Endpoint Security. How to improve the security of your endpoints thanks to the innovative egambit Endpoint Security agent

Transcription

1 Endpoint Security How to improve the security of your endpoints thanks to the innovative egambit Endpoint Security agent 1

2 Situation with endpoints and security olet s focus on Microsoft Windows environment owindows is one of the main operating systems used in current infrastructures Servers Workstations, Laptops oattackers spend an incredible time at creating unknown and undetected weapons in order to get illegal stealth remote accesses othe problem is that current defensive technologies like antivirus, antimalwares, personal firewall, cannot handle intruders alone This explains why most attacks will finally success, thanks to human errors or poor configurations and insecurity Evil link followed, Evil attachment open 2

3 About egambit Endpoint Security agent oto struggle against potential intruders over your Windows environment, egambit offers an advanced Endpoint Security agent (HIPS++) ohost-based Intrusion Prevention System Detection + Prevention in your Windows othis Endpoint Security technology will securely connect your Windows environments to egambit appliances egambit will then be able to detect weird behaviors, suspicious files, exfiltration of data, hacking attempts, stealth backdoors othe egambit Endpoint Security agent will be the best friend of your Antivirus, as it will help at catching what is usually missed 3

4 egambit Endpoint Security Assets Inventory Threat Intelligence Post Intrusion Security Assessments egambit 360 Network Detection System & App Monitoring Network Monitoring System Protection 4

5 egambit «Endpoint Security» agent à Stealth hackers detected and/or blocked Many Antiviruses + Threats Databases + Sandboxes + Artificial Intelligence + Continuous & Global + Consultants + Sandbox Windows egambit Intelligence in TEHTRIS cloud Threats Local egambit agent Data from the Ground Checks / Analysis / Answers Appliance Local egambit Intelligence Defensive Cyberarsenal 5

6 Example based on 2014, November experience SCADA Production network attacked in a multinational company. Unknown Trojan horse [0/57 on Virustotal] with SSL exfiltration. Local egambit Engine egambit results = detection + retaliation 1) Detection of suspicious unknown activity (HIPS engine) 2) Reporting to the worldwide cloud-based intelligence (global analysis) 3) Remote advanced analysis of the Windows (from egambit appliance) IP of attackers retrieved. Evil tools stolen and sent to Sandbox in minutes. 4) TEHTRIS MSSP: alert sent to IT Security expert team from customer (SOC) 5) Mitigation authorized by customer (protection of the SCADA production) Exfiltration path broken. Physical location of attackers found. Offensive weapons remotely broken. Offensive actions broken. 6

7 Examples of defensive capabilities These features can be enabled or disabled by the customer, to adapt the threat response to the desired level 7

8 Oletools Support Oletools is a must-have technology created by the well-known security expert Philippe LAGADEC (@decalage2) egambit Endpoint Security agent is fully compatible with Oletools - Scans of office documents (Word, Excel, Powerpoint) - Automatic scans - Live security analysis of macro-based threats 8

9 YARA Support oyara is a technology created by Victor Manual Alvarez (@plusvic) from VirusTotal YARA is said to be like an NIDS, for files + memory. oegambit Endpoint Security agent is fully compatible with YARA. Scans of memory + file system On-demand scans + Automatic scans Custom YARA rules supported Build specific YARA based rules as Indicators Of Compromise (IOC) to scan your whole infrastructure memory during a malware / spyware global hunt 9

10 Cloud-based intelligence olive reports from analysis made on the ground in the Windows computers are shared with the nearest egambit appliance osome results might be sent to a cloud-based intelligence in order to beneficiate from all experiences from worldwide global fighting When a new malware is caught somewhere on earth, all egambit Endpoint Security brothers are getting stronger It s a kind of collective cloud-based artificial intelligence dedicated to IT Security oexample Threats can be hunted by more than 50 antiviruses at the same time, with no CPU impact on your Endpoints devices 10

11 Latest innovations with the egambit Endpoint Security agent in Windows ogui : we added a «Windows Tray» (icon) Shared for the end user Announce when an evil process was killed, etc osiem : get your logs from Windows workstations! Grabbing important security events Add Windows workstation to your SIEM strategy (priceless and smart, compared to heavy SIEM) omicrosoft Security: advanced compatibility Follow Windows Security features Windows Defender, Security Essentials, EMET, App Locker 11

12 Latest innovations with the egambit Endpoint Security agent in Windows oaudits : check the security of your Windows stations and servers thanks to egambit agent Thousands of vulnerabilities analyzed Follow your real security status in your infrastructure ousb : fight against weird connected devices External hard drives, Mobiles, USB Keys, random devices... Read only mode + Alerts + Disabling mode... oram : Fully analyze the memory of your processes Modular YARA rules applied on memory Fight against «all in memory» attacks, and some obfuscation concepts like packers Example: detect backdoors like meterpreter with migrations in a legal process, or detect offensive tools like stealth mimikatz... 12

13 Defensive cyber-weapon system oothers defensive missiles proposed ARP Spoofing detection Malware persistence detection Scans of running processes Checks for Web browser security issues Checks for Potentially Unwanted Programs Local system information gathered Network exfiltration detection Network mitigation missiles System mitigation missiles otehtris can develop specific features when needed (crisis, threats ) 13

14 Artificial Intelligence When signatures based solution cannot fight against new unknown or advanced threats 14

15 egambit Artificial Intelligence o New features added in 2016 : «JARVIS» o Artificial Intelligence to recognize Windows malwares o Powerful neuronal network able to share advices against Windows binaries o Goodware or Badware? o Efficient against unknown threats compared to solutions based on signatures o Detections of many threats o Backdoors, Ransomwares, Virus, Adwares o Made by TEHTRIS and fully integrated inside other egambit technologies o o o o Unknown program running in your company? Forensics operations (post incident)? Security crisis handled?... 15

16 egambit Artificial Intelligence oneuronal Network based on deep learning o«multilayer Perceptron MLP» technology o Many hidden layers o More than 40 millions of parameters used for training o Inter-neuronal network with chosen weight otraining against more than 20 millions of different binaries o For each binary analyzed, more than points of control extracted and pushed to the network for an analysis Currently the network is able to detect known + unknown threats with more than 90% of success (many 0days threats caught in the wild since it was deployed worldwide) 16

17 Automatic Neutralization Sharing a «license to kill» with egambit Endpoint Security agents, in order to neutralize threats 17

18 Example of intrusion owinword attacked and exploited with a 0day Launching a malicious sub-process fairing.exe Temporary directory, unknown executable oegambit Endpoint Security agent can detect + respond automatically 18

19 Multiple options for neutralization Wide list of options to fit your environment Specific configurations can be studied with egambit experts in case of issues Wise method : learn how your environment works first and then activate the best options Impossible or complex to reach a 0% of risk Need to adapt the balance between security and efficiency Options of neutralization 1) Antivirus Descriptions Antivirus results from outside of your organization 2) Sandbox TEHTRIS Sandbox results 3) Heuristics 4) Execution Policy / Compliance 5) System Processes 6) Spawn Trees Artificial Intelligence, Machine Learning, Behaviors Paths of executions Play with system processes? Follow trees of processes (who launches who?) 19

20 Conclusions If you need to harden the security of your endpoints (stations, laptops, servers ) 20

21 egambit Endpoint Security agent [HIPS] otwo complementary levels of work Live Intrusion Detection alerts (monitoring) Retaliation and interaction against threats (mitigation) omultiple skills and features added to your security Follow the activity in your Windows boxes Improve your security and check compliance issues Detect unusual and unwanted programs Follow weird behaviors and anomalies Detect hidden software, insiders threats Retrieve APT, lateral movements, malwares Increase SOC/CSIRT capacities and speed Ease Forensics and Incident Management Add SIEM features against the logs of your workstations and laptops Launch audits against your endpoints with thousands of security checks 21

22 Compatibility matrix oegambit Endpoint Security agent was successfully running on this list of environments so far Windows XP Windows 2003 Windows 2008 Windows 2012 Windows 2016 Windows 7 Windows 8 Windows 10 othe deployment is pretty easy as it contains hardened auto-configuration protocol and features Just launch the MSI on your Windows, and the cyber protection against malwares and intruders will works alone 22

23 Example of features (samples) Standard Security (classical Antivirus) Advanced Security (standard Endpoint) Enhanced Security (egambit Endpoint) GUI System Tray Security Policies Cleaning Features Antivirus features Threats Intelligence Database Heuristic Protections Real Time Process Tracking Memory Analysis? Persistant Threats Tracking USB Security Live Office Protection Spawn Tree Protections Sandboxing Full Powershell Protection Security Audits of Endpoints SIEM (logs from stations) Ransomware Tracking Artificial Intelligence 23

24 egambit Endpoint Security agent oall in one solution (EDR + SIEM + Audits +...) Easy to deploy à MSI file Managed à SaaS: fully managed by TEHTRIS Detection à detect known/unknow threats Protection à automatic neutralization of main threats Response à manual cleaning for specific threats (crisis) SIEM : Security monitoring à SIEM for workstations! Audits : Security assessment à System & Applications audit! High-tech solutions à Artificial Intelligence... 24

25 Let s adopt egambit 25