#SymVisionEmea
Integrating MSS, SEP and NGFW to catch
targeted APTs
SYMANTEC VISION SYMPOSIUM 2014
“NATIONAL CYBER STRATEGIES & DATA PROTECTION LEGISLATION ARE GAINING SPEED”
Information security to cyber security
“DETECTION , PRIORITISATION & RESPONSE IS CHALLENGING”
“CYBER IS MOVING UP THE BUSINESS RISK REGISTER”
“WE EXIST IN A HYPER CONNECTED AND COMPLEX WORLD”
+91
%
Increase in targeted attack campaigns
2012
SYMANTEC VISION SYMPOSIUM 2014
Realization
Customer
Needs Shift
Breach is Inevitable
Data & Process
& People
Stopping
Incoming
Attacks
Finding
Incidents
Containing &
Remediating
Problems
Restoring
Operations
Prepare
Protect
Detect
Respond
Recover
Protection Only
Protection +
Detection
& Response
5
Rapid detection & response – a significant challenge!
Solving the challenges: Advanced Threat Protection
Focused on solving customer problems
Tell me about them faster & better than
anyone else, across all ports and protocols,
whether blocked or detected
Tell me what it means to me: details on
why it is malicious, what it did, how it got
in, what I can do about it, what it means in
a global context
Don’t show me 100s of 1000s of events in a
big list - Prioritize your detections so I can
maximize my time
Help me
Protect, Detect and Respond
Incident Responder &
Security Operations
SYMANTEC VISION SYMPOSIUM 2014
Managed Security Services (MSS-ATP)
7
Traditional
UTM or ISA
Next Gen FW
STAP
Determine who can talk
to who, but they can’t
hear what’s being said.
•
Port & protocol based
•
IP-based detection
•
Some IPS capabilities
Limited to catching
what’s known
•
Signature-based IPS & AV
•
URL filtering
•
Application control
Analyzes files to detect
unknown & zero-day malware
•
Virtual Execution
•
Sandboxing
•
File hash lookups
SYMANTEC VISION SYMPOSIUM 2014
Symantec offers great proactive protection today
Endpoint Protection
Web Security
Email Security
Managed Security Services – Advanced Threat Protection (MSS-ATP)
9
Insight
• File reputation
• World’s largest
with intelligence
on over 8 billion
SONAR
Skeptic
TM
Disarm
• Behavioral
analysis
• Analyzes over
1400 behaviors
• Advanced spear
phishing heuristics
• 100% unknown
virus SLA
• Spear phishing
attachment
sanitization
• 95% +
effectiveness
IPS
• Prevents exploits
• Blocks command
and control
communication
Symantec Global
Intelligence Network
Manual correlation & remediation
Network Security
technology detects
suspected Malware
• Determines whether
malware is known and if
endpoint has blocked it
• Verifies whether endpoints
are compromised
• Determines if / where
infection has spread
Initiates endpoint actions
(clean, block, quarantine,
gather forensics, …)
Launches corrective
actions
Network
Security Group
Endpoint Protection
Manager
Endpoint
Security Group
TODAY
NetSec VX
SYMANTEC VISION SYMPOSIUM 2014
Managed Security Services – Advanced Threat Protection (MSS-ATP)
11
Introducing…
Network
Security
Endpoint
Security
Security
Intelligence
Threat
Experts
Automated Triage Workflows
Rapid Response | Operational Efficiency | Attack Visibility
Integration
SYMANTEC VISION SYMPOSIUM 2014
Customer
Premise
Symantec
SOC
Log
Collection
Platform
Security
Analysts
Customer
Portal
DeepSight Global
Threat Intelligence
Data
Warehouse
13
Symantec MSS
IS
big data security analytics
2B+ events logged daily
alerts generated annually
Over 100,000 security
200,000 daily code
submissions
7 Billion
•
File, URL & IP
Classifications
•
Capturing previously
unseen threats &
attack methods
1 Billion+
•
Devices Protected
•
More visibility across
devices creates better
context and deeper insight
2.5 Trillion
•
Rows of Security
Telemetry
•
Putting “big data” analytics
to work for every end user
Monitors Threats
in 157+ countries
14 Data Centers
World Wide
550 Threat
Researchers
SYMANTEC VISION SYMPOSIUM 2014
GameOver Zeus
Cryptolocker
Recent news: Symantec fighting advanced cyber threats
Symantec Endpoint
Protection
Network-based Adv.
Threat Detection
MSS Advanced Threat
Protection
SYMANTEC VISION SYMPOSIUM 2014
•
Wildfire
•
Threat Emulation
•
Advanced Malware Protection (AMP)
17
Advanced Threat Protection Alliance
Network
Adv. Threat
Detection
Symantec Endpoint
Protection
Symantec Managed
Security Services
Virt Exec
Symantec Global
Intelligence Network
Effective Detection of
Advanced Threats
Only Critical Threats
Prioitised
Efficiency Savings for
Customers
Outcome:
Protected
INCIDENT
GIN & Insight file
reputational database adds
global threat intelligence
and context to detected
threats
SYMANTEC VISION SYMPOSIUM 2014
•
Targeted attacks use custom malware that can evade traditional defense technologies
•
These custom malware files have never been seen before, and only appear in the targeted attack
•
Insight can effectively detect these unknown or custom malware files without risk of false positives
Bad Reputation
Good Reputation
Never before seen
File A
File B
File C
19
Insight detects targeted attacks
Leverages file reputation to detect unknown files
Sources
Potential Threat List
Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded
Malware Download, Endpoint Protected
SEP Correlation
File Reputation & MSS
Network
FILE A
FILE B
Potential Threat List
Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded
Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected
Potential Threat List
Malicious File Downloaded Malicious File Downloaded Malicious File Downloaded
Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected Malware Download, Endpoint Protected
