Scalar Decisions, profile picture
Uploaded byScalar Decisions
PPTX, PDF1,253 views

Scalar Security Roadshow - Vancouver Presentation

The document provides insights on addressing complex security challenges, noting that security spending has increased and there is a correlation between budget and maturity in security systems. It highlights Scalar's expertise and achievements as a provider of emerging technology solutions, focusing on data protection, high performance computing, and partnership with leading security brands. Additionally, it covers the capabilities of Cisco's Firepower in enhancing cybersecurity measures through integrated threat defense and comprehensive visibility.

Technology◦
Related topics:
IT Security•

Embed presentation

Downloaded 22 times
1 / 119
2 / 119
3 / 119
4 / 119
5 / 119
6 / 119
7 / 119
8 / 119
9 / 119
10 / 119
11 / 119
12 / 119
13 / 119
14 / 119
15 / 119
16 / 119
17 / 119
18 / 119
19 / 119
20 / 119
21 / 119
22 / 119
23 / 119
24 / 119
25 / 119
26 / 119
27 / 119
28 / 119
29 / 119
30 / 119
31 / 119
32 / 119
33 / 119
34 / 119
35 / 119
36 / 119
37 / 119
38 / 119
39 / 119
40 / 119
41 / 119
42 / 119
43 / 119
44 / 119
45 / 119
46 / 119
47 / 119
48 / 119
49 / 119
50 / 119
51 / 119
52 / 119
53 / 119
54 / 119
55 / 119
56 / 119
57 / 119
58 / 119
59 / 119
60 / 119
61 / 119
62 / 119
63 / 119
64 / 119
65 / 119
66 / 119
67 / 119
68 / 119
69 / 119
70 / 119
71 / 119
72 / 119
73 / 119
74 / 119
75 / 119
76 / 119
77 / 119
78 / 119
79 / 119
80 / 119
81 / 119
82 / 119
83 / 119
84 / 119
85 / 119
86 / 119
87 / 119
88 / 119
89 / 119
90 / 119
91 / 119
92 / 119
93 / 119
94 / 119
95 / 119
96 / 119
97 / 119
98 / 119
99 / 119
100 / 119
101 / 119
102 / 119
103 / 119
104 / 119
105 / 119
106 / 119
107 / 119
108 / 119
109 / 119
110 / 119
111 / 119
112 / 119
113 / 119
114 / 119
115 / 119
116 / 119
117 / 119
118 / 119
119 / 119
Scalar Security Roadshow © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 1
Purpose of today’s session: Provide insights on how Scalar and our partners address today’s complex security challenges © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 2
Gartner report highlights 3 • Security spend as % of IT budgets increased • Strong correlation between Security budget and maturity • Emphasis on network, applications and endpoint • Insufficient investment in people and process © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014
Scalar – brief overview © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014 4
10 Years © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 5
90 © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 6
100% Vancouver Calgary Montreal Ottawa Toronto London © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 7
54% © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 8
#1 #51 ICT Security Company #15 Top 250 ICT Companies © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 9
An integrator of emerging technologies. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 10
Top tier technical talent. • Engineers average 15 years of experience • World-class experts from some of the leading organizations in the industry • Dedicated teams: PMO, finance, sales and operations • Canadian Authorized Training Centres • We employ and retain top talent © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 11
Top awards. • Brocade Partner of the Year ~ Innovation • Cisco Partner of the Year ~ Data Centre & Virtualization • NetApp Partner of the Year ~ Central Canada • VMware Global Emerging Products Partner of the Year • F5 VAR Partner of the Year ~ North America • Palo Alto Networks Rookie of the Year © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 12
Our Focus • Protection of Data and Systems • High Performance Computing • Flexible Solutions © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 13
Our security partners © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014 14
Partners here today © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014 15
SECURITY © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16
FirePOWER Rob Bleeker Security Consulting Systems Engineer CCIE# 29033, [CCN|I|D|P], SFCE, CEH SECURITY
SECURITY Agenda: • New Security Model and Global Intelligence • The POWER in FirePOWER • FirePOWER Appliance • ASA with FirePOWER Services © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18
The New Security Model BEFORE Discover Enforce Harden AFTER Scope Contain Remediate Attack Continuum DURING Detect Block Defend Network Endpoint Mobile Virtual Cloud Point in Time Continuous © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19
Cyber Attack Chain Recon Weaponization Deliver Exploit Install CnC Actions BEFORE Discover Enforce Harden AFTER Scope Contain Remediate During Detect Block Prevent NGIPS Web Security Email Security Visibility and Context Firewall NGFW VPN UTM NAC + Identity Services Advanced Malware Protection Network Behavior Analysis © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20
CiscoSecurity Intelligence Operation (SIO) More Than $100 24 Hours Daily More Than 40 Million OPERATIONS SPENT IN DYNAMIC RESEARCH AND DEVELOPMENT 0010 010 10010111001 10 100111 010 000100101 110011 01100111010000110000111000111010011101 Cisco1100001110001110 ® SIO 1001 1101 1110011 0110011 101000 0110 00 0111000 111010011 101 1100001 11000 111010011101 0010 010 10010111001 10 100111 010 000100101 110011 01100111010000110000111000111010011101 1100001110001110 1001 1101 1110011 0110011 101000 0110 00 0111000 111010011 101 1100001 11000 111010011101 Email Devices WWW Web LANGUAGES IPS Networks Endpoints More Than 80 PH.D, CCIE, CISSP, MSCE Cloud IPS AnyConnect® ESA ASA WWW WSA Information More Than 800 ENGINEERS, TECHNICIANS, AND RESEARCHERS Actions Visibility Control 1.6 Million GLOBAL SENSORS 100 TB DATA RECEIVED PER DAY 40% WORLDWIDE EMAIL TRAFFIC 13 Billion WEB REQUESTS More Than 150 Million DEPLOYED ENDPOINTS 3 to 5 MINUTE UPDATES More Than 200 PARAMETERS TRACKED More Than 5500 IPS SIGNATURES PRODUCED More Than 70 PUBLICATIONS PRODUCED More Than 8 Million RULES PER DAY © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21
Collective Security Intelligence Malware Protection IPS Rules Reputation Feeds Vulnerability Database Updates Sourcefire AEGIS™ Program Private and Public Threat Feeds Sandnets Sourcefire VRT® (Vulnerability Research Team) Sandboxing Machine Learning Infrastructure FireAMP™ Community Honeypots File Samples Big Data (>380,000 per Day) Advanced Microsoft and Industry Disclosures SPARK Program Snort and ClamAV Open Source Communities © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22
The POWER in FirePOWER SECURITY © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23
About Sourcefire Mission: To be the leading provider of intelligent cybersecurity solutions for the enterprise. • Founded in 2001 by Snort Creator, Martin Roesch, CTO • Headquarters: Columbia, MD • Focus on enterprise and government customers • Global Security Alliance ecosystem • NASDAQ: FIRE Leading in NSS for NGFW, NGIPS, BDS (Advanced Malware Protection) © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24
Integrated Threat Defense Across the Attack Continuum BEFORE Control Enforce Harden Attack Continuum DURING AFTER Detect Block Defend Scope Contain Remediate Firewall / VPN Granular App Control Modern Threat Control Advanced Malware Protection Retrospective Security IoCs / Incident Response NGIPS Security Intelligence Web Security Visibility and Automation © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25
FireSIGHT™ Management Center: Full Stack Visibility CATEGORIES EXAMPLES FirePOWER Services TYPICAL IPS TYPICAL NGFW Threats Attacks, Anomalies ✔ ✔ ✔ Users AD, LDAP, POP3 ✔ ✗ ✔ Web Applications Facebook Chat, Ebay ✔ ✗ ✔ Application Protocols HTTP, SMTP, SSH ✔ ✗ ✔ File Transfers PDF, Office, EXE, JAR ✔ ✗ ✔ Malware Conficker, Flame ✔ ✗ ✗ Command & Control Servers C&C Security Intelligence ✔ ✗ ✗ Client Applications Firefox, IE6, BitTorrent ✔ ✗ ✗ Network Servers Apache 2.3.1, IIS4 ✔ ✗ ✗ Operating Systems Windows, Linux ✔ ✗ ✗ Routers & Switches Cisco, Nortel, Wireless ✔ ✗ ✗ Mobile Devices iPhone, Android, Jail ✔ ✗ ✗ Printers HP, Xerox, Canon ✔ ✗ ✗ VoIP Phones Cisco phones ✔ ✗ ✗ Virtual Machines VMware, Xen, RHEV ✔ ✗ ✗ Contextual Information Superiority Awareness © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26
Impact Assessment IMPACT Correlates all intrusion events to an impact of the attack against the target FLAG ADMINISTRATOR ACTION WHY Act Immediately, Vulnerable Event corresponds to vulnerability mapped to host Investigate, Potentially Vulnerable Relevant port open or protocol in use, but no vuln mapped Good to Know, Currently Not Vulnerable Relevant port not open or protocol not in use Good to Know, Unknown Target Monitored network, but unknown host Good to Know, Unknown Network Unmonitored network © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 27
Cisco FireSIGHT Simplifies Operations • Impact Assessment and Recommended Rules Automate Routine Tasks © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28
Visibility and Context © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 29
Visibility and Context File Sent File Received File Executed File Moved File Quarantined © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 30
Indications of Compromise (IoCs) IPS Events Malware Backdoors CnC Connections Exploit Kits Admin Privilege Escalations Web App Attacks SI Events Connections to Known CnC IPs Malware Events Malware Detections Malware Executions Office/PDF/Java Compromises Dropper Infections © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 31
FirePOWER Services: Application Control • Control access for applications, users and devices • “Employees may view Facebook, but only Marketing may post to it” • “No one may use peer-to-peer file sharing apps” Over 3,000 apps, devices, and more! © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 32
…Yet Another Open Source Success Story • OpenAppID • Open source application detection and control Application-focused detection language tied to Snort engine Enhances coverage and efficacy and accelerates development of application detectors Empowers the community to share detectors for greater protection Already over 1300 OpenAppID Detectors Ties into a Snort Pre-processor for maximum performance and integration Detection of applications on the network Reporting on the usage statistics of apps (traffic) Blocking of applications by policy Extensions to the Snort rule language to enable application specification Reporting of an “App Name” along with Security events (e.g. IPS/AMP) © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 33
FirePOWER Services: URL Filtering • Block non-business-related sites by category • Based on user and user group © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34
FirePOWER Services: Advanced Malware Malware Alert! Available In Defense Center 1) File Capture Collective Security Intelligence Sandbox 3) Send to Sandbox 2) File Storage 4) Execution Report Network Traffic © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 35
Reduced Cost and Complexity • Multilayered protection in a single device • Highly scalable for branch, internet edge, and data centers • Automates security tasks oImpact assessment oPolicy tuning oUser identification • Integrate transparently with third-party security solutions through eStreamer API © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 36
FirePOWER Appliances SECURITY © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37
Setting the New Standard for Advanced Threat Protection Sourcefire FirePOWER™ • Industry-best Intrusion Prevention • Real-time Contextual Awareness • Full Stack Visibility • Intelligent Security Automation with FireSIGHT™ • Unparalleled Performance and Scalability • Easily add Application Control, URL Filtering and Advanced Malware Protection with optional subscription licenses © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 38
Platforms and Places in the Network IPS Performance and Scalability FirePOWER 7100 Series 500 Mbps – 1 Gbps FirePOWER 7120/7125/8120 1 Gbps - 2 Gbps FirePOWER 8100/8200 2 Gbps - 10 Gbps FirePOWER 8200 Series 10 Gbps – 40 Gbps FirePOWER 7000 Series 50 Mbps – 250 Mbps FirePOWER 8300 Series 15 Gbps – 60 Gbps SOHO Branch Office Internet Edge Campus Data Center © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 39
FirePOWER Feature Summary NGIPS • IPS Detection and Prevention • Security Updates • Reports, Alerts, and Dashboards • Centralized Policy Management • Custom IPS Rule Creation • Automated Impact Assessment • Automated Tuning • FireSIGHT Network & User Intelligence • IT Policy Compliance Whitelists • File Type Determination • Network Behavior Analysis You can ADD additional license • Application Control • User and User Group Control • Stateful Firewall Inspection Switching and Routing • Network Address Translation • URL Filtering • File Blocking • Advanced Malware Protection Virtual Appliances for VMWare and XEN
ASA with FirePOWER Services SECURITY © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 41
FirePOWER Services for ASA: Components FirePOWER Services Blade ASA 5585-X • Models: ASA 5585-X-10, ASA 5585-X- 20, ASA 5585-X-40, ASA 5585-X-60 • New FirePOWER Services Hardware Module Required • Licenses and Subscriptions • Models: ASA 5512-X, 5515-X, 5525-X, 5545-X, and 5555-X • SSD Drive Required • FirePOWER Services Software Module • Licenses and Subscriptions © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 42
Superior Multilayered Protection • World’s most widely deployed, enterprise-class ASA stateful firewall • Granular Application Visibility and Control (AVC) • Industry-leading FirePOWER Next-Generation IPS (NGIPS) • Reputation- and category-based URL filtering • Advanced malware protection Cisco Collective Security Intelligence Enabled FireSIGHT Analytics & Automation CISCO ASA WWW URL Filtering (subscription) Identity-Policy Control & VPN Advanced Malware Protection (subscription) Intrusion Prevention (subscription) Application Visibility &Control Clustering & High Availability Network Firewall Routing | Switching Built-in Network Profiling © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 43
ASA and FirePOWER Features • IPS Detection and Prevention • Security Updates • Reports, Alerts, and Dashboards • Centralized Policy Management • Custom IPS Rule Creation • Automated Impact Assessment • Automated Tuning • FireSIGHT Network & User Intelligence • IT Policy Compliance Whitelists • File Type Determination • Network Behavior Analysis • Application Control • User and User Group Control • Stateful Firewall Inspection Switching and Routing • Network Address Translation • URL Filtering • File Blocking • Advanced Malware Protection • Identity-Based Firewall for enhanced user ID awareness. • Highly Secure remote access (IPSEC and SSL) • Proactive, near-real-time protection against Internet threats • Integrates with other essential network security tech • Supports Cisco TrustSec security group tags (SGTs) and • Extensive stateful inspection engine, • Site-to-site VPN, NAT, IPv6, • Dynamic Routing (including BGP) • HA, Clustering • Protection from botnets • Delivers high availability for high-resiliency application • Change of Authorization (CoA) © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 44
Q & A
The Perimeter is Dead, Long Live the Perimeter Buu Lam Field Systems Engineer
What is The Perimeter?
pe·rim·e·ter 1.the continuous line forming the boundary of a closed geometric figure. "the perimeter of a rectangle" synonyms: circumference, outside, outer edge "the perimeter of a circle" the outermost parts or boundary of an area or object. "the perimeter of the garden" synonyms: boundary, border, limits, bounds, confines, edge, margin, fringe(s), periphery, borderline, verge; More a defended boundary of a military position or base. In Networking we call it…DMZ
Defense in Depth?
Defense in depth The principle of defense-in-depth is that layered security mechanisms increase security of the system as a whole. If an attack causes one security mechanism to fail, other mechanisms may still provide the necessary security to protect the system……Implementing a defense-in-depth strategy can add to the complexity of an application, which runs counter to the “simplicity” principle often practiced in security. That is, one could argue that adding new protection functionality adds additional complexity that might bring new risks with it. https://www.owasp.org/index.php/Defense_in_depth
What’s a Perimeter without a
Perimeter Security Technologies A long time ago… and then… present day… and now with F5! Firewalls started out as proxies Stateless filters accelerated firewalls, but weakened security Stateful firewalls added security with deep inspection, but still fall short of proxies F5 brings full proxy back to firewalls: highest security matched by a high-scale and high-performance architecture F5 Agility 2014 52
Protecting against Threats is challenging Webification of apps Device proliferation 71% of internet experts predict most people will do work via web or mobile by 2020. 95%of workers use at least one personal device for work. 130 millionenterprises will use mobile apps by 2014 Evolving security threats Shifting perimeter 58%of all e-theft tied to activist groups. 81%of breaches involved hacking 80%of new apps will target the cloud. 72%IT leaders have or will move applications to the cloud. F5 Agility 2014 53
Evolving Security Threat Landscape F5 Agility 2014 54
More sophisticated attacks are multi-layer Application SSL DNS Network F5 Agility 2014 55
Its all about the Application.
BIG-IP Application Security Manager BIG-IP ® ASM™ protects the applications your business relies on most and scales to meet changing demands. Multiple deployment options Visibility and analysis Comprehensive protections • Standalone or ADC add-on • Appliance or Virtual edition • Manual or automatic policy building • 3rd party DAST integration • Visibility and analysis • High speed customizable syslog • Granular attack details • Expert attack tracking and profiling • Policy & compliance reporting • Integrates with SIEM software • Full HTTP/S request logging • Granular rules on every HTTP element • Client side parameter manipulation protection • Response checks for error & data leakage • AV integrations F5 Agility 2014 57
Comprehensive Protections BIG-IP ASM extends protection to more than application vulnerabilities L7 DDOS Web Scraping Web bot identification XML filtering, validation & mitigation XML Firewall Geolocation blocking ICAP anti-virus Integration ASM F5 Agility 2014 58
Network Threats Application Threats 90% of security investment focused here Yet 75% of attacks are focused here Attack Vectors TCP SYN Flood TCP Conn Flood DNS Flood HTTP GET Flood Attack Vectors HTTP Slow Loris DNS Cache Poison SQL Injection Cross Site Scripting F5 Agility 2014 59
Unique full-proxy architecture WAF WAF Slowloris atXtaScSk iRule leakage iRule iRule HTTP SSL TCP HTTP SSL TCP iRule iRule iRule SSL renegotiation SYN flood ICMP flood Data Network Firewall F5 Agility 2014 60
Who are you? AAA
Who’s Requesting Access? Employees Partner Customer Administrator Manage access based on identity IT challenged to: • Control access based on user-type and role • Unify access to all applications (mobile, VDI, Web, client-server, SaaS) • Provide fast authentication and SSO • Audit and report access and application metrics F5 Agility 2014 62
Security at the Critical Point in the Network Physical Virtual Cloud Storage Total Application Delivery Networking Services Clients Remote access SSL VPN APP firewall F5 Agility 2014 63
BIG-IP APM Use Cases Secure Web Gateway Accelerated Remote Access Internet Apps Enterprise Data & Apps Federation Cloud, SaaS, and Partner Apps Internet App Access Management BIG-IP APM OAM VDI Exchange Sharepoint F5 Agility 2014 64
Which Threat mitigation to use? Content Delivery Network Carrier Service Provider Cloud-based DDoS Service Cloud/Hosted Service Network firewall with SSL inspection Web Application Firewall On-premise DDoS solution Intrusion Detection/Prevention On-Premise Defense F5 Agility 2014 65
All of the above
Full Proxy Security Client / Server Web application Application Session Network Physical Application health monitoring and performance anomaly detection HTTP proxy, HTTP DDoS and application security SSL inspection and SSL DDoS mitigation L4 Firewall: Full stateful policy enforcement and TCP DDoS mitigation Client / Server Web application Application Session Network Physical F5 Agility 2014 67
F5 Provides Complete Visibility and Control Across Applications and Users DNS Web Access Intelligent Services Platform Users Securing access to applications from anywhere Resources Protecting your applications regardless of where they live Dynamic Threat Defense DDoS Protection Protocol Security Network Firewall TMOS F5 Agility 2014 68
PROTECTING THE DATA CENTER Use case Load Balancer Firewall/VPN • Consolidation of firewall, app security, traffic management Network DDoS DNS Security Balancer & SSL • Protection for data centers and application servers Application DDoS Web Application Firewall Load • High scale for the most common inbound protocols Before f5 with f5 Web Access Management F5 Agility 2014 69
F5 Bringing deep application fluency to Perimeter security One platform SSL inspection Traffic management DNS security Access control Application security Network firewall EAL2+ EAL4+ (in process) DDoS mitigation F5 Agility 2014 70
How do I implement perimeter Security with F5?
Reference Architectures DDoS Protection S/Gi Network Simplificatio n Security for Service Providers Application Services LTE Roaming Migration to Cloud DevOps Secure Mobility DNS Cloud Federation Cloud Bursting F5 Agility 2014 72
Application (7) Presentation (6) Increasing difficulty of attack detection DDoS MITIGATION Physical (1) Data Link (2) Network (3) Transport (4) Session (5) Network attacks Session attacks Application attacks OWASP Top 10 (SQL Injection, XSS, CSRF, etc.), Slowloris, Slow Post, HashDos, GET Floods SYN Flood, Connection Flood, UDP Flood, Push and ACK Floods, Teardrop, ICMP Floods, Ping Floods and Smurf Attacks BIG-IP ASM Positive and negative policy reinforcement, iRules, full proxy for HTTP, server performance anomaly detection DNS UDP Floods, DNS Query Floods, DNS NXDOMAIN Floods, SSL Floods, SSL Renegotiation BIG-IP LTM and GTM High-scale performance, DNS Express, SSL termination, iRules, SSL renegotiation validation BIG-IP AFM SynCheck, default-deny posture, high-capacity connection table, full-proxy traffic visibility, rate-limiting, strict TCP forwarding. Packet Velocity Accelerator (PVA) is a purpose-built, customized hardware solution that increases scale by an order of magnitude above software-only solutions. OSI stack F5 mitigation technologies OSI stack F5 mitigation technologies F5 Agility 2014 73
® Solve the Endpoint Security Challenge with Isolation, not Detection Chris Cram Security Solutions Architect © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 75
76 Agenda The Security Landscape Bromium Overview Use Cases and Benefits Summary and Next Steps © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
Up 294% $30B No! Security Spending — ’05–’14 Are breaches going down? Up 390% Malware/Breaches — ’05–’14 Source: Gartner, Idtheftcenter, $30B is a Gartner figure for 2014 3 The IT Security Paradox © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
“Anti-virus is dead. It catches only 45% of cyber-attacks.” Brian Dye SVP, Symantec 71% of all breaches are from the endpoint! The Endpoint Problem  Polymorphic  Targeted  … Pattern Matching  Only known  Many ???  Costly remediation Advanced Threats Ineffective Detection 5 The Problem © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
 Polymorphic  Targeted  Zero Day Pattern-Matching  Only known  Many false positives  Costly remediation 71% of all breaches start on the endpoint! Advanced Threats Ineffective Detection The Endpoint Problem Source: Verizon Data Breach Report 4 The Problem © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
Advanced Attacks Evade Legacy Defenses Threats 80 Network Detection Based Firewall IPS Web & Email Gateways Endpoint Detection Based PC Firewall PC Anti-virus © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
81 $25B $20B $15B $10B $5B $0 Citigroup Washington Post Restaurant Depot Scribd Ubuntu Bethesda Game Studios Michael’s Stores Virginia LexisNexis Sega University of Wisconsin – Milwaukee Sony Pictures Betfair Seacoast Radiology, PA Three Iranian banks KT Corp. Ohio Medicaid State Puerto Rico Department of Health Sony Online EntertainmentSouthern Sony PSN California Medical-Legal Consultants San Francisco Public Utilities Commission Writerspace .com Network Solutions University of California Berkeley Prescription Monitoring Program Heartland University RockYou! Drupal Yahoo Japan South Africa Police Living Social Central Hudson Gas & Electric Nintendo Washington State court system Evernote RBS Worldpay Auction. com.kr Virginia Dept. of Health Ameritrade Hannaford Brothers Supermarket Monster. Processors International CheckFree Corporation TD com Chain TK/ TJ Maxx Yahoo Blizzard Data KDDI Gawker .com Global Payments US Federal Reserve Bank of Clevelan d Ankle & Foot Center of Tampa Bay, AT&T Ubisoft Inc. Significant Data Breaches Source: Idtheftcenter.org Updated 6/16/14 | WW Security Spend Source: Gartner, Red bubbles illustrative only to depict the 71% Application Whitelisting Host Intrusion Prevention Endpoint Sandboxing Host Web Filtering Cloud-based AV detection Network Sandboxing Target AOL Cardsystems Solutions Inc. AOL NASDAQ Twitter Sutherland Healthcare Neiman Marcus Ebay Aaron Brothers Mac Rumour s .Com Neiman Marcus Home Depot America 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 n Express PF Changs Paytime Adobe Snapch at 2013 614 reported breaches 91,982,172 records Recent Security Timeline © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
82 $25B $20B $15B $10B $5B $0 Application Whitelisting Host Intrusion Prevention Endpoint Sandboxing Host Web Filtering Cloud-based AV detection Network Sandboxing Breaches Starting from the Endpoint 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 Significant Data Breaches Source: Idtheftcenter.org Updated 6/16/14 | WW Security Spend Source: Gartner, Red bubbles illustrative only to depict the 71% 2013 614 reported breaches 91,982,172 records Recent Security Timeline © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
Bromium—Pioneer and Innovator Redefining security with isolation technology Transforming the legacy security model Global, top investors, leaders of Xen Top tier customers across every vertical 8 © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
84 Core Technology Hardware isolates each untrusted Windows task Lightweight, fast, hidden, with an unchanged native UX Microvisor Based on Xen with a small, secure code base Industry-standard desktop, laptop hardware Hardware Virtualization Hardware Security Features © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
Isolate all end user tasks – browsing, opening emails, files… Utilize micro-virtualization and the CPU to hardware isolate Across major threat vectors— Web, email, USB, shares… Seamless user experience on standard PCs 85 How Bromium Solves The Problem © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
Bromium vSentry OS Anti-virus, sandbox and other security tools OS Kernel  Today’s signature and behavioral techniques miss many attacks  They almost always leave endpoints corrupted, requiring re-imaging Hardware-isolated Micro VMs  All user tasks and malware are isolated in a super-efficient micro-VM  All micro-VMs destroyed, elimi-nating all traces of malware with them Hardware Applications tab tab OS Hardware Traditional Endpoint Security O S O S O S O S 10 Different from Traditional Security © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
LAVA Understanding the Kill Chain WHO Is the Target WHERE Is the Attacker WHAT WHAT Is the Goal WHAT Is the Technique Is the Intent 24 © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
Java Legacy App Support Off Net Patching Laptop Users High Value Targets Threat Intelligence Secure Browsing 12 Use Cases © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
89 Why Customers Deploy Bromium Defeat Attacks  Eliminate compromises on the endpoint  Deliver protection in the office or on the road Streamline IT  Reduce operational costs  Dramatically increase IT productivity Empower End Users  Remove the burden of security from users  Enable users to click on anything…anywhere © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
Summary The attack landscape has fundamentally changed; perimeter evaporating in the cloud and mobile era Current ‘detection’ defenses are ineffective; endpoint is the weakest link Bromium is redefining endpoint security with micro-virtualization Enormous benefits in defeating attacks, streamlining IT and empowering users 90 © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
Questions? © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 91
Beyond Compliance Rob Stonehouse – Chief Security Architect © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 92
The Rush To Compliance “We have to be compliant!” © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 93
What Do We Know? • The Internet wants all your information • Law is not a deterrent • Little risk for huge gains • Patience = Success • Users will still click on anything …It is going to get worse © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 94
20+ Years of Monitoring What have we seen? - Sophisticated malware - Teams of attackers - Persistence & Purpose © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 95
The Problem Technology • New strategies • Hard to realize the value InfoSec is Expensive • Resource issues © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 96
What is The Answer? Visibility © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 97
Get The Help You Need You Can No Longer Do This Alone © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 98
Recap • Reduce complexity – simplify • Apply security at the infrastructure, applications and endpoint • Augment technology with people and process • Spend on security vs. compliance • Gain visibility through effective security operations © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 99
Managed Security Services Jamie Hari – Product Manager, Infrastructure & Security © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 100
Scalar discovered what they overlooked. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 101
Changing Tactics © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 102
The way you look at security needs to change. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014 103
SIEM © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 104
Improved Intelligence Scalar has the tools and experience to manage security The SIEM is the heart and brain of the SOC. It moves data around in a quickly complex and technical analyses landscape. it with continually updated intelligence. Users Servers End Points Firewalls IPS VS AV/AM/AS SIEM SOC Tools Scalar SOC © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 105
What is SIEM? A solution which gathers, analyzes, and presents security information. • Log Management • Security Event Correlation and Analysis • Security Alerting & Reporting © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 106
Reporting Quickly Identify Patterns of Activity, Traffic, and Attacks © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 107
Managed SIEM & Incident Response Real-time security event monitoring and intelligent incident response • 24 x 7 Security Alert & System Availability Monitoring • Security Incident Analysis & Response • Infrastructure Incident, Change, Patch, and Configuration Management © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 108
What should I look for in a provider? • Breadth and Depth of Technical Capability • Flexibility in Deployment, Reporting, and Engagement Options • Experience with Customers in Diverse Industries • A Partner Model © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 109
Getting Started © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 110
Proof of Value 4 Week Trial • Dashboard for Real-time Data • Weekly Security Report • Detailed Final Summary Report • Seamless Continuation into Full Service © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 111
You decide how we fit © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014 112
Questions? © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 113
Putting our expertise into practice. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 114
Integrating, securing and managing systems for the most technologically advanced games ever. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 115
Building a centre of excellence that delivers a compute cluster to a global user community. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 116
2 banks. 5 months. 1 great enterprise application. Mobile Wallet © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 117
© 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 118
What’s next? Looking for more info on security? Rob Stonehouse, Scalar’s Chief Security Architect, discusses security beyond compliance on our blog here. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 119

More Related Content

PPTX
Scalar Security Roadshow - Calgary Presentation
byScalar Decisions
 
PDF
Next Generation Security
byCisco Canada
 
PDF
Cisco Security Presentation
bySimplex
 
PDF
Cisco ThreatGrid: Malware Analysis and Threat Intelligence
byCisco Canada
 
PPTX
Talos Insight: Threat Innovation Emerging from the Noise
byCisco Canada
 
PDF
Scalar Security Roadshow - Ottawa Presentation
byScalar Decisions
 
PDF
Scalar Security Roadshow - Toronto Presentation
byScalar Decisions
 
PPTX
Mobile Threat Protection: A Holistic Approach to Securing Mobile Data and Dev...
bySkycure
 
Scalar Security Roadshow - Calgary Presentation
byScalar Decisions
 
Next Generation Security
byCisco Canada
 
Cisco Security Presentation
bySimplex
 
Cisco ThreatGrid: Malware Analysis and Threat Intelligence
byCisco Canada
 
Talos Insight: Threat Innovation Emerging from the Noise
byCisco Canada
 
Scalar Security Roadshow - Ottawa Presentation
byScalar Decisions
 
Scalar Security Roadshow - Toronto Presentation
byScalar Decisions
 
Mobile Threat Protection: A Holistic Approach to Securing Mobile Data and Dev...
bySkycure
 

What's hot

PDF
Cisco Security Architecture
byCisco Canada
 
PDF
Partner Welcome Kit
byLuca Simonelli
 
PDF
Check Point vSEC for Microsoft Azure Webinar
byCheck Point Software Technologies
 
PPTX
Disrupting the Malware Kill Chain - What's New from Palo Alto Networks.
byScalar Decisions
 
PDF
Kaspersky Lab's Corporate Presentation - our Values, Business, Solutions
byKaspersky
 
PPTX
Check Point Solutions Portfolio- Detailed
byMoti Sagey מוטי שגיא
 
PDF
Moti Sagey CPX keynote _Are All security products created equal
byMoti Sagey מוטי שגיא
 
PDF
Presentation cisco cloud security strategy
byxKinAnx
 
PDF
Cisco's 2016 Annual Security report
byCisco Canada
 
PPTX
Building Up Network Security: An Introduction
byGlobal Knowledge Training
 
PDF
Kaspersky Lab new Enterprise Portfolio
byKaspersky
 
PDF
Advanced threat security - Cyber Security For The Real World
byCisco Canada
 
PDF
CPX 2016 Moti Sagey Security Vendor Landscape
byMoti Sagey מוטי שגיא
 
PDF
Infosec 2014: Risk Analytics: Using Your Data to Solve Security Challenges
bySkybox Security
 
PPTX
Tools for Evaluating Mobile Threat Defense Solutions
bySkycure
 
PDF
The Four Horsemen of Mobile Security
bySkycure
 
PPTX
Supply Chain Threats to the US Energy Sector
byKaspersky
 
PPTX
Building Up Network Security: Intrusion Prevention and Sourcefire
byGlobal Knowledge Training
 
PDF
The Motives, Means and Methods of Cyber-Adversaries
byKaspersky
 
PDF
Think Like a Hacker: Using Network Analytics and Attack Simulation to Find an...
bySkybox Security
 
Cisco Security Architecture
byCisco Canada
 
Partner Welcome Kit
byLuca Simonelli
 
Check Point vSEC for Microsoft Azure Webinar
byCheck Point Software Technologies
 
Disrupting the Malware Kill Chain - What's New from Palo Alto Networks.
byScalar Decisions
 
Kaspersky Lab's Corporate Presentation - our Values, Business, Solutions
byKaspersky
 
Check Point Solutions Portfolio- Detailed
byMoti Sagey מוטי שגיא
 
Moti Sagey CPX keynote _Are All security products created equal
byMoti Sagey מוטי שגיא
 
Presentation cisco cloud security strategy
byxKinAnx
 
Cisco's 2016 Annual Security report
byCisco Canada
 
Building Up Network Security: An Introduction
byGlobal Knowledge Training
 
Kaspersky Lab new Enterprise Portfolio
byKaspersky
 
Advanced threat security - Cyber Security For The Real World
byCisco Canada
 
CPX 2016 Moti Sagey Security Vendor Landscape
byMoti Sagey מוטי שגיא
 
Infosec 2014: Risk Analytics: Using Your Data to Solve Security Challenges
bySkybox Security
 
Tools for Evaluating Mobile Threat Defense Solutions
bySkycure
 
The Four Horsemen of Mobile Security
bySkycure
 
Supply Chain Threats to the US Energy Sector
byKaspersky
 
Building Up Network Security: Intrusion Prevention and Sourcefire
byGlobal Knowledge Training
 
The Motives, Means and Methods of Cyber-Adversaries
byKaspersky
 
Think Like a Hacker: Using Network Analytics and Attack Simulation to Find an...
bySkybox Security
 

Viewers also liked

PDF
Calgary security road show master deck final
byScalar Decisions
 
PDF
Optimize IT Infrastructure
byScalar Decisions
 
PPTX
Task Incident Readiness with Veris, Judy Nowak at TASK Toronto, April 27, 2...
bypatmisasi
 
PPT
Alfa Tech VestAsia 2012
byAlfa Tech VestAsia Pte Ltd
 
PDF
Scalar Security Roadshow - Toronto Stop
byScalar Decisions
 
PDF
Scalar Security Roadshow: Toronto Presentation - April 15, 2015
byScalar Decisions
 
PDF
Keys to success and security in the cloud
byScalar Decisions
 
PDF
Vancouver security road show master deck final
byScalar Decisions
 
PDF
Cloud Perspectives - Ottawa Seminar - Oct 6
byScalar Decisions
 
PDF
Scalar Decisions 2013 Overview
bypatmisasi
 
PDF
2016 Scalar Security Study Roadshow
byScalar Decisions
 
PDF
Scalar Technical session - Network Functions Virtualization leveraging Brocade
byScalar Decisions
 
PDF
Scalar customer case study: Rainmaker Entertainment
byScalar Decisions
 
PDF
Scalar Decisions: Emerging Trends and Technologies in Storage
bypatmisasi
 
PPTX
Heather Enlow & Chris Ingram - Cybersecurity Act of 2015 and Other Hot Privac...
bycentralohioissa
 
PPTX
12210943 pss7
byEricNg0401
 
PDF
Connect the Dots: Draw a Clear Picture of Social’s Impact on Business Results
bySpredfast
 
PDF
Design Thinking: Beyond the Bounds of Your Own Head (a phenomenological persp...
byThomas Wendt
 
PDF
1500 to 3000 sf proximity mtcc
byCommercialOfficeLeasing.com
 
PDF
4000 sf downtown dt
byCommercialOfficeLeasing.com
 
Calgary security road show master deck final
byScalar Decisions
 
Optimize IT Infrastructure
byScalar Decisions
 
Task Incident Readiness with Veris, Judy Nowak at TASK Toronto, April 27, 2...
bypatmisasi
 
Alfa Tech VestAsia 2012
byAlfa Tech VestAsia Pte Ltd
 
Scalar Security Roadshow - Toronto Stop
byScalar Decisions
 
Scalar Security Roadshow: Toronto Presentation - April 15, 2015
byScalar Decisions
 
Keys to success and security in the cloud
byScalar Decisions
 
Vancouver security road show master deck final
byScalar Decisions
 
Cloud Perspectives - Ottawa Seminar - Oct 6
byScalar Decisions
 
Scalar Decisions 2013 Overview
bypatmisasi
 
2016 Scalar Security Study Roadshow
byScalar Decisions
 
Scalar Technical session - Network Functions Virtualization leveraging Brocade
byScalar Decisions
 
Scalar customer case study: Rainmaker Entertainment
byScalar Decisions
 
Scalar Decisions: Emerging Trends and Technologies in Storage
bypatmisasi
 
Heather Enlow & Chris Ingram - Cybersecurity Act of 2015 and Other Hot Privac...
bycentralohioissa
 
12210943 pss7
byEricNg0401
 
Connect the Dots: Draw a Clear Picture of Social’s Impact on Business Results
bySpredfast
 
Design Thinking: Beyond the Bounds of Your Own Head (a phenomenological persp...
byThomas Wendt
 
1500 to 3000 sf proximity mtcc
byCommercialOfficeLeasing.com
 
4000 sf downtown dt
byCommercialOfficeLeasing.com
 

Similar to Scalar Security Roadshow - Vancouver Presentation

PDF
Proteja seus clientes - Gerenciamento dos Serviços de Segurança
byCisco do Brasil
 
PDF
The Next Generation Security
byCybera Inc.
 
PDF
Cisco Live Cancun PR Session
byFelipe Lamus
 
PDF
Cisco Content Security
byCisco Canada
 
PDF
Tomorrow Starts Here - Security Everywhere
byCisco Canada
 
PDF
Cisco Advanced Services
byCisco do Brasil
 
PDF
Cisco, Sourcefire and Lancope - Better Together
byLancope, Inc.
 
PPTX
1- Cybersecurity Threats, Vulnerabilities, and Attacks.pptx
bytarunprog01
 
PPTX
Two for Attack: Web and Email Content Protection
byCisco Canada
 
PDF
CONFidence2015: Real World Threat Hunting - Martin Nystrom
byPROIDEA
 
PDF
BGA SOME/SOC Etkinliği - Tehdit Odaklı Güvenlik Mimarisinde Sourcefire Yakla...
byBGA Cyber Security
 
PDF
8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security
byBGA Cyber Security
 
PPTX
apl5iy2ftxiwofbhsmxj-signature-584e2459f99b5370bda435f09b42cc84cc8c063b8cd454...
byChrysostomos Christofi
 
PDF
The Network as a Sensor, Cisco and Lancope
byCisco Enterprise Networks
 
PDF
During the Next Generation Network and Data Centre – Now and into the Future ...
byCisco Canada
 
PDF
Presentación - Cisco ASA with FirePOWER Services
byOscar Romano
 
PDF
Cisco ASA con fire power services
byFelipe Lamus
 
PDF
Using Your Network as a Sensor for Enhanced Visibility and Security
byLancope, Inc.
 
PPTX
Isday 2017 - Atelier Cisco
byInforsud Diffusion
 
PPTX
Idc security roadshow may2015 Adrian Aron
byDejan Jeremic
 
Proteja seus clientes - Gerenciamento dos Serviços de Segurança
byCisco do Brasil
 
The Next Generation Security
byCybera Inc.
 
Cisco Live Cancun PR Session
byFelipe Lamus
 
Cisco Content Security
byCisco Canada
 
Tomorrow Starts Here - Security Everywhere
byCisco Canada
 
Cisco Advanced Services
byCisco do Brasil
 
Cisco, Sourcefire and Lancope - Better Together
byLancope, Inc.
 
1- Cybersecurity Threats, Vulnerabilities, and Attacks.pptx
bytarunprog01
 
Two for Attack: Web and Email Content Protection
byCisco Canada
 
CONFidence2015: Real World Threat Hunting - Martin Nystrom
byPROIDEA
 
BGA SOME/SOC Etkinliği - Tehdit Odaklı Güvenlik Mimarisinde Sourcefire Yakla...
byBGA Cyber Security
 
8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security
byBGA Cyber Security
 
apl5iy2ftxiwofbhsmxj-signature-584e2459f99b5370bda435f09b42cc84cc8c063b8cd454...
byChrysostomos Christofi
 
The Network as a Sensor, Cisco and Lancope
byCisco Enterprise Networks
 
During the Next Generation Network and Data Centre – Now and into the Future ...
byCisco Canada
 
Presentación - Cisco ASA with FirePOWER Services
byOscar Romano
 
Cisco ASA con fire power services
byFelipe Lamus
 
Using Your Network as a Sensor for Enhanced Visibility and Security
byLancope, Inc.
 
Isday 2017 - Atelier Cisco
byInforsud Diffusion
 
Idc security roadshow may2015 Adrian Aron
byDejan Jeremic
 

More from Scalar Decisions

PDF
Scalar - a brief introduction
byScalar Decisions
 
PDF
Sheridan College: Scalar Customer Case Study
byScalar Decisions
 
PDF
Cloudforms Workshop
byScalar Decisions
 
PDF
Scalar Case Study: Strong Project Management Helps McMaster University Succes...
byScalar Decisions
 
PDF
The Cyber Security Readiness of Canadian Organizations
byScalar Decisions
 
PDF
XtremIO
byScalar Decisions
 
PDF
Where Technology Meets Medicine: SickKids High Performance Computing Data Centre
byScalar Decisions
 
PDF
Scalar Security Roadshow April 2015
byScalar Decisions
 
PDF
Scalar Customer Case Study: Toronto 2015 Pan Am/Parapan Am Games
byScalar Decisions
 
PDF
Scalar cloud study2016_slideshare
byScalar Decisions
 
PDF
The road to clustered data ontap.
byScalar Decisions
 
PDF
Web scale with-nutanix_rev
byScalar Decisions
 
PDF
2016 Scalar Security Study: The Cyber Security Readiness of Canadian Organiza...
byScalar Decisions
 
PDF
Résumé de l’étude sur la sécurité de Scalar 2016
byScalar Decisions
 
PDF
2017 Scalar Security Study Summary
byScalar Decisions
 
PDF
Digital Transformation
byScalar Decisions
 
PDF
Hyperconverged Infrastructure: The Leading Edge of Virtualization
byScalar Decisions
 
PDF
Executive Summary of the 2016 Scalar Security Study
byScalar Decisions
 
PPTX
La transformation numérique de Scalar
byScalar Decisions
 
PDF
Cyber Security trends and tactics for 2015
byScalar Decisions
 
Scalar - a brief introduction
byScalar Decisions
 
Sheridan College: Scalar Customer Case Study
byScalar Decisions
 
Cloudforms Workshop
byScalar Decisions
 
Scalar Case Study: Strong Project Management Helps McMaster University Succes...
byScalar Decisions
 
The Cyber Security Readiness of Canadian Organizations
byScalar Decisions
 
XtremIO
byScalar Decisions
 
Where Technology Meets Medicine: SickKids High Performance Computing Data Centre
byScalar Decisions
 
Scalar Security Roadshow April 2015
byScalar Decisions
 
Scalar Customer Case Study: Toronto 2015 Pan Am/Parapan Am Games
byScalar Decisions
 
Scalar cloud study2016_slideshare
byScalar Decisions
 
The road to clustered data ontap.
byScalar Decisions
 
Web scale with-nutanix_rev
byScalar Decisions
 
2016 Scalar Security Study: The Cyber Security Readiness of Canadian Organiza...
byScalar Decisions
 
Résumé de l’étude sur la sécurité de Scalar 2016
byScalar Decisions
 
2017 Scalar Security Study Summary
byScalar Decisions
 
Digital Transformation
byScalar Decisions
 
Hyperconverged Infrastructure: The Leading Edge of Virtualization
byScalar Decisions
 
Executive Summary of the 2016 Scalar Security Study
byScalar Decisions
 
La transformation numérique de Scalar
byScalar Decisions
 
Cyber Security trends and tactics for 2015
byScalar Decisions
 

Recently uploaded

PPTX
Cybersecurity Basics: Understanding Threats, Protection Methods, and Safe Dig...
byDhruvManiar3
 
PPT
HDTV and DTV Standards: The United States Opts for a Digital HDTV Standard
byJeffrey Hart
 
PDF
Techbrains Baku 2025 by GoUP - all speaker session
byHusseinMalikMammadli
 
PDF
Artificial Intelligence(AI) full Book.pdf
bydeyanimesh299
 
PPTX
Corporate AI Training to AI Enable a Company Workforce
byStélio Inácio
 
PDF
Azure Identity, Governance, and Monitoring solutions
byVICTOR MAESTRE RAMIREZ
 
PDF
How to Connect HP LaserJet MFP M234dwe to WiFi
byPrinter Tales
 
PDF
What is Voice User Interface (VUI) Definition & Examples.pdf
byDesign Studio UI UX
 
PDF
Navigating the Spectrum of Advanced AI – Agentic, Autonomous, and Autopoietic...
byScott M. Graffius
 
PDF
The map to conquer linear algebra for IT engineer
byakipii ogaoga
 
PDF
Top 10 API Automation Testing Tools: Features, Pros & Cons
byhenrycavill30521
 
PDF
Digital Marketing Trends in 2026: AI, Data, Content & Future Growth
byConacent Consulting
 
PDF
IAI-Unit1-notes useful.............................
bydinesh620610
 
PDF
IAC 500 Sensor - Humidity Measurement Device
byCS Instruments
 
PDF
Ai In Courts Ai in courts AI in court AI in court
byZainKarim7
 
PPTX
Spacecraft Guidance Quick Research Guide by Arthur Morgan
byArthur Morgan
 
PPTX
AI Bot Traffic Surge: Retail Fraud Threat for Age-Restricted Websites
byFTx Identity
 
PDF
कम्प्यूटर.pdf for all computer examination
bynm92169694
 
PDF
“Lessons from Yesterday's Tomorrowland” by Scott M. Graffius
byScott M. Graffius
 
PPTX
UNIT III TYPOLOGY OF CRIME AND CRIMINAL BEHAVIOUR (1).pptx
bybloodyhumanoid
 
Cybersecurity Basics: Understanding Threats, Protection Methods, and Safe Dig...
byDhruvManiar3
 
HDTV and DTV Standards: The United States Opts for a Digital HDTV Standard
byJeffrey Hart
 
Techbrains Baku 2025 by GoUP - all speaker session
byHusseinMalikMammadli
 
Artificial Intelligence(AI) full Book.pdf
bydeyanimesh299
 
Corporate AI Training to AI Enable a Company Workforce
byStélio Inácio
 
Azure Identity, Governance, and Monitoring solutions
byVICTOR MAESTRE RAMIREZ
 
How to Connect HP LaserJet MFP M234dwe to WiFi
byPrinter Tales
 
What is Voice User Interface (VUI) Definition & Examples.pdf
byDesign Studio UI UX
 
Navigating the Spectrum of Advanced AI – Agentic, Autonomous, and Autopoietic...
byScott M. Graffius
 
The map to conquer linear algebra for IT engineer
byakipii ogaoga
 
Top 10 API Automation Testing Tools: Features, Pros & Cons
byhenrycavill30521
 
Digital Marketing Trends in 2026: AI, Data, Content & Future Growth
byConacent Consulting
 
IAI-Unit1-notes useful.............................
bydinesh620610
 
IAC 500 Sensor - Humidity Measurement Device
byCS Instruments
 
Ai In Courts Ai in courts AI in court AI in court
byZainKarim7
 
Spacecraft Guidance Quick Research Guide by Arthur Morgan
byArthur Morgan
 
AI Bot Traffic Surge: Retail Fraud Threat for Age-Restricted Websites
byFTx Identity
 
कम्प्यूटर.pdf for all computer examination
bynm92169694
 
“Lessons from Yesterday's Tomorrowland” by Scott M. Graffius
byScott M. Graffius
 
UNIT III TYPOLOGY OF CRIME AND CRIMINAL BEHAVIOUR (1).pptx
bybloodyhumanoid
 

Scalar Security Roadshow - Vancouver Presentation

  • 1.
    Scalar Security Roadshow © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 1
  • 2.
    Purpose of today’ssession: Provide insights on how Scalar and our partners address today’s complex security challenges © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 2
  • 3.
    Gartner report highlights 3 • Security spend as % of IT budgets increased • Strong correlation between Security budget and maturity • Emphasis on network, applications and endpoint • Insufficient investment in people and process © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014
  • 4.
    Scalar – briefoverview © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014 4
  • 5.
    10 Years ©2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 5
  • 6.
    90 © 2014Scalar Decisions Inc. Not for distribution outside of intended audience. 6
  • 7.
    100% Vancouver Calgary Montreal Ottawa Toronto London © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 7
  • 8.
    54% © 2014Scalar Decisions Inc. Not for distribution outside of intended audience. 8
  • 9.
    #1 #51 ICT Security Company #15 Top 250 ICT Companies © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 9
  • 10.
    An integrator ofemerging technologies. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 10
  • 11.
    Top tier technicaltalent. • Engineers average 15 years of experience • World-class experts from some of the leading organizations in the industry • Dedicated teams: PMO, finance, sales and operations • Canadian Authorized Training Centres • We employ and retain top talent © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 11
  • 12.
    Top awards. •Brocade Partner of the Year ~ Innovation • Cisco Partner of the Year ~ Data Centre & Virtualization • NetApp Partner of the Year ~ Central Canada • VMware Global Emerging Products Partner of the Year • F5 VAR Partner of the Year ~ North America • Palo Alto Networks Rookie of the Year © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 12
  • 13.
    Our Focus •Protection of Data and Systems • High Performance Computing • Flexible Solutions © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 13
  • 14.
    Our security partners © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014 14
  • 15.
    Partners here today © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014 15
  • 16.
    SECURITY © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16
  • 17.
    FirePOWER Rob Bleeker Security Consulting Systems Engineer CCIE# 29033, [CCN|I|D|P], SFCE, CEH SECURITY
  • 18.
    SECURITY Agenda: •New Security Model and Global Intelligence • The POWER in FirePOWER • FirePOWER Appliance • ASA with FirePOWER Services © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18
  • 19.
    The New SecurityModel BEFORE Discover Enforce Harden AFTER Scope Contain Remediate Attack Continuum DURING Detect Block Defend Network Endpoint Mobile Virtual Cloud Point in Time Continuous © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19
  • 20.
    Cyber Attack Chain Recon Weaponization Deliver Exploit Install CnC Actions BEFORE Discover Enforce Harden AFTER Scope Contain Remediate During Detect Block Prevent NGIPS Web Security Email Security Visibility and Context Firewall NGFW VPN UTM NAC + Identity Services Advanced Malware Protection Network Behavior Analysis © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20
  • 21.
    CiscoSecurity Intelligence Operation(SIO) More Than $100 24 Hours Daily More Than 40 Million OPERATIONS SPENT IN DYNAMIC RESEARCH AND DEVELOPMENT 0010 010 10010111001 10 100111 010 000100101 110011 01100111010000110000111000111010011101 Cisco1100001110001110 ® SIO 1001 1101 1110011 0110011 101000 0110 00 0111000 111010011 101 1100001 11000 111010011101 0010 010 10010111001 10 100111 010 000100101 110011 01100111010000110000111000111010011101 1100001110001110 1001 1101 1110011 0110011 101000 0110 00 0111000 111010011 101 1100001 11000 111010011101 Email Devices WWW Web LANGUAGES IPS Networks Endpoints More Than 80 PH.D, CCIE, CISSP, MSCE Cloud IPS AnyConnect® ESA ASA WWW WSA Information More Than 800 ENGINEERS, TECHNICIANS, AND RESEARCHERS Actions Visibility Control 1.6 Million GLOBAL SENSORS 100 TB DATA RECEIVED PER DAY 40% WORLDWIDE EMAIL TRAFFIC 13 Billion WEB REQUESTS More Than 150 Million DEPLOYED ENDPOINTS 3 to 5 MINUTE UPDATES More Than 200 PARAMETERS TRACKED More Than 5500 IPS SIGNATURES PRODUCED More Than 70 PUBLICATIONS PRODUCED More Than 8 Million RULES PER DAY © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21
  • 22.
    Collective Security Intelligence Malware Protection IPS Rules Reputation Feeds Vulnerability Database Updates Sourcefire AEGIS™ Program Private and Public Threat Feeds Sandnets Sourcefire VRT® (Vulnerability Research Team) Sandboxing Machine Learning Infrastructure FireAMP™ Community Honeypots File Samples Big Data (>380,000 per Day) Advanced Microsoft and Industry Disclosures SPARK Program Snort and ClamAV Open Source Communities © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22
  • 23.
    The POWER inFirePOWER SECURITY © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23
  • 24.
    About Sourcefire Mission:To be the leading provider of intelligent cybersecurity solutions for the enterprise. • Founded in 2001 by Snort Creator, Martin Roesch, CTO • Headquarters: Columbia, MD • Focus on enterprise and government customers • Global Security Alliance ecosystem • NASDAQ: FIRE Leading in NSS for NGFW, NGIPS, BDS (Advanced Malware Protection) © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24
  • 25.
    Integrated Threat DefenseAcross the Attack Continuum BEFORE Control Enforce Harden Attack Continuum DURING AFTER Detect Block Defend Scope Contain Remediate Firewall / VPN Granular App Control Modern Threat Control Advanced Malware Protection Retrospective Security IoCs / Incident Response NGIPS Security Intelligence Web Security Visibility and Automation © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25
  • 26.
    FireSIGHT™ Management Center: Full Stack Visibility CATEGORIES EXAMPLES FirePOWER Services TYPICAL IPS TYPICAL NGFW Threats Attacks, Anomalies ✔ ✔ ✔ Users AD, LDAP, POP3 ✔ ✗ ✔ Web Applications Facebook Chat, Ebay ✔ ✗ ✔ Application Protocols HTTP, SMTP, SSH ✔ ✗ ✔ File Transfers PDF, Office, EXE, JAR ✔ ✗ ✔ Malware Conficker, Flame ✔ ✗ ✗ Command & Control Servers C&C Security Intelligence ✔ ✗ ✗ Client Applications Firefox, IE6, BitTorrent ✔ ✗ ✗ Network Servers Apache 2.3.1, IIS4 ✔ ✗ ✗ Operating Systems Windows, Linux ✔ ✗ ✗ Routers & Switches Cisco, Nortel, Wireless ✔ ✗ ✗ Mobile Devices iPhone, Android, Jail ✔ ✗ ✗ Printers HP, Xerox, Canon ✔ ✗ ✗ VoIP Phones Cisco phones ✔ ✗ ✗ Virtual Machines VMware, Xen, RHEV ✔ ✗ ✗ Contextual Information Superiority Awareness © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26
  • 27.
    Impact Assessment IMPACT Correlates all intrusion events to an impact of the attack against the target FLAG ADMINISTRATOR ACTION WHY Act Immediately, Vulnerable Event corresponds to vulnerability mapped to host Investigate, Potentially Vulnerable Relevant port open or protocol in use, but no vuln mapped Good to Know, Currently Not Vulnerable Relevant port not open or protocol not in use Good to Know, Unknown Target Monitored network, but unknown host Good to Know, Unknown Network Unmonitored network © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 27
  • 28.
    Cisco FireSIGHT SimplifiesOperations • Impact Assessment and Recommended Rules Automate Routine Tasks © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28
  • 29.
    Visibility and Context © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 29
  • 30.
    Visibility and Context File Sent File Received File Executed File Moved File Quarantined © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 30
  • 31.
    Indications of Compromise(IoCs) IPS Events Malware Backdoors CnC Connections Exploit Kits Admin Privilege Escalations Web App Attacks SI Events Connections to Known CnC IPs Malware Events Malware Detections Malware Executions Office/PDF/Java Compromises Dropper Infections © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 31
  • 32.
    FirePOWER Services: ApplicationControl • Control access for applications, users and devices • “Employees may view Facebook, but only Marketing may post to it” • “No one may use peer-to-peer file sharing apps” Over 3,000 apps, devices, and more! © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 32
  • 33.
    …Yet Another OpenSource Success Story • OpenAppID • Open source application detection and control Application-focused detection language tied to Snort engine Enhances coverage and efficacy and accelerates development of application detectors Empowers the community to share detectors for greater protection Already over 1300 OpenAppID Detectors Ties into a Snort Pre-processor for maximum performance and integration Detection of applications on the network Reporting on the usage statistics of apps (traffic) Blocking of applications by policy Extensions to the Snort rule language to enable application specification Reporting of an “App Name” along with Security events (e.g. IPS/AMP) © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 33
  • 34.
    FirePOWER Services: URLFiltering • Block non-business-related sites by category • Based on user and user group © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34
  • 35.
    FirePOWER Services: AdvancedMalware Malware Alert! Available In Defense Center 1) File Capture Collective Security Intelligence Sandbox 3) Send to Sandbox 2) File Storage 4) Execution Report Network Traffic © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 35
  • 36.
    Reduced Cost andComplexity • Multilayered protection in a single device • Highly scalable for branch, internet edge, and data centers • Automates security tasks oImpact assessment oPolicy tuning oUser identification • Integrate transparently with third-party security solutions through eStreamer API © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 36
  • 37.
    FirePOWER Appliances SECURITY © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37
  • 38.
    Setting the NewStandard for Advanced Threat Protection Sourcefire FirePOWER™ • Industry-best Intrusion Prevention • Real-time Contextual Awareness • Full Stack Visibility • Intelligent Security Automation with FireSIGHT™ • Unparalleled Performance and Scalability • Easily add Application Control, URL Filtering and Advanced Malware Protection with optional subscription licenses © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 38
  • 39.
    Platforms and Placesin the Network IPS Performance and Scalability FirePOWER 7100 Series 500 Mbps – 1 Gbps FirePOWER 7120/7125/8120 1 Gbps - 2 Gbps FirePOWER 8100/8200 2 Gbps - 10 Gbps FirePOWER 8200 Series 10 Gbps – 40 Gbps FirePOWER 7000 Series 50 Mbps – 250 Mbps FirePOWER 8300 Series 15 Gbps – 60 Gbps SOHO Branch Office Internet Edge Campus Data Center © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 39
  • 40.
    FirePOWER Feature Summary NGIPS • IPS Detection and Prevention • Security Updates • Reports, Alerts, and Dashboards • Centralized Policy Management • Custom IPS Rule Creation • Automated Impact Assessment • Automated Tuning • FireSIGHT Network & User Intelligence • IT Policy Compliance Whitelists • File Type Determination • Network Behavior Analysis You can ADD additional license • Application Control • User and User Group Control • Stateful Firewall Inspection Switching and Routing • Network Address Translation • URL Filtering • File Blocking • Advanced Malware Protection Virtual Appliances for VMWare and XEN
  • 41.
    ASA with FirePOWERServices SECURITY © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 41
  • 42.
    FirePOWER Services forASA: Components FirePOWER Services Blade ASA 5585-X • Models: ASA 5585-X-10, ASA 5585-X- 20, ASA 5585-X-40, ASA 5585-X-60 • New FirePOWER Services Hardware Module Required • Licenses and Subscriptions • Models: ASA 5512-X, 5515-X, 5525-X, 5545-X, and 5555-X • SSD Drive Required • FirePOWER Services Software Module • Licenses and Subscriptions © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 42
  • 43.
    Superior Multilayered Protection • World’s most widely deployed, enterprise-class ASA stateful firewall • Granular Application Visibility and Control (AVC) • Industry-leading FirePOWER Next-Generation IPS (NGIPS) • Reputation- and category-based URL filtering • Advanced malware protection Cisco Collective Security Intelligence Enabled FireSIGHT Analytics & Automation CISCO ASA WWW URL Filtering (subscription) Identity-Policy Control & VPN Advanced Malware Protection (subscription) Intrusion Prevention (subscription) Application Visibility &Control Clustering & High Availability Network Firewall Routing | Switching Built-in Network Profiling © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 43
  • 44.
    ASA and FirePOWERFeatures • IPS Detection and Prevention • Security Updates • Reports, Alerts, and Dashboards • Centralized Policy Management • Custom IPS Rule Creation • Automated Impact Assessment • Automated Tuning • FireSIGHT Network & User Intelligence • IT Policy Compliance Whitelists • File Type Determination • Network Behavior Analysis • Application Control • User and User Group Control • Stateful Firewall Inspection Switching and Routing • Network Address Translation • URL Filtering • File Blocking • Advanced Malware Protection • Identity-Based Firewall for enhanced user ID awareness. • Highly Secure remote access (IPSEC and SSL) • Proactive, near-real-time protection against Internet threats • Integrates with other essential network security tech • Supports Cisco TrustSec security group tags (SGTs) and • Extensive stateful inspection engine, • Site-to-site VPN, NAT, IPv6, • Dynamic Routing (including BGP) • HA, Clustering • Protection from botnets • Delivers high availability for high-resiliency application • Change of Authorization (CoA) © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 44
  • 45.
  • 46.
    The Perimeter isDead, Long Live the Perimeter Buu Lam Field Systems Engineer
  • 47.
    What is The Perimeter?
  • 48.
    pe·rim·e·ter 1.the continuousline forming the boundary of a closed geometric figure. "the perimeter of a rectangle" synonyms: circumference, outside, outer edge "the perimeter of a circle" the outermost parts or boundary of an area or object. "the perimeter of the garden" synonyms: boundary, border, limits, bounds, confines, edge, margin, fringe(s), periphery, borderline, verge; More a defended boundary of a military position or base. In Networking we call it…DMZ
  • 49.
  • 50.
    Defense in depth The principle of defense-in-depth is that layered security mechanisms increase security of the system as a whole. If an attack causes one security mechanism to fail, other mechanisms may still provide the necessary security to protect the system……Implementing a defense-in-depth strategy can add to the complexity of an application, which runs counter to the “simplicity” principle often practiced in security. That is, one could argue that adding new protection functionality adds additional complexity that might bring new risks with it. https://www.owasp.org/index.php/Defense_in_depth
  • 51.
  • 52.
    Perimeter Security Technologies A long time ago… and then… present day… and now with F5! Firewalls started out as proxies Stateless filters accelerated firewalls, but weakened security Stateful firewalls added security with deep inspection, but still fall short of proxies F5 brings full proxy back to firewalls: highest security matched by a high-scale and high-performance architecture F5 Agility 2014 52
  • 53.
    Protecting against Threatsis challenging Webification of apps Device proliferation 71% of internet experts predict most people will do work via web or mobile by 2020. 95%of workers use at least one personal device for work. 130 millionenterprises will use mobile apps by 2014 Evolving security threats Shifting perimeter 58%of all e-theft tied to activist groups. 81%of breaches involved hacking 80%of new apps will target the cloud. 72%IT leaders have or will move applications to the cloud. F5 Agility 2014 53
  • 54.
    Evolving Security ThreatLandscape F5 Agility 2014 54
  • 55.
    More sophisticated attacksare multi-layer Application SSL DNS Network F5 Agility 2014 55
  • 56.
    Its all aboutthe Application.
  • 57.
    BIG-IP Application SecurityManager BIG-IP ® ASM™ protects the applications your business relies on most and scales to meet changing demands. Multiple deployment options Visibility and analysis Comprehensive protections • Standalone or ADC add-on • Appliance or Virtual edition • Manual or automatic policy building • 3rd party DAST integration • Visibility and analysis • High speed customizable syslog • Granular attack details • Expert attack tracking and profiling • Policy & compliance reporting • Integrates with SIEM software • Full HTTP/S request logging • Granular rules on every HTTP element • Client side parameter manipulation protection • Response checks for error & data leakage • AV integrations F5 Agility 2014 57
  • 58.
    Comprehensive Protections BIG-IPASM extends protection to more than application vulnerabilities L7 DDOS Web Scraping Web bot identification XML filtering, validation & mitigation XML Firewall Geolocation blocking ICAP anti-virus Integration ASM F5 Agility 2014 58
  • 59.
    Network Threats Application Threats 90% of security investment focused here Yet 75% of attacks are focused here Attack Vectors TCP SYN Flood TCP Conn Flood DNS Flood HTTP GET Flood Attack Vectors HTTP Slow Loris DNS Cache Poison SQL Injection Cross Site Scripting F5 Agility 2014 59
  • 60.
    Unique full-proxy architecture WAF WAF Slowloris atXtaScSk iRule leakage iRule iRule HTTP SSL TCP HTTP SSL TCP iRule iRule iRule SSL renegotiation SYN flood ICMP flood Data Network Firewall F5 Agility 2014 60
  • 61.
  • 62.
    Who’s Requesting Access? Employees Partner Customer Administrator Manage access based on identity IT challenged to: • Control access based on user-type and role • Unify access to all applications (mobile, VDI, Web, client-server, SaaS) • Provide fast authentication and SSO • Audit and report access and application metrics F5 Agility 2014 62
  • 63.
    Security at theCritical Point in the Network Physical Virtual Cloud Storage Total Application Delivery Networking Services Clients Remote access SSL VPN APP firewall F5 Agility 2014 63
  • 64.
    BIG-IP APM UseCases Secure Web Gateway Accelerated Remote Access Internet Apps Enterprise Data & Apps Federation Cloud, SaaS, and Partner Apps Internet App Access Management BIG-IP APM OAM VDI Exchange Sharepoint F5 Agility 2014 64
  • 65.
    Which Threat mitigationto use? Content Delivery Network Carrier Service Provider Cloud-based DDoS Service Cloud/Hosted Service Network firewall with SSL inspection Web Application Firewall On-premise DDoS solution Intrusion Detection/Prevention On-Premise Defense F5 Agility 2014 65
  • 66.
  • 67.
    Full Proxy Security Client / Server Web application Application Session Network Physical Application health monitoring and performance anomaly detection HTTP proxy, HTTP DDoS and application security SSL inspection and SSL DDoS mitigation L4 Firewall: Full stateful policy enforcement and TCP DDoS mitigation Client / Server Web application Application Session Network Physical F5 Agility 2014 67
  • 68.
    F5 Provides CompleteVisibility and Control Across Applications and Users DNS Web Access Intelligent Services Platform Users Securing access to applications from anywhere Resources Protecting your applications regardless of where they live Dynamic Threat Defense DDoS Protection Protocol Security Network Firewall TMOS F5 Agility 2014 68
  • 69.
    PROTECTING THE DATACENTER Use case Load Balancer Firewall/VPN • Consolidation of firewall, app security, traffic management Network DDoS DNS Security Balancer & SSL • Protection for data centers and application servers Application DDoS Web Application Firewall Load • High scale for the most common inbound protocols Before f5 with f5 Web Access Management F5 Agility 2014 69
  • 70.
    F5 Bringing deepapplication fluency to Perimeter security One platform SSL inspection Traffic management DNS security Access control Application security Network firewall EAL2+ EAL4+ (in process) DDoS mitigation F5 Agility 2014 70
  • 71.
    How do Iimplement perimeter Security with F5?
  • 72.
    Reference Architectures DDoS Protection S/Gi Network Simplificatio n Security for Service Providers Application Services LTE Roaming Migration to Cloud DevOps Secure Mobility DNS Cloud Federation Cloud Bursting F5 Agility 2014 72
  • 73.
    Application (7) Presentation (6) Increasing difficulty of attack detection DDoS MITIGATION Physical (1) Data Link (2) Network (3) Transport (4) Session (5) Network attacks Session attacks Application attacks OWASP Top 10 (SQL Injection, XSS, CSRF, etc.), Slowloris, Slow Post, HashDos, GET Floods SYN Flood, Connection Flood, UDP Flood, Push and ACK Floods, Teardrop, ICMP Floods, Ping Floods and Smurf Attacks BIG-IP ASM Positive and negative policy reinforcement, iRules, full proxy for HTTP, server performance anomaly detection DNS UDP Floods, DNS Query Floods, DNS NXDOMAIN Floods, SSL Floods, SSL Renegotiation BIG-IP LTM and GTM High-scale performance, DNS Express, SSL termination, iRules, SSL renegotiation validation BIG-IP AFM SynCheck, default-deny posture, high-capacity connection table, full-proxy traffic visibility, rate-limiting, strict TCP forwarding. Packet Velocity Accelerator (PVA) is a purpose-built, customized hardware solution that increases scale by an order of magnitude above software-only solutions. OSI stack F5 mitigation technologies OSI stack F5 mitigation technologies F5 Agility 2014 73
  • 75.
    ® Solve theEndpoint Security Challenge with Isolation, not Detection Chris Cram Security Solutions Architect © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 75
  • 76.
    76 Agenda TheSecurity Landscape Bromium Overview Use Cases and Benefits Summary and Next Steps © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 77.
    Up 294% $30BNo! Security Spending — ’05–’14 Are breaches going down? Up 390% Malware/Breaches — ’05–’14 Source: Gartner, Idtheftcenter, $30B is a Gartner figure for 2014 3 The IT Security Paradox © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 78.
    “Anti-virus is dead.It catches only 45% of cyber-attacks.” Brian Dye SVP, Symantec 71% of all breaches are from the endpoint! The Endpoint Problem  Polymorphic  Targeted  … Pattern Matching  Only known  Many ???  Costly remediation Advanced Threats Ineffective Detection 5 The Problem © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 79.
     Polymorphic Targeted  Zero Day Pattern-Matching  Only known  Many false positives  Costly remediation 71% of all breaches start on the endpoint! Advanced Threats Ineffective Detection The Endpoint Problem Source: Verizon Data Breach Report 4 The Problem © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 80.
    Advanced Attacks EvadeLegacy Defenses Threats 80 Network Detection Based Firewall IPS Web & Email Gateways Endpoint Detection Based PC Firewall PC Anti-virus © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 81.
    81 $25B $20B $15B $10B $5B $0 Citigroup Washington Post Restaurant Depot Scribd Ubuntu Bethesda Game Studios Michael’s Stores Virginia LexisNexis Sega University of Wisconsin – Milwaukee Sony Pictures Betfair Seacoast Radiology, PA Three Iranian banks KT Corp. Ohio Medicaid State Puerto Rico Department of Health Sony Online EntertainmentSouthern Sony PSN California Medical-Legal Consultants San Francisco Public Utilities Commission Writerspace .com Network Solutions University of California Berkeley Prescription Monitoring Program Heartland University RockYou! Drupal Yahoo Japan South Africa Police Living Social Central Hudson Gas & Electric Nintendo Washington State court system Evernote RBS Worldpay Auction. com.kr Virginia Dept. of Health Ameritrade Hannaford Brothers Supermarket Monster. Processors International CheckFree Corporation TD com Chain TK/ TJ Maxx Yahoo Blizzard Data KDDI Gawker .com Global Payments US Federal Reserve Bank of Clevelan d Ankle & Foot Center of Tampa Bay, AT&T Ubisoft Inc. Significant Data Breaches Source: Idtheftcenter.org Updated 6/16/14 | WW Security Spend Source: Gartner, Red bubbles illustrative only to depict the 71% Application Whitelisting Host Intrusion Prevention Endpoint Sandboxing Host Web Filtering Cloud-based AV detection Network Sandboxing Target AOL Cardsystems Solutions Inc. AOL NASDAQ Twitter Sutherland Healthcare Neiman Marcus Ebay Aaron Brothers Mac Rumour s .Com Neiman Marcus Home Depot America 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 n Express PF Changs Paytime Adobe Snapch at 2013 614 reported breaches 91,982,172 records Recent Security Timeline © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 82.
    82 $25B $20B $15B $10B $5B $0 Application Whitelisting Host Intrusion Prevention Endpoint Sandboxing Host Web Filtering Cloud-based AV detection Network Sandboxing Breaches Starting from the Endpoint 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 Significant Data Breaches Source: Idtheftcenter.org Updated 6/16/14 | WW Security Spend Source: Gartner, Red bubbles illustrative only to depict the 71% 2013 614 reported breaches 91,982,172 records Recent Security Timeline © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 83.
    Bromium—Pioneer and Innovator Redefining security with isolation technology Transforming the legacy security model Global, top investors, leaders of Xen Top tier customers across every vertical 8 © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 84.
    84 Core Technology Hardware isolates each untrusted Windows task Lightweight, fast, hidden, with an unchanged native UX Microvisor Based on Xen with a small, secure code base Industry-standard desktop, laptop hardware Hardware Virtualization Hardware Security Features © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 85.
    Isolate all enduser tasks – browsing, opening emails, files… Utilize micro-virtualization and the CPU to hardware isolate Across major threat vectors— Web, email, USB, shares… Seamless user experience on standard PCs 85 How Bromium Solves The Problem © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 86.
    Bromium vSentry OS Anti-virus, sandbox and other security tools OS Kernel  Today’s signature and behavioral techniques miss many attacks  They almost always leave endpoints corrupted, requiring re-imaging Hardware-isolated Micro VMs  All user tasks and malware are isolated in a super-efficient micro-VM  All micro-VMs destroyed, elimi-nating all traces of malware with them Hardware Applications tab tab OS Hardware Traditional Endpoint Security O S O S O S O S 10 Different from Traditional Security © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 87.
    LAVA Understanding theKill Chain WHO Is the Target WHERE Is the Attacker WHAT WHAT Is the Goal WHAT Is the Technique Is the Intent 24 © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 88.
    Java Legacy AppSupport Off Net Patching Laptop Users High Value Targets Threat Intelligence Secure Browsing 12 Use Cases © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 89.
    89 Why CustomersDeploy Bromium Defeat Attacks  Eliminate compromises on the endpoint  Deliver protection in the office or on the road Streamline IT  Reduce operational costs  Dramatically increase IT productivity Empower End Users  Remove the burden of security from users  Enable users to click on anything…anywhere © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 90.
    Summary The attacklandscape has fundamentally changed; perimeter evaporating in the cloud and mobile era Current ‘detection’ defenses are ineffective; endpoint is the weakest link Bromium is redefining endpoint security with micro-virtualization Enormous benefits in defeating attacks, streamlining IT and empowering users 90 © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience.
  • 91.
    Questions? © 2014Scalar Decisions Inc. Not for distribution outside of intended audience. 91
  • 92.
    Beyond Compliance RobStonehouse – Chief Security Architect © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 92
  • 93.
    The Rush ToCompliance “We have to be compliant!” © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 93
  • 94.
    What Do WeKnow? • The Internet wants all your information • Law is not a deterrent • Little risk for huge gains • Patience = Success • Users will still click on anything …It is going to get worse © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 94
  • 95.
    20+ Years ofMonitoring What have we seen? - Sophisticated malware - Teams of attackers - Persistence & Purpose © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 95
  • 96.
    The Problem Technology • New strategies • Hard to realize the value InfoSec is Expensive • Resource issues © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 96
  • 97.
    What is TheAnswer? Visibility © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 97
  • 98.
    Get The HelpYou Need You Can No Longer Do This Alone © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 98
  • 99.
    Recap • Reducecomplexity – simplify • Apply security at the infrastructure, applications and endpoint • Augment technology with people and process • Spend on security vs. compliance • Gain visibility through effective security operations © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 99
  • 100.
    Managed Security Services Jamie Hari – Product Manager, Infrastructure & Security © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 100
  • 101.
    Scalar discovered whatthey overlooked. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 101
  • 102.
    Changing Tactics ©2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 102
  • 103.
    The way youlook at security needs to change. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014 103
  • 104.
    SIEM © 2014Scalar Decisions Inc. Not for distribution outside of intended audience. 104
  • 105.
    Improved Intelligence Scalarhas the tools and experience to manage security The SIEM is the heart and brain of the SOC. It moves data around in a quickly complex and technical analyses landscape. it with continually updated intelligence. Users Servers End Points Firewalls IPS VS AV/AM/AS SIEM SOC Tools Scalar SOC © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 105
  • 106.
    What is SIEM? A solution which gathers, analyzes, and presents security information. • Log Management • Security Event Correlation and Analysis • Security Alerting & Reporting © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 106
  • 107.
    Reporting Quickly IdentifyPatterns of Activity, Traffic, and Attacks © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 107
  • 108.
    Managed SIEM &Incident Response Real-time security event monitoring and intelligent incident response • 24 x 7 Security Alert & System Availability Monitoring • Security Incident Analysis & Response • Infrastructure Incident, Change, Patch, and Configuration Management © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 108
  • 109.
    What should Ilook for in a provider? • Breadth and Depth of Technical Capability • Flexibility in Deployment, Reporting, and Engagement Options • Experience with Customers in Diverse Industries • A Partner Model © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 109
  • 110.
    Getting Started ©2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 110
  • 111.
    Proof of Value 4 Week Trial • Dashboard for Real-time Data • Weekly Security Report • Detailed Final Summary Report • Seamless Continuation into Full Service © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 111
  • 112.
    You decide howwe fit © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. September 25, 2014 112
  • 113.
    Questions? © 2014Scalar Decisions Inc. Not for distribution outside of intended audience. 113
  • 114.
    Putting our expertiseinto practice. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 114
  • 115.
    Integrating, securing andmanaging systems for the most technologically advanced games ever. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 115
  • 116.
    Building a centreof excellence that delivers a compute cluster to a global user community. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 116
  • 117.
    2 banks. 5months. 1 great enterprise application. Mobile Wallet © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 117
  • 118.
    © 2014 ScalarDecisions Inc. Not for distribution outside of intended audience. 118
  • 119.
    What’s next? Lookingfor more info on security? Rob Stonehouse, Scalar’s Chief Security Architect, discusses security beyond compliance on our blog here. © 2014 Scalar Decisions Inc. Not for distribution outside of intended audience. 119

Editor's Notes

  • #32 Indications of Compromise, or IoCs, are “tags” on a host that indicate that an event with a likely host infection has occurred. IOCs are tallied against each host. [NEED ADDITIONAL SPEAKER NOTES?]
  • #78 Let me start by saying that security is broken. And we are living in the great IT security paradox. What do I mean by that? Let’s begin by taking look at the larger picture, the security industry as a whole. The spend on security each year is over $30 billion dollars ($20B on network, $10B on endpoint). This is an increase of almost 300% over the last decade, a staggering amount. One would think that with this significant level of spend breaches would be going down as organizations would have figured out the optimal defense in depth strategy to counter cyber-attacks. Remember, we have added layers on top of layers over the years. In fact, this is not case. Breaches have actually gone up dramatically and most of this growth is in the last 3 years. Why is that? Deeper look (optional) – Further, if you look at the spend buckets according to IDC, most organizations have not fundamentally changed the allocation of spend. They are spending roughly the same amount in each security segment, such as firewalls or IPS or AV, as they spent almost 10 years ago. How is this possible when the cybercriminals have completely ratcheted up their game. This is another major contributing factor. But let’s take a deeper look at the real issue.
  • #106 BROAD DIVERSE TECHNOLOGIES IN ANY ENVIRONMENT EACH WITH THEIR OWN MONITORING, REPORTING, AND ADMINISTRATION INTERFACES SIEM BRINGS THEM TOGETHER INTO A SINGLE PANE OF GLASS