Security: more important than ever - Sophos Day Belux 2014
•Download as PPTX, PDF•
0 likes•1,649 views
Security: more important than ever! At the Sophos Day Belux 2014, Jorn Lutters took the time to have a look back at 2014 and showed the audience what we've been dealing with in IT-security world the past year. Looking to 2015, Sophos is excited to contribute to a safer world!
Recommended
Recommended
More Related Content
What's hot
What's hot (19)
Viewers also liked
Viewers also liked (15)
Similar to Security: more important than ever - Sophos Day Belux 2014
Similar to Security: more important than ever - Sophos Day Belux 2014 (20)
More from Sophos Benelux
More from Sophos Benelux (12)
Recently uploaded
Recently uploaded (20)
Security: more important than ever - Sophos Day Belux 2014
- 1. 1 Security: More important than ever. Analyzing and rethinking security Jorn Lutters, Pre-Sales Engineer for Sophos
- 2. 2 Threat trends and 2014 notable cases
- 3. 3
- 4. 4
- 5. 5
- 6. 6
- 7. 7
- 8. 8
- 9. 9
- 10. 10
- 11. 11
- 12. 12 42.8 million Security incidents detected per year. © PWC Information Security Survey 2015 117,339 incoming attacks per day, every day – roughly 1,5 per second
- 13. 13 Malvertisements Legitimate websites serving malware 30,000 Infections per hour – just for Yahoo alone. That’s roughly 8 computers per second 225% Increase in popularity in 2014 - currently 1 in 5 add providers are compromised
- 14. 14 Professionalism, Crimeware “Monetization”: Bulk of Threats Are Automated, Coordinated & Professional Welcome to the Age of Personalized Malware 50% 75% 88% 50% of our detections are based on only 19 malware identities. 75% of unique pieces of malware are targeted attacks (i.e., are not seen beyond the organization targeted). 88% of malware found in fewer than 10 other organizations.
- 15. 15 Let’s talk about security
- 16. 16
- 17. 17 Problem 1: Complexity
- 18. 18
- 19. 19
- 20. 20 Problem 2: Security overlap (Compatibility issues)
- 21. 21
- 22. 22
- 23. 23 Problem 3: Mind the gap
- 24. 24
- 25. 25 Solution A Solution B Solution C You are here
- 26. 26 Problem 4: Segmentation
- 27. 27
- 28. 28
- 29. 29 Problem 5: Defense in depth
- 30. 30
- 31. 31
- 32. 32
- 33. 33
- 34. 34 Sophos Simple Security
- 35. 35 0 1 3 8 50 60.0 50.0 40.0 30.0 20.0 10.0 .0 100-499 Employees 500-999 Employees 1000-4,999 Employees 5000-19,999 Employees 20,000+ Employees Sophos’ core customers Challenged by Complexity Limited by Resources
- 36. 36 Corporate Owned and BYOD Protect My Data Go Wireless Users Are Everywhere What About Securing My Servers? Transition to the Cloud Can’t Control Users via Brute Force Downtime Unacceptable Regulations & Compliance “Console Proliferation” & “Agent Pollution” Help Desk Queries
- 37. 37 Corporate Owned and BYOD Protect My Data Go Wireless Users Are Everywhere What About Securing My Servers? Transition to the Cloud Can’t Control Users via Brute Force Downtime Unacceptable Regulations & Compliance “Console Proliferation” & “Agent Pollution” Help Desk Queries New Attack Surfaces (Android, iOS) 250,000 New Threats Will Appear Today Polymorphic Threats Affect Everyone Macs Are No Longer Immune Not Just A “Big Company” Problem IT Systems Are The Lifeblood for Any Size Org
- 38. 38 Anti-malware 38 Sophos Complete Security Anti-spam BYOD solution Firewall Encryption Security Management Usage policies
- 39. 39 Complete Security… Network Servers End Users and Devices Made Simple. Simple Deployment Simple Protection Simple Management • On premise • Virtual • Cloud • User self provision • Active Protection – real-time protection powered by SophosLabs • Live lookups via the Cloud • SophosLabs experts tune the protection so you don’t have to Next Gen Firewall Anti-malware and IPS URL Filtering Network Access Control Wireless VPN Anti-Spam Email Encryption Anti- Malware Mobile Encryption Patch Assessment Application Control Device Control Encryption for Cloud Endpoint Web Protection Anti-Malware Webserver Protection Virtualization Intuitive consoles: On Premise or From the Cloud Backed by expert support App Control V-Shield
- 40. 40 Reputation Data • Active Protection SophosLabs Correlated intelligence • Content Classification AT HOME AND ON THE MOVE Mobile Control Endpoint Security SafeGuard Encryption Secure VPN Client HEADQUARTERS Endpoint Security SafeGuard Encryption REMOTE OFFICE 1 NextGen Firewall Secure Wi-Fi Endpoint Security SafeGuard Encryption Mobile Control Administration Secure Wi-Fi SOPHOS CLOUD Web Application Firewall Secure Email Gateway Secure Web Gateway Mobile Control Network Storage Antivirus Server Security Guest Wi-Fi UTM NextGen Firewall Secure Web Gateway Secure Email Gateway Web Application Firewall REMOTE OFFICE 2 Secure Wi-Fi Endpoint Security SafeGuard Encryption Mobile Control Secure VPN RED
- 41. 42 AT HOME ON THE MOVE HEADQUARTERS SAMPLES TELEMETRY HONEY POTS SOPHOSLABS HUMAN DECISION MAKING AUTOMATED LEARNING & AUTOMATION BIG DATA ANALYTICS Dynamic & Static REMOTE OFFICE
- 42. 43 SophosLabs Active Protection Malware Data Website URL Database HIPS Rules Reputation Data Malicious URLs Spam Campaigns Sensitive Data Types Application Categories Device Data Mobile Application Reputation Anonymizing Proxies Application Patches Network Servers Devices Web Email Next Gen FW Web App FW Wifi Smartphone/ Tablet Workstation/ Laptop Data Correlated Intelligence Reputation Data Content Classification Email Web File
- 43. 44
- 44. 45 EFFECTIVENESS USABILITY “INTEGRATED” PRODUCT PORTFOLIO COMPLETE SECURITY INTEGRATION POINT SOLUTION
- 45. 46 “Complex solutions aren’t solutions. We make security for the real world – for the pragmatic enterprise. Simple security is better security.” Kris Hagerman, CEO Sophos
- 46. 47
- 47. 48 Why they should’ve gone for Sophos Recent cases and how Sophos can help prevent disaster
- 48. 49
- 49. 50
- 50. 51 SEC Block C&C DNS IP tables AFC Webproxy and UTM Advanced Threat Protection C&C Server URL Database Command & Control Server Check URL Contact C&C server File checksum suspicious SXL Analyze Send file Pattern ATP IPS
- 51. 52
- 52. 53 SMC and Mobile Encryption
- 53. 54
- 54. 55 DLP met Safeguard encryptie
- 55. © Sophos Ltd. All rights reserved5. 6
Editor's Notes
- Juni 2013 NSA lek NSA en Government Communications HeadQuarter (CGHQ) Prism
- Target: In the days prior to Thanksgiving 2013 – reported december 12 2013 Home depot: 18th of september 2014 – reported 6 november 2014
- Heartbleed Juni 2014 Facebook Instagram Pinterest Tumblr Google Yahoo Amazon Etsy GoDaddy Flickr Netflix Youtube American Funds Box Dropbox Github OKCupid Wikipedia Wordpress
- Stéphane Chazelas contacted Bash's maintainer, Chet Ramey, on 12 September 2014[1] telling about his discovery of the original bug, which he called "Bashdoor". Working together with security experts, he soon had a patch as well.[1] The bug was assigned the CVE identifier CVE-2014-6271.[4] It was announced to the public on 24 September 2014 when Bash updates with the fix were ready for distribution
- Original release date: October 17, 2014 | Last revised: October 20, 2014Print Document Systems Affected All systems and applications utilizing the Secure Socket Layer (SSL) 3.0 with cipher-block chaining (CBC) mode ciphers may be vulnerable. However, the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack demonstrates this vulnerability using web browsers and web servers, which is one of the most likely exploitation scenarios.
- Source: Haveibeenpwned.com
- PWC global state of Information Security survey 2015 10,000 executives and IT directors in 154 countries
- Let’s talk a bit about security
- …the “malware” problem is getting larger (and at a faster pace) than imaginable. Today: 250,000 new threats will appear. Tomorrow, more than that will appear. Etc. …Macs are no longer immune. …new mobile platforms (Android, iOS) are expanding the attack surface …targeted attacks are not just against the “big guys” anymore …ever-changing (polymorphic) threats require industrial-strength protection …reliance on IT systems and data (for all sizes of organizations) could not be higher. Saying it’s the lifeblood of the org is an understatement. It must be available and secure.
- Simple Deployment * Select the delivery method that works best for you * Be up and running in [xx time] * Stay up-to-date automatically with cloud deployment Simple Management * Navigate easily with intuitive management interface * Get anywhere / anytime access with cloud management * Simplify policy rollout across devices and technologies
- Sophos Labs collects data from millions of endpoints and correlates it with our own research to provide immediate protection from the latest threats.
- We don’t want using all this great technology to be difficult. That’s why we’re doing the hard work. A good example is our HIPs solution which gives you everything we know about how malicious files are constructed and behave and identifies them for you. You don’t have to construct a complex policy, you just tick a box to get it working. And our active protection is truly unified. Identifying and protecting against every type of threat and delivered to the engine that powers all of our products, whether at the endpoint, gateway or across the network.
- 1. As in all markets at first products were created to solve individual problems - what we’d call point products – they were focussed on solving one problem in one way – for example signature based antivirus or simple firewalls. 2. As the threat grew and as new technologies emerged to address these threats - like host intrusion prevention or application control – the number of point products required for effective protection increased. Often security vendors offered these new technologies as new, separate products. Often they only really integrated at the brand or licensing level. Using all these products would in theory increase protection effectiveness, but in reality to achieve that level of protection an unsustainable increase in IT admin resource was required. The biggest impact was increased overhead for administrators and users. They were being asked to install multiple point products that were not integrated sufficiently at the deployment, policy or reporting levels. This left customers with multiple agents on their endpoints slowing their users down, multiple appliances at their gateway slowing theri traffic down and multiple technical support hotlines to call, slowing resolving issues down. In addition this lack of true integration meant many customers where overwhelmed and ended up not using all features. This trend continues today – and is exacerbated by increased pressures on IT – to protect against more sophisticated threats, on a more diverse range of platforms and devices – all with far fewer resources. 3. Our approach has always been fundamentally different. Because we’re focussed on cutting through the complexity by truly integrating all the security layers to deliver complete protection with a minimum of resources. This started with enabling our endpoint antivirus agent to detect spyware and PUAs alongside viruses - and to include runtime HIPS (Host intrusion prevention system) technologies – without the need for a plug-in or separate agents. And it continues today with our complete security approach through all our products: Web in Endpoint – combines our endpoint agents and gateway UTM appliances to ensure consistent web protection everywhere Data Control – again built-into our endpoint agent and our gateway protection with our labs supplying the data intelligence to power the protection Mobile Control – our unique combination of Mobile Device Management and Mobile Security And our UTM lets you to manage everything on one physical or virtual box – from your network firewall to the endpoint antivirus and even includes a wireless controller so you get truly secure wi-fi And our difference is not just about how the products work together but also about making them usable. We make sure aour products are practical to use in a business environment. For example we’ll use our expertise to make our management interfaces only display the essential options required to build the policies you require – we’ll use a single checkbox to activate a technology like HIPS - and hide all the complex configuration and fine tuning behind this - as it’s all is handled by the experts in our labs…we call this Active Protection. Today we’re continuing to build on this approach – by constantly improving the ways in which our security components work better together – both at the protection level using our labs to hide the complexity from our customers and to simplify deployment and management by utilizing the Sophos Cloud platform. Our product vision is to delver Complete Security Integration that reduces the enemy of security – complexity - for both IT admins and their users. To provide better protection with the lowest possible overhead. Our aim is to allow businesses operating securely and focus on growing without having over invest IT security products or expertise. In the to protecting against web-based threats by enabling our endpoint agent and gateway perform runtime HIPS,
- At the core of ATP is a set of different traffic analysis mechanisms based on DNS, IP tables and the application control engine. This efficiently checks against data from our Sophos Labs to detect and prevent devices to connect to C&C/botnets outside the network. But that's not all: If you also enable Web Protection and IPS (which I recommend!) the ATP analysis will be leveraged by results of those systems - all consolidated in one dashboard/inline report/reporting view. As mentioned above, ATP is able to consolidate results not only from its core engine but also IPS and Web Protection. Thus, the webadmin dashboard for ATP will show results whenever one of the analysis reports an incident. Same is true for the inline reports (-->Network Protection), only those will of course add more details/options: You will find information about source and destination of the traffic, a description of the threat found (and an external link to Sophos Threatcentral for ATP result), the origin which tells you which parts of the ATP system triggered the alert (DNS, AFCd, Proxy or IPS). You'll also have the option to add exceptions out of the inline report by hitting the "+" symbol! Note so, that the dashboard and inline reports will reset themselves on a daily basis Competition: Fortinet Include similar ATP functionality to us including cloud sandboxing, botnet database and web filtering Offer on-box sandboxing Analysis We offer a better multi-layer ATP solution that combines DNS, IPS, App control and Web that goes beyond what Fortinet provides They have on-box sandboxing which we don’t currently offer, but the cloud is actually a better place to do this than on a customers system. Expensive and complex Conclusion We compare favorably with Fortinet’s Advanced Threat Protection Sonicwall Offer basic IP-address based botnet filtering only
- Mobile control Mobile encryptie Applicatiebeheer
- DLP in email appliance en UTM DLP in endpoint DLP met Safeguard SPX met email appliance en UTM