OSB140 - Want a Safer Network? You Can Remove Local Admin Rights with Ivanti Application Control Shane Wescott Mark Williamson

2. Shane Wescott Mark Williamson
AppSense Technology Evangelist – Aust/NZ Technical Lead (AM)
OSB140 - Want a safer network. you can remove local admin rights with
Ivanti application control

3. Agenda
 Who are we
 Why Ivanti for Privilege Management
 How does it work – What’s under the
hood
 Tips and Tricks
 What’s the Challenge
 Customer Success Stories
 Demo – Show me already
 Q & A

4. Who are we ?

5. What’s the
challenge ?

6. User-Targeted Attacks
Of
Cyberattacks Start
With A Phishing Email
PhishMe 2016 Enterprise Phishing Susceptibility and
Resiliency Report
https://phishme.com/2016-enterprise-phishing-susceptibility-report

7. User-Targeted Attacks
of
recipients open
phishing messages,
and 12% click on
attachments.
Verizon 2016 Data Breach Investigations Report
http://www.verizonenterprise.com/DBIR/2016/
Up from 23% and 11%, respectively, in 2015

10. Mitigate Impact
A vulnerability that when exploited allows the attacker to operate in the
context of the current user. Reducing user privileges reduces the attackers
ability to operate thereby slowing their ability to move around your
environment.
Privilege Management Reduces Impact:
0
2
4
6
8
10
12
14
16
18
Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
total Priv mgmt mitigates

11. SANS Training Example from Dr Eric Cole
• 47 users across 47 companies
• Average required rights to data 42%
• Of total data loss, ONLY 17% would
have been lost
• Remaining 83% equated to $4.5 Million
• Roughly $100K per user breached

12. Australian Signals Directorate

13. SANS – 1st Five…
SANS “First Five”—as providing the most immediate increase in
efficient and effective reduction in risk from advanced targeted
attacks:
1) software whitelisting,
2) secure standard configurations,
3) application security patching,
4) system security patching and
5) minimization of administrative privileges.

14. How does it
work – What’s
under the
hood?

15. ivanti User Privilege Management
 Enable admin apps & features for standard users
 Allow personal apps with IT control
 Full auditing capability

16. Standard Elevation with Ivanti Application Control
16
AM Agent
LSASS
Amend Token?
CreateProcess
Regedit.exe
AMAppHook.Dll
NTDLL
LSA Client
Custom LSA
Auth
Package
AMMessageAssist
Regedit.exeReparent
CreateProcess -
Regedit.exe
Explorer.exe

17. Why Ivanti for
Privilege
Management ?

18. Discover Provide Insight Take Action

19. Our History

20. History and Experience
• 18 years experience Whitelisting
from AppSense
• 14 years experience Patching from
Shavlik
• 7 years experience Privilege
Management from AppSense

21. Control Administrative Rights
 Applications
 OS Components
 Websites
 Services
 Installs

22. Corporate App Store

23. Application Network Access Control
Control outbound
connections:
 IP
 Hostname
 URL
 UNC or Port

24. What Do I Need To Elevate?

25. Ivanti is QUICK to protect
Deploy
Audit
Review
Update
Proven Methodology

26. Granular, Contextual Policies
• Allows authorised users to
access “break glass”
functionality
• All based on granular,
contextual policies
• All policy based with full
auditing

27. 85%
of Windows
intrusion threats
Organizations can prevent up to
by implementing four key disciplines
PATCH OPERATING
SYSTEMS
1
PATCH
APPLICATIONS
2
PRIVILEGE
MANAGEMENT
4
APPLICATION
WHITELISTING
3
Powered ByPowered By

28. Our defense-in-depth products
PATCH &
VULNERABILITY
MANAGEMENT
APPLICATION
CONTROL &
PRIVILEGE
MANAGEMENT
ENDPOINT SECURITY
SUITES
SECURE PROGRAM
MANAGEMENT
• IVANTI PATCH FOR
ENDPOINTS
• IVANTI PATCH FOR
SERVERS
• IVANTI PATCH FOR SCCM
• IVANTI APPLICATION
CONTROL FOR ENDPOINTS
• IVANTI APPLICATION
CONTROL FOR SERVERS
• IVANTI APPLICATION
CONTROL FOR SCCM
• IVANTI ENDPOINT SECURITY
• IVANTI SERVER SECURITY
• IVANTI SERVICE MANAGER
• IVANTI ASSET MANAGER
Provide Insight
Compliance and monitoring by Xtraction

29. Customer
Success
Stories?

30. Only product Customer bought off a Beta 

31. Hassell – Removal of Admin/App Store

32. Demo – Show
me already

33. 33

34. Tips and
Tricks

35. 1. Follow the advice from Experts
 SANS, CIS, ASD –do the most
important things FIRST
 Follow a proven methodology
 If you want more info on this jump into
this session
OSB310 – Whitelisting, The Good, the
Bad, the Ugly. Our Experts help you
avoid Common Pitfalls
Thursday 10:15- 11:15 Jamaica B

36. 2. Get buy in from the Business
• It cant just be driven by the
Security Team
• Communications is the key –
user and departmental
• Make sure people understand
the business benefit

37. 3. Do your Discovery - Don’t assume anything
What’s running on your network?
What apps need admin rights?
How quickly user behaviour can change
Xtraction can be Awesome to help get that
single page view

38. 3. Do your Discovery - Don’t assume anything
Xtraction example:
ASD TOP 4 Single pane view
Multiple data sources

39. Plug for Xtraction
OSL140 - Here’s Your #$@&%*! Report! Test Drive Xtraction for
Security
Wednesday 14:15 – 15:15 MEC C1

40. Q + A
Thank you