Dell Security Overview Eddie Chan Security Solution Consultant Dell Security Solutions Dell | Hong Kong & Taiwan
Agenda • Session One • 2016 Threat Report Update • Session Two • SonicWALL C APT URE Advanced Threat Protection Service • Session Three • Privileged Management - Safeguard • Access Management - Defender Security Products
Global Response Intelligent Defense (GRID) Network • Threat research team • Proprietary malware analysis automation • World-wide monitoring • Shared cross-vector threat- related information (i.e. 1M Sensors, Honeypots, Sandboxing) • Real-time counter-threat intelligence • Active participant in leading research organizations • Industry leading responsiveness Internal Use Only – Dell Confidential
Malware attacks 8.19 billion | blocked by Dell firewalls in 2015 Internal Use Only – Dell Confidential
The top malware delivery methods Website Email/Phishing downloads Portable Text messages devices (USB) (SMS) 6 Dell - Internal Use - Confidential
What did we find last year? Internal Use Only – Dell Confidential
1 • Use of anti-forensic mechanisms to evade security systems Exploit kits evolved with • Upgrades in evasion greater speed, techniques, such as URL pattern changes heightened stealth and novel shape-shifting • Changes to landing page abilities redirection techniques (i.e. Steganography) • Modifications in landing page entrapment techniques Dell - Restricted - Confidential
Flow chart Spartan infection chain
黑客鎖電腦檔案 索金鑰費 中小企下載圖片中招 付款失敗資料救不回 11 Dell - Internal Use - Confidential
Angler exploit kit pushed new variant of ransomeare
Ransomware effect for differences business area
2 HTTPS hits as percentage of total hits SSL/TLS encrypted traffic rises sharply, leading to 61% more under-the-radar hacks 39% Dell - Restricted - Confidential
You can’t protect what you can’t see — attacks unseen by most firewalls “…redirection code planted “…redirection code planted in the malicious in the malicious advertisements uses advertisements uses SSL/TLS (Secure Sockets SSL/TLS (Secure Sockets Layer/Transport Layer,…” Layer/Transport Layer,…” By Jeremy Kirk, IDG News Service, Jul 27, 2015
3 Notable trends in Android attacks Malware for the • New variant that added a randomly Android ecosystem generated PIN to the typical ransomware lock screen continued to rise and • Dropping malicious code as part of a evolve library file, rather than a classes file • Financial sector continued to be a prime target for Android malware Dell - Restricted - Confidential
4 Popular malware families continued to morph from season to season and differed across geographic regions Dell - Restricted - Confidential
Most popular malware by country in November 2015
Top 10 malware families 19 Dell - Internal Use - Confidential
Predictions for 2016 • Battle between HTTPS encryption and threat scanning will continue to rage, as companies fear performance trade-offs • Flash zero-days will drop gradually because major browser vendors have stopped supporting Flash plugins • Malicious threats will target Android Pay through the vulnerabilities of Near Field Communication (NFC)
Final Takeaways
Recommendations App IAM VPN AV Control Defend Before Layered Security - most effective better together strategy Patch Encry 2FA Manag IPS ption ement Obey the 3 D’s D efend:: Before an attack fortify your position to DPI CFC SIEM PAM During Detect give yourself the best chance of preventing a breach. Educa Sand monit AV tion box or D etect:: During an attack ensure your tools see the threat and act quickly to prevent it Behavioral logs DLP Discover analysis After D iscover:: After penetration ensure visibility un- masks the threat quickly to minimize loss. Forensics Identity Network Endpoint Data Combine technologies from each tower that cross the time boundaries Internal Use Only – Dell Confidential
Introducing Dell SonicWALL C APT URE Advanced Threat Protection Service February 2016
Challenge: Explosion of evasive, zero-day threats* • Designed to evade 1 st generation sandbox analysis and detection • Target not just windows environments but also mobile and connected devices • Hide in encrypted and unencrypted traffic • Hide in more file types, of any file size * Source: Dell Security 2016 Threat Report
Introducing Dell SonicWALL Capture Advanced Threat Protection Service Cloud service detects and blocks zero-day threats at the gateway Multi-engine sandbox detects more • threats than single sandbox technology Broad file type analysis and • operating system support and no file-size limitation Blocks until verdict at the gateway • • Rapid deployment of remediation signatures • Reporting and alerts NSA 2600 – 6600 TZ SOHO – TZ600 SuperMassive 9200-9600
Increase security effectiveness against zero-day threats • Multi-engine advanced threat analysis detects more threats, can’t be evaded • Virtualized sandbox • Full system emulation • Hypervisor level analysis • Broad file type and OS environment analysis, no file size limitation • PE, MS Office, PDF, archives, JAR, APK • Windows, Android and Mac OS • Automated and manual file submission 26 Internal Use Only – Dell Confidential
VMRAY with Dell SonicWALL Internal Use Only – Dell Confidential
lastline with Dell SonicWALL Internal Use Only – Dell Confidential
lastline in NSS LABs report in 2015 Internal Use Only – Dell Confidential
Monitoring and reporting • At-a-glance dashboard • Scanned file history • Detailed file analysis report 30 Internal Use Only – Dell Confidential
Internal Use Only – Dell Confidential
Internal Use Only – Dell Confidential
Internal Use Only – Dell Confidential
Manually upload file for advance inspection Internal Use Only – Dell Confidential
Internal Use Only – Dell Confidential
C APT URE Screen Demo April 2016
Introduce for Safeguard & Defender April 2016
Privilege Management Challenges • Difficult to manage • Huge security and compliance risk Fact: 69% of confirmed security incidents were perpetuated by insiders, and increased more than 300% between 2011 and 2012 Fact: More than half were former employees who regained access via backdoors or corporate accounts that were never disabled Dell Software 39
Why are they difficult to manage? Devices Mainframes Databases Applications Servers Vendors Applications Helpdesk Developers Admins Dell Software 40
Huge security and compliance risk? Very Powerful • IT Admin - Deleted 15 virtualized machines that ran 88 servers • IT Admin – Stole patient records and test results • IT Director – Continued use for a month and altered CEO presentation • Systems Admin – Took down 2000 servers No individual accountability Dell Software 41
Solve the challenges Secure & efficient Granular delegation & Monitoring & management command control logging Task 1 Task 2 Task 3 User A User B User C Dell Software 42
Secure and efficient management Privilege Safe ? Issuance Request Authorization Change Servers Mainframes Applications Devices Databases Dell Software 43
Privileged Password Manager Privileged • Secures accounts in a password safe password – AES 256 Encrypted safe • Request and approval workflow – Dual or more release controls • Removes embedded passwords in applications and scripts • Automated password changes –“Last use” – Time-based • Full audit trail Dell Software 44
Session Management (IN THE ROADMAP) Allow only certain Pre-set time limits Full DVR-like recording commands Dell Software 45
Who to talk to and what to listen for Administrator IT Manager Security officer Potential breach, audit Manual process, Manual process, application too much responsibility reports, compliance access, assigning accountability, access reporting Dell Software 46
Dell Defender
• Average user has over 40 Problem: static professional/personal accounts passwords are – Users use the same password for multiple inefficient, accounts – Complex passwords are written down unsecure and – Passwords are only changed when required expensive • Large organizations spend on average $850,000 per year resetting passwords • Increasing remote workforce makes it more important to prove identity of users accessing the network 48
• Changes with every use Answer: • Can’t be written down two-factor • Nothing to forget authentication 2FA 49
• Secure A two-factor • Flexible authentication • Scalable solution should be: • Easy to use • Affordable 50
Recommend
More recommend
