This document summarizes new security features in Ivanti Endpoint Manager. It discusses multi-layered protections including patching, antivirus, device control, and fileless attack protection. It also outlines three layers of ransomware protection and detection capabilities like inventory data export and a simple security view. Remediation options are presented that can disable networks, run scripts, kill processes, or reimage devices. The document closes by noting Ivanti is recognized in Forrester research on endpoint security suites.

1. OSB220 – What's New in Security for
Endpoint Manager?
Eran Livne – Product Management

2. Protect

3. What is the “front door” of endpoints?

4. Endpoints have 2 “front doors”
§ “Drive by”
§ Execute malicious code

5. “Last week, it was reported that popular Web portal
AskMen.com was compromised to redirect users to a
malicious website that hosted the Nuclear Exploit Kit.”

7. Multi-Layered Protection

8. Patch, patch, patch

9. Windows 10 & Office 365 patching

10. Business web applications break? (NEW)

12. Antivirus

13. Whitelisting

14. Easy definition and maintenance
§ Start by importing from gold images.
§ Approve folders and vendors.
§ Automatically learn used applications.
§ Eliminate the noise using file reputation.
§ Respond to users’ requests.

15. Device control

16. “Malware authors are shifting to fileless
attacks to evade traditional defenses.”
Get Ready for 'Fileless' Malware Attacks, Gartner 2/13/17

17. What are fileless attacks?

19. Layered fileless attacks protection
§ Protect against running scripts by unauthorized processes
§ Memory protection
§ Register and startup folder protection
§ “Call home” protection

22. 3 layers of ransomware protection
1.Detect and block.
2.Protect the boot record.
3.Protect your data.

24. Detection

25. See inside the Matrix.

26. Gather and export data
§ Inventory and security data collected
§ SIEM Integration – using Syslog (NEW)

27. Simple security view

28. Compliance
§ PCI compliance
§ Updated to latest PCI DSS version
§ Security Content Automation Protocol (SCAP) scanning
§ Using latest SCAP engine (2016.3 SU3)
§ Detect common configuration-related vulnerabilities

29. Remediation

31. “With RIG, when it comes to the delivery of malware files, the same
malware file often gets written and executed multiple times on the
victim’s PC. If one method doesn’t work or is blocked by an anti-
malware solution, they have a couple of backup methods.”
Cisco Talos Research.

32. Supports Ivanti AV, Symantec AV, McAfee AV

33. Remediation
§ Disable network
§ Remote control
§ Run your scripts/programs
§ Remote kill processes
§ Re-image
§ Shut down

34. We are recognized.

35. The Forrester Wave™:
Endpoint Security Suites, Q4 2016

36. Video clip placeholder

37. Thanks
Eran Livne
eran.livne@ivanti.com