Trend Micro Deep Discovery for Education. Identify and mitigate APTs and other security issues before they corrupt databases or steal sensitive data

Transcription

1 Trend Micro Deep Discovery for Education Identify and mitigate APTs and other security issues before they corrupt databases or steal sensitive data 1

2 Computers, the Internet, and portable devices are now a vital part of the educational experience. With continuously dwindling budgets and ever-limited resources, maintaining a safe and productive IT environment that can address constant changes in computing continues to create severe challenges for educators. Many schools have been finding that providing antivirus (AV) protection is not enough to ensure the safety, availability, and performance of their networks. To keep IT environments operating without unplanned disruptions, schools need solutions that prevent modern evasive types of attacks and provide visibility into the health of the machines in their network. Trend Micro Deep Discovery is at the heart of the Trend Micro Custom Defense solution, which enables schools to examine their network and identify machines with problems, and can contain and fix those problems before they spread to other parts of the network.

3 Protecting School Networks in an Era of Increasing Threats Today s K-12 and higher education network administrators face a daunting set of security challenges. They must protect against threats that can lead to classroom interruptions and corrupted databases. They must also protect against data theft that can breach employee and student privacy. And, they must maintain accurate security updates on all machines, keep the entire system performing seamlessly all while being able to identify and fix problems quickly. Despite reduced school budgets and IT resources, these challenges continue to increase at schools across the Nation. Further complicating IT security at schools is the advent of personal devices. As more students and teachers bring in their own laptops, tablets, and smartphones, they introduce new threats to the network. For example, an infected laptop could spread malware and infect network servers and other machines. To ensure infrastructure integrity, IT administrators must account for personal devices by either protecting them or blocking them from the school s network. As the threat landscape continues to shift, schools must be prepared for a growing array of new and advanced malware that is designed to evade traditional detection. Known as Advanced Persistent Threats (APTs) as well as Targeted Attacks, these attacks are designed to breach perimeter security controls and leverage an insider s system (student, school employee, etc.) in order to compromise targeted systems. Recent attacks include dynamic malware, layered encoding, and multi-packing which can operate undetected while stealing confidential data. Trend Micro Deep Discovery Visibility, Insight, and Control It s no longer enough to block a threat at the desktop or server. With more sophisticated attacks coming from more devices, today s schools need an IT security solution that provides networkwide monitoring to provide network-wide visibility, insight, and control needed to combat APTs and targeted attacks. Trend Micro Deep Discovery provides schools with the best detection and greatest coverage by identifying malicious content, communications, and behavior across every stage of an attack sequence. Through detection and in-depth analysis of both advanced malware and evasive attack behavior, Deep Discovery enables a new level of active protection, visibility and intelligence to combat APTs and targeted attacks across the computing environment. Deep Discovery includes specialized inspection engines and custom sandbox simulation to identify zero-day malware and abnormal activities that are invisible to standard security defenses. Aided by global threat intelligence from the Trend Micro Smart Protection Network, Deep Discovery delivers high detection rates, low false positives, and in-depth reporting information to accelerate attack containment. Deep Discovery is comprised of two components. The Deep Discovery Inspector provides network traffic inspection, advanced threat detection, and real-time analysis and reporting. The optional Deep Discover Advisor provides open, scalable custom sandbox analysis, visibility to network-wide security events, and security update reports all in a unified intelligence platform. Deep Discovery in Action Trend Micro Deep Discovery is at the core of the Trend Micro Custom Defense solution, which enables school IT departments to not only detect and analyze APTs, but also to rapidly adapt protection and respond to these attacks. Deep Discovery provides the network-wide visibility, insight and control needed to protect your institution against APTs and targeted attacks, including: Threat profile what are the characteristics, origins and variants of this malware? Related IPs/domains what are the known command & control communications for this attack? Attack group/campaign who and what is behind this threat? Containment and remediation what to look for, how to remediate, and eradicate? 3

4 Top Threats The Top Threats tab provides detailed reports that enable schools to quickly see the top threats Deep Discovery is tracking over a desired time period last 24 hours, last month, and hourly. This detail allows school IT staff to quickly pinpoint the most relevant and dangerous threats to their environment. Threat Summary The Threat Summary includes five threat categories and hourly drill down information that makes it easy for schools to see the peak times when attacks are occurring. This information allows IT staff to better understand what is happening in their environment dynamically. Real-Time Monitoring Similar to the Threat Summary above, Real-Time Monitoring provides more granular details related to IP and volume counts for threats. 4

5 Threat Discovery/ Mitigation Report When a threat is detected, it is important to ensure steps are taken to quickly contain and remediate the threat. Deep Discovery can perform real-time containment and remediation of the threat as well as provide root-cause to ensure the IT department understands how the threat entered in the first place. Open, Scalable Analysis Platform Deep Discovery uses sandbox analysis to detect APTs and other targeted attacks in a school s environment. Deep Discovery s virtualized threat sandbox analysis system uses customer-specific images that exactly match an IT environment ensuring accurate detection and reducing false positives. Its open platform also lets the Deep Discovery Inspector Other Trend Products Direct File Submission Open Web Services school integrate other Trend solutions with Deep Discovery, manually submit a file for analysis, or use open Web services to have other threat data feed into a sandbox. 5

6 Success Story: K-12 Schools Extend Security with Trend Micro Deep Discovery 6

7 7

8 Summary As IT environments become an increasingly important part of today s educational landscape, schools must take steps to protect their networks from a new breed of sophisticated threats. Unlike yesterday s simple malware, today s threats can evade traditional AV to steal confidential employee and student information, disrupt classroom activities, and corrupt databases. Attacks from zero-day threats and APTs can cripple school networks that rely solely on AV protection. Deep Security uses advanced detection methods to rapidly and accurately identify emerging threats and continually delivers global threat intelligence to help keep schools and other organizations protected from these new Get a Free 30-Day Evaluation See for yourself how Trend Micro Deep Discovery can ensure the safety, availability, and performance of your school s IT network. We ll setup Deep Discovery in your environment for free for 30 days, so you can take it for a test drive and experience the benefits of increased visibility, insight, and control. To schedule your 30-day evaluation, contact: Lorri Schoeni Account Manager 500 E Border St, 7th Floor Arlington, TX Office: Mobile: attack techniques. But understanding new threats and tactics is only the first step in maintaining an IT environment serving students and teachers. To combat today s threats and ensure the safety, availability, and performance of their IT environment, schools must be able to identify computers and devices with problems and address those problems before they spread to other parts of the network. By providing visibility across the network, insight into malware affecting individual machines, and the ability to alleviate the problem, Deep Discovery can help keep school IT environments protected from advanced threats so they continue to enhance the educational experience. Securing Your Journey to the Cloud 2013 by Trend Micro Incorporated. All rights reserved. Trend Micro, the Trend Micro t-ball logo, OfficeScan, and Trend Micro Control Manager are trademarks or registered trademarks of Trend Micro Incorporated. All other company and/or product names may be trademarks or registered trademarks of their owners. Information contained in this document is subject to change without notice. [Deep-Discovery-Education PS-MAR2013]