BREAKTHROUGH CYBER SECURITY FREQUENTLY ASKED QUESTIONS

Size: px

Start display at page:

Download "BREAKTHROUGH CYBER SECURITY FREQUENTLY ASKED QUESTIONS"

Carol Conley
5 years ago
Views:

1 BREAKTHROUGH CYBER SECURITY FREQUENTLY ASKED QUESTIONS

2 What does GBMS Tech do? WE STOP MALWARE from running on your computers and mobile devices. We block CryptoLocker and Ransomware without any product updates. If an App isn t trusted it won t run, Period! Antivirus and other security tools can t stop today s onslaught of unknown malware. We can. We do it with a simple and provable approach: Only Trusted Apps are allowed to run, Untrusted Apps are ALWAYS blocked.

Frequently Asked Questions How does it work? GBMS Host Technology use five unique cyber-metric fingerprints and the file s size to positively identify any executable or script that tries to run.

3 Frequently Asked Questions How does it work? GBMS Host Technology use five unique cyber-metric fingerprints and the file s size to positively identify any executable or script that tries to run. Our kernel security agent intercepts the loading of all executables and scripts, and checks whether their fingerprints are authorized on your Trusted Apps list. If they are TRUSTED they re allowed to RUN. Everything else is blocked. It s a simple yes/no decision. The result: We block 100% of malware that tries to run as an executable or script. If an App isn t trusted, it won t run. Period. Even protects unsecure endpoints. This one simple cyber-security technology blocks all executable and scripted malware and all other untrusted Apps. Even if an endpoint has unpatched security holes, attackers won t be able to launch malware through those holes. And malware that s already present on an endpoint will be blocked the instant our driver is installed and enabled.

Windows XP Windows 2000 Windows Servers And Windows POS including some versions of Embedded Windows.

Windows XP and Windows 2000 can be protected from executable and script-based malware even though Microsoft no longer provides

4 Which Operating Systems do you protect? We protects all shipping versions of Microsoft Windows, including versions: Windows 10, Windows 8+ Windows 7 Windows Vista Windows XP Windows 2000 Windows Servers And Windows POS including some versions of Embedded Windows. Point-of-Sale systems, medical equipment, kiosks, automated teller machines and other embedded systems that are running on Windows XP and Windows 2000 can be protected from executable and script-based malware even though Microsoft no longer provides security updates for these versions of Windows. New Operating System Drivers will be released in the future for Android, Mac OS X, Linux and others to protect: Android Phones and Tablets Mac and Linux Desktops and Servers Connected and Self-Driving Cars

5 What is your Licensing Model? We offer a subscription-based service per endpoint that customers can subscribe to on an, annual or 3-Year basis. Who are the Competitors? And what makes GBMS Host Technology better? Established App Control vendors use push models that are both inefficient and hard to manage. Our patent pending technology eliminates the need to push whitelists to endpoints and significantly reduces network and management overhead. Host technology security created unique technological advantages that application whitelisting vendors don t have: Sophos Security Their App Control technology comes from our previous company, We use the technology that s been built from the ground up to address all the obstacles we d identified in that 8 year old technology. Bit9/Carbon Black Their push deployment model is hard to use and add significant management overhead. Cylance This is a machine learning technology that can t stop all zero-day attacks by malicious scripts. McAfee Their technology came from the SolidCore acquisition in Old and hard to configure. Symantec According to Gartner s February 1, 2016 Magic Quadrant for Endpoint Protection Platforms Symantec s Completeness of Vision score is affected by the limited capabilities of its application control. Symantec has been a latecomer to the App Control protection market.

6 What makes GBMS Host Technology better than competing application whitelisting and other cyber-security technologies? [Lumension Security(Coretrace), Sophos(Coretrace), Carbon Black(Bit9), McAfee s App Control] Spoof-Proof Cyber-Metric Handprinting that Prevents Hash Collision Attacks to circumvent the system. Instant Protection without scanning that makes protection available the moment it s installed. App Usage Intelligence based on our collection of information on all software that runs or tries to run. Protection against Malicious Insiders and lone wolf Admins with our 1-Click Distrust Button and Two-Man Rule. No need to push whitelists to the endpoint; this significantly reduces network and management overhead. Users can subscribe to our services on a Monthly, Annual or 3-Year basis. They only pay for what they use. We make App Control simple to install and manage; eliminating the main barriers to App Control adoption. [Entercept, Okena, SignaCert, TripWire, Check Point, Einstein 1, 2 & 3, Cylance] None of these security systems actually provide Zero-Day protection because they rely upon blacklisting, periodic scanning, behavioral analysis, heuristic or machine learning, host or network intrusion detection or endpoint/cloud-based sandboxing. Each of these detection technologies require prior knowledge of what malware techniques have been used or anticipation of what techniques might be used by hackers. Likewise, compliance-monitoring systems don t block Zero-Day attacks.

7 Host Technology (Trusted Apps) works using a simple and provable approach. We identify Apps (executables and scripts) by unique cybermetric attributes or Code Signing Certificates. Only Trusted Apps are allowed to run, Untrusted Apps are ALWAYS blocked.

8 What types of endpoints do you protect? We protect all Microsoft Windows platforms from Windows 2000 through Windows 10. It can be used to protect desktops, servers, tablets and purpose drive machines in these use cases: Enterprise Desktops and Servers Point-of-Sale Industrial Control Systems Cloud Servers Embedded Windows SMB Desktops and Servers Windows Tablets Automatic Teller Machines (ATMs) Kiosks Casino Gaming Machines

CryptoLocker, CryptWall, CryptoXXX Wiper Virus type attacks Stuxnet type attacks against Industrial Control Systems Watering Hole

9 What types of malware attacks do you protect against? We block all untrusted executables and untrusted scripts. This includes: Ransomware, executable or script based; e.g. CryptoLocker, CryptWall, CryptoXXX Wiper Virus type attacks Stuxnet type attacks against Industrial Control Systems Watering Hole type attacks where hackers infect trusted websites Droppers from Websites Phishing and Spear Phishing Attack type infections Keyloggers and similar information stealing trojans Executable and Script based Internet Worm type attacks

10 How does one determine what goes on the App Trust-List? App Trust-Lists can include Cyber-Metric Handprints, Code-Signing Certificates or a combination of both. Besides adding Handprints for specific executables and scripts or Code-Signing Certificates from specific software publishers, you can also trust separate Trust-Listing profiles from your account or from other users. Simply put, you can Trust an App, Trust a Code-Signing Certificate or Trust a User or a Trust-List Profile. What happens if a user adds an untrustworthy App to the list? Everything on the Trust-List is allowed to run, but any App can be Distrusted with a single click. How do you handle Trusted Apps that are found to be vulnerable or untrustworthy? There are three methods to block Apps that you no longer trust: 1. Remove it from the Trust-List by clicking the Distrust button in your Trusted Apps list or App Browser. 2. Filter it out from the Trusted App in your App Browser. 3. Add a Deny Policy for the specific App in your Group or a Profile you re trusting.

11 What is the extent of your protection for web browsers? Web Browsers must be included in your Trust-Listing before they are allowed to run. A specific Handprint or Code-Signing Certificate is required for them like any other App. Currently, web browsers Javascript and plugins execution are not within our perimeter of defense, but our driver will block the running of any executables or scripts that are installed as part of a malware dropper, effectively breaking a browser-based attack s chain of events. Are there Global and Local Trust Lists? The system includes Global Trust-Lists, user defined trust-lists and endpoint cache trust-lists. Users have the discretion to trust the global trust-lists, trust other Certified Advisors public trust-lists and build their own user defined trust-lists. The security includes two curated Global Trust-Lists: CTR, a curated trust-list of approved Code-Signing Certificates Our CTO s curated trust-list of approved App Handprints Either of these can be trusted by a user with a single click, or the user can cherry pick individual Apps and CERTs.

12 Is there a Global Namespace that provides a Master List in the cloud across all versions of Apps? The Software I Can Trust feature allows users to trust all CERTs with the same Certificate Subject Name issued by the same Certificate Authority. Once a CERT/ISSUER namespace has been trusted, all new Code-Signing Certificates in the same namespace are automatically trusted. How do endpoints maintain App Trust- Listing protection when not connected to a network or the Internet? There is both a memory based cache and a persistent cache of signed entries on the endpoint. How do you maintain synchronization between the endpoint s trust-list caches and service s Trust-Lists? Every time an App is authorized to run, the authorization is cached in endpoint s memory with a Timeto-Live specified by the trust-listing service (12 hours by default) to eliminate the need to frequently check whether an App is in the user s Trust-List. This authorization is also stored as a signed entry in a persistent file cache on the endpoint. Any App that has been authorized to run in the past is still allowed to run when the endpoint isn t connected to the network or the Internet. If the endpoint receives a denial response for any previously authorized App, its entry is removed from the persistent cache. Users can also scan an endpoint to populate its persistent cache for all executables and scripts on its file system based on the user s current Trust-Listing Profile.

13 What does the end-user see when an App is blocked from running or is an exception to a Monitoring Mode trust-list? The administrator can control the visibility of Blocked App and Monitoring Mode Exception tray notifications on the endpoint from the dashboard interface on either a group basis or override the group settings for each individual endpoint. If the tray notifications are enabled, they will see a Blocked App or Warning notification along with the file s name and path. How are Blocked Apps and Monitoring Mode Exceptions resolved? How do I trust unknown Apps? Any unknown executables, scripts or Code-Signing Certificates can be resolved by: 1. Safe Learn Mode for Code-Signing Certificates on signed executables 2. Learn Mode for Unsigned executables and scripts 3. Adding the unknown executables and scripts from the Blocked Apps and Monitor Mode Exceptions panels 4. Harvesting the Code-Signing Certificates and Handprints directly from an endpoint or another file system 5. A Single Click to Add unknown executables and scripts already identified by a trusted Advisor

14 +44 (0) Berkeley Street London W1J 8DJ GBMSMK004 Rev1

Real-time, Unified Endpoint Protection

Real-time, Unified Endpoint Protection Real-Time, Unified Endpoint Protection is a next-generation endpoint protection company that delivers realtime detection, prevention and remediation of advanced threats