Security Automation. Challenge: Automatizzare le azioni di isolamento e contenimento delle minacce rilevate tramite soluzioni di malware analysis

Transcription

1 Security Automation Challenge: Automatizzare le azioni di isolamento e contenimento delle minacce rilevate tramite soluzioni di malware analysis

2 Network Admission Control

3

4 See Managed Unmanaged Computing Devices Agentless Continuous DIRECTORIES PATCH SIEM Network Devices Applications Antivirus out-of-date Vulnerability Broken agent ATD VA EMM IoT Visible with OTHER Visible Not Visible

5 Control Policy-driven Automated Users Network Endpoints Existing IT

6 Orchestrate Share context Automate workflows IBM IBM ControlFabric Open APIs

7 IT Security With ForeScout IBM IBM 1 See corporate, BYOD, IoT, rogue devices. FIREWALL SIEM ATD VA ENDPOINT PATCH EMM 2 Control network access based on user, device, policy Internet Directories Network 3 4 Find and fix vulnerabilities and security problems on managed endpoints Automate enrollment for guests and BYOD including mobile devices Network Infrastructure 5 Rapidly respond to incidents, without human intervention BYOD Devices Managed Devices IoT Devices Rogue Devices

8 IT Security With ForeScout IBM IBM 1 See corporate, BYOD, IoT, rogue devices. FIREWALL SIEM ATD VA ENDPOINT PATCH EMM 2 Control network access based on user, device, policy Internet Directories Network 3 4 Find and fix vulnerabilities and security problems on managed endpoints Automate enrollment for guests and BYOD including mobile devices Network Infrastructure 5 Rapidly respond to incidents, without human intervention BYOD Devices Managed Devices IoT Devices Rogue Devices

9 IT Security With ForeScout IBM IBM 1 See corporate, BYOD, IoT, rogue devices. FIREWALL SIEM ATD VA ENDPOINT PATCH EMM 2 Control network access based on user, device, policy Internet Directories Network 3 4 Find and fix vulnerabilities and security problems on managed endpoints Automate enrollment for guests and BYOD including mobile devices Network Infrastructure 5 Rapidly respond to incidents, without human intervention BYOD Devices Managed Devices IoT Devices Rogue Devices

10 IT Security With ForeScout IBM IBM 1 See corporate, BYOD, IoT, rogue devices. FIREWALL SIEM ATD VA ENDPOINT PATCH EMM 2 Control network access based on user, device, policy Internet Directories Network 3 54 Find and fix vulnerabilities and security problems on managed endpoints Automate enrollment for guests and BYOD including mobile devices Network Infrastructure 5 Rapidly respond to incidents, without human intervention BYOD Devices Managed Devices IoT Devices

11 IT Security With ForeScout IBM IBM 1 See corporate, BYOD, IoT, rogue devices. FIREWALL SIEM ATD VA ENDPOINT PATCH EMM 2 Control network access based on user, device, policy Internet Directories Network 3 4 Find and fix vulnerabilities and security problems on managed endpoints Automate enrollment for guests and BYOD including mobile devices Network Infrastructure 65 Rapidly respond to incidents, without human intervention BYOD Devices Managed Devices IoT Devices Rogue Devices

12 Granular Controls Modest Strong Alert & Remediate Limit Access Move & Disable Open trouble ticket Send notification SNMP Traps Syslog HTTP browser hijack Auditable end-user acknowledgement Self-remediation Integrate with systems and security management platforms. Send to WebService. Write to SQL/LDAP. Deploy a virtual firewall around an infected or non-compliant device Reassign the device into a VLAN with restricted access Update access lists (ACLs) on switches, firewalls and routers to restrict access DNS hijack (captive portal) Automatically move device to a preconfigured guest network Reassign device from production VLAN to quarantine VLAN Block access with 802.1X Alter login credentials to block access, VPN block Block access with device authentication Turn off switch port (802.1X, SNMP) Wi-Fi port block Terminate unauthorized applications Disable peripheral device

13 Next Generation Security Platform

14 Next Generation Security Platform

15 Identification Technologies Transform the Firewall App-ID Identify the application User-ID Identify the user Content-ID Scan the content

16 Single-Pass Parallel Processing (SP3) Architecture Single Pass Operations once per packet - Traffic classification (app identification) - User/group mapping - Content scanning threats, URLs, confidential data One policy Parallel Processing Function-specific parallel processing hardware engines Separate data/control planes Up to 200Gbps, Low Latency

17 Wildfire

18 Traps Advanced Endpoint Protection Prevent Exploits Including zero-day exploits Prevent Malware Including advanced & unknown malware Collect Attempted-Attack Forensics For further analysis Scalable & Lightweight Must be user-friendly and cover complete enterprise Integrate with Network and Cloud Security For data exchange and crossed-organization protection

19 Security Reimagined

20 Multi-Vector Virtual Execution Engine PURPOSE-BUILT FOR SECURITY HARDENED HYPERVISOR SIGNATURE-LESS EXPLOIT BASED DETECTION, NOT JUST FILE FINDS KNOWN AND UNKNOWN THREATS MULTI-VECTOR PERFORMANCE EFFICACY

21 Analyze, Detonate and Correlate ANALYZE 2 MILLION OBJECTS PER HOUR DETONATE CORRELATE WITHIN VMs ACROSS VMs CROSS ENTERPRISE

22 FireEye Ecosystem

23 Put pieces together!

24 Forescout + PaloAlto

25 Forescout + FireEye

26 DEMO!

27 Q&A