Agenda Why we need a new approach to endpoint security Introducing Sophos Intercept X Demonstration / Feature Walk Through Deployment Options Q & A 2
Endpoint Security has reached a Tipping Point • Attacks are from within the perimeter, delivered using software exploits • Ransomware reaches $1.2B in damages • Lack of Threat Intelligence after a Breach
Driving the Paradigm Shift to Next-Generation ZERO DAY LIMITED ADVANCED EXPLOITS VISIBILITY MALWARE
The Evolution of Sophos Endpoint Security From Anti-Malware to Anti-Exploit to Next-Generation Exposure Pre-Exec File Run-Time Exploit Prevention Analytics Scanning Detection URL Blocking Generic Matching Signatures Signatureless Technique Web Scripts Heuristics Known Malware Behavior Analytics Identification Download Rep Core Rules Malware Bits Runtime Behavior T RADITIONAL M ALWARE A DVANCED T HREATS
! E XECUTABLE M ALICIOUS MS F ILES R ANSOMWARE I NCIDENT E XPLOIT U NAUTHORIZED R EMOVABLE A DVANCED F ILES URL S & PDF P REVENTION R ESPONSE P REVENTION A PPS M EDIA C LEAN A ND Y ET … 90% OF D ATA B REACHES ARE >90% O F E XPLOIT A TTEMPTS U SE M ORE T HAN 60% OF IT S TAFF F ROM E XPLOITS K ITS K NOWN V ULNERABILITIES L ACK I NCIDENT R ESPONSE S KILLS P REVENT R ESPOND D ETECT B EFORE IT RUNS ON DEVICE B EFORE IT REACHES DEVICE N EXT G ENERATION E NDPOINT
Introducing Sophos Intercept X Anti-Ransomware Anti-Exploit Root-Cause Analysis Detect Next-Gen Threats Automated Incident Response Prevent Exploit Techniques • Stops Malicious Encryption • IT Friendly Incident Response • Signatureless Exploit Prevention • Behavior Based Conviction • Process Threat Chain Visualization • Protects Patient-Zero / Zero-Day • Automatically Reverts Affected Files • Prescriptive Remediation Guidance • Blocks Memory-Resident Attacks • Identifies source of Attack • Advanced Malware Clean • Tiny Footprint & Low False Positives ADVANCED ZERO DAY LIMITED MALWARE EXPLOITS VISIBILITY Prevent Ransomware Attacks Faster Incident Response No User/Performance Impact Roll-Back Changes Root-Cause Visualization No File Scanning Attack Chain Analysis Forensic Strength Clean No Signatures
Optional Demo
ANTI-RANSOMWARE
CryptoGuard - Intercepting Ransomware Monitor file access Attack detected Rollback initiated Forensic visibility • If suspicious file • Malicious process is • Original files restored • User message changes are detected, stopped and we • Malicious files • Admin alert file copies are created investigate the removed • Root cause analysis process history details available
ROOT CAUSE ANALYSIS
Root-Cause Analytics Understanding the Who, What, When, Where, Why and How What Happened? • Root Cause Analysis • Automatic report @ the process / threat / registry level • 90 Days of historical reporting • Detailed Visual representation of what other assets have been touched What is at Risk? • Compromised Assets • Comprehensive list of business documents, executables, libraries and files • Any adjacent device (i.e., mobile) or network resources which may be at risk Future Prevention • Security Posture • Recommendations based on historical security risks • Provides steps to prevent future attacks • Rich reporting of Compliance status
15 Sophos confidential
16
ANTI-EXPLOIT
Intercepting Exploits 10’s of new malware sub- techniques every year ?
Intercepting Exploits Exploit Prevention 10’s of new malware sub- • Monitors processes for attempted use of techniques every year exploit techniques e.g. Buffer overflow, code injection, stack pivot and others • Blocks when technique is attempted • Malware is prevented from leveraging vulnerabilities ?
SOPHOS CENTRAL
A Single, Synchronized Security Platform Sophos Central In Cloud On Prem UTM/Next-Gen Firewall Endpoint/Next-Gen Endpoint Wireless Mobile Email Server Web Encryption 21
Sophos Central: Admin Dashboard User-Centric Unified Powerful Simple Fast 22
DEPLOYMENT OPTIONS
Deployment Options SOPHOS INTERCEPT X Antivirus and endpoint Sophos Central Endpoint solutions from other Advanced vendors 24
TO SUM UP…
Taking Your Endpoints To The Next-Generation ADVANCED ZERO DAY LIMITED MALWARE EXPLOITS VISIBILITY 26
Sophos Intercept X Anti-Ransomware Anti-Exploit Root-Cause Analysis Detect Next-Gen Threats Automated Incident Response Prevent Exploit Techniques • Stops Malicious Encryption • IT Friendly Incident Response • Signatureless Exploit Prevention • Behavior Based Conviction • Process Threat Chain Visualization • Protects Patient-Zero / Zero-Day • Automatically Reverts Affected Files • Prescriptive Remediation Guidance • Blocks Memory-Resident Attacks • Identifies source of Attack • Advanced Malware Clean • Tiny Footprint & Low False Positives ADVANCED ZERO DAY LIMITED MALWARE EXPLOITS VISIBILITY Prevent Ransomware Attacks Faster Incident Response No User/Performance Impact Roll-Back Changes Root-Cause Visualization No File Scanning Attack Chain Analysis Forensic Strength Clean No Signatures
Recommend
More recommend
