based Security Focus on the Operational Basics Manage Those Devices Key Moves You Can Make

15. Strategy 1: Implement Defense-in-Depth Traditional Endpoint Security Defense-N-Depth Blacklisting As The Core Zero Day 3 rd Party Application Risk Malware As a Service Volume of Malware Patch & Configuration Mgmt.

16. Antivirus will provide some protection against known payloads, and remains a good layer for known malware detection and removal However as attack sophistication and targeting increases, malware becomes less effective as a primary defense Application control is a much better defense to stop unknown payloads from installing Strategy 2: Stop Malware Payloads

17. What is Application Whitelisting? Malware Applications Authorized Operating Systems Business Software Known Viruses Worms Trojans Unauthorized Games iTunes Shareware Unlicensed S/W Unknown Viruses Worms Trojans Keyloggers Spyware Un-Trusted

18. Trust-Based Security

19. Flexible Trust Trusted Publisher Authorizes applications based on the vendor that “published” them through the digital signing certificate. Trusted Updater Authorizes select systems management solutions to “update” software, patches and custom remediations, while automatically updating them to the whitelist. Trusted Path Authorizes applications to run based on their location. Local Authorization Allows end-users to locally authorize applications which have not been otherwise trusted by the whitelist or any other trust rules.

20. Strategy 3: Focus on the Operational Basics Source: Aberdeen Group, Managing Vulnerabilities and Threats (No, Anti-Virus is Not Enough), December 2010 Assess Prioritize Remediate Repeat Identify all IT assets (including platforms, operating systems, applications, network services) Monitor external sources for vulnerabilities, threats and intelligence regarding remediation Scan all IT assets on a regular schedule for vulnerabilities, patches and configurations Maintain an inventory of IT assets Maintain a database of remediation intelligence Prioritize the order of remediation as a function of risk, compliance, audit and business value Model / stage / test remediation before deployment Deploy remediation (automated, or manually) Train administrators and end-users in vulnerability management best practices Scan to verify success of previous remediation Report for audit and compliance Continue to assess, prioritize and remediate

21. Rethink Your Patch Strategy Source: 1 - SANS Institute The top security priority is “patching client-side software” 1 Streamline patch management and reporting across OS’s AND applications Patch and defend is not just a Microsoft issue More than 2/3 of today’s vulnerabilities come from non-Microsoft applications

22. Stop Unwanted Applications Immediate and simple risk mitigation Denied Application Policy prevents unwanted applications even if they are already installed Easily remove unwanted applications

23. Reduce Local Administrator Risk Limit Local Admin Usage Monitor and Control existing Local Admins

24. Strategy 4: Manage those Devices

25. Real World IT Security Experience

26. EMSolutions Headquartered in Arlington, VA Established in May 2000 Four Satellite Offices Systems Engineering, Information Technology and Information Assurance, Science and Advanced Technology Solutions, and Modeling and Simulation for Government Organizations

27. IT Security Challenges Control use of removable devices on customer network Monitor and control data entering and leaving network Audit any and all use of peripherals and media introduced to the network Protect dedicated infrastructure that supports unclassified and corporate work Ensure constant uptime of hot desks Limit risk from local admin users Prevent execution of unwanted and malicious apps Current AV solution was not effective in preventing the issues

28. Addressing the Challenge Implemented Lumension ® Endpoint Management and Security Suite (L.E.M.S.S.) Easy process to install, set up and maintain the application whitelist with all currently used corporate OSes and software Shifted from another antivirus provider to the AV module within L.E.M.S.S. Educated users about potential external threats and internal problems that could arise from lack of precaution

29. Results Improved Security Eliminated malware outbreaks More robust patch management Improved User Productivity Optimized performance of end user PCs Reduced IT help desk calls/complaints from users regarding malware-related PC issues Improved IT Productivity Visibility into endpoints, apps and configurations Minimized time required for endpoint maintenance and user education Reduced admin burden by managing one solution

30. Q&A

31. Global Headquarters 8660 East Hartford Drive Suite 300 Scottsdale, AZ 85255 1.888.725.7828 [email_address] http://blog.lumension.com