ein wichtiger Baustein im Security Ökosystem Dr. Christian Gayda (T-SEC) und Ingo Kruckewitt (Symantec)

Transcription

1 Next Gen Endpoint Protection ein wichtiger Baustein im Security Ökosystem Dr. Christian Gayda (T-SEC) und Ingo Kruckewitt (Symantec)

2 What is Next Gen Endpoint Protection? 2

3 DT Next Gen Endpoint Protection Family Consumer / VSE SME LE EP-Cloud Console EP-Management Server SEPM Server (Win, Linux) PC MAC Android ios Server (Win, Linux) PC MAC Android ios 3

4 Next Gen EP: engines for the whole family Vantage Intrusion Prevention Generic Exploit Mitigation Emulator, Machine Learning Insight & Safeweb SONAR SymClass MutantX Antivirus NETWORK HARDENING FILE REPUTATION BEHAVIORS SAMPLE AUTOMATION CLUSTERING FILE Blocks malware as it tries to spread over the network Blocks all zero day attacks by hardening the operating system Scans and Determines the safety eradicates malware of files & websites using files that arrive on a the wisdom of the system. Emulator crowd (analytics) helps unpack packers Watches programs as they run and identifies/blocks suspicious behaviors Advanced tools automatically classify over 1M malware files/day Uses key elements and behaviors to cluster malware into families Scans and eradicates malware files that arrive on a system. 4

5 Next Gen EP: under the hood Inbound Communication Payload delivery Payload execution Outbound Communication Reputation ML Machine Learning Static Attribute ML Clustering Behavioral ML Network Stateful Firewall Next gen IPS Next-gen IPS Browser protection Hardening System hardening Application control Just in time memory scan Core OS Rootkit protection AV Engine Emulation Big Data Real-time response to rapidly changing threat landscape Threat vector learning at scale Signature based Non signature based Machine learning and deep learning 5

6 Next Gen EP: flow of actions Patented real-time cloud lookup for scanning of suspicious files Global Intelligence Network (GIN) NETWORK FIREWALL & INTRUSION PREVENTION ANTIVIRUS ADVANCED MACHINE LEARNING REPUTATION ANALYSIS EMULATOR DEVICE CONTROL BEHAVIOR MONITORING MEMORY EXPLOIT MITIGATION Blocks malware before it spreads to your machine and controls traffic Scans and eradicates malware that arrives on a system Pre-execution detection of new and evolving threats Determines safety of files and websites using the wisdom of the community Virtual environment detects malware hidden using custom packers Control file, registry, and device access and behavior; whitelisting, blacklisting, etc. Monitors and blocks files that exhibit suspicious behaviors Blocks zero-day exploits against vulnerabilities in popular software INCURSION INFECTION INFESTATION and EXFILTRATION 6

7 Advanced Machine Learning based protection Collect Training sets in Real-Time Training Algorithm Trained Machine New & Retrained Advanced ML Advanced Machine Learning detects unknown threats before execution Leverages Symantec s massive in field presence to gather the best training data Trained by algorithms crafted by Symantec s dedicated team of ML scientists and ML experts Customer Benefit: 0-day Protection against unknown malware Infrequent updates The Advanced ML Engine is designed to 7be updated with small infrequent updates. 7 Detect on client with Advanced Machine Learning High effectiveness. Internal tests show very high detection efficacy.

8 Detect Malware hidden in polymorphic custom packers Malware hides behind custom polymorphic packers No Emulation Executable Packer Packed, not recognized Emulator detects malware trying to evade detection by using polymorphic custom packers by unpacking in a virtual environment Emulator unpacks the malware in a virtual environment Emulation Emulation Environment Executable Packer Customer Benefit: Emulation Environment Executable Unpacking Payload Recognized Runs each file in a lightweight virtual machine to cause threats to reveal themselves Light-weight solution with no performance over-head (happens in milliseconds as user opens the file) 8 8

9 Proactive exploit protection why it is so important Event Triggers Cybercriminals discover a new vulnerability. The race is on to develop a working exploit. Cybercriminals develop an exploit for the vulnerability. The exploit is sold to the highest criminal bidders. The security community discovers the vulnerability. Patch development starts for the vulnerability. Cybercriminals race to create new exploits and sell them in easily available kits to less technical criminals. A patch for the vulnerability is developed and made available to consumers. Day Zero Patch Protection can take 7 to 60 days on average Threat Level The world is still relatively safe. High-value institutions are at risk from targeted attacks. Consumers with the vulnerable software are now at risk. Consumers with the vulnerable software are still at risk. Consumers who have patched are safe until the next vulnerability is discovered. MEM protects consumers here 9 9

10 Next Gen EP: WannaCry protection Patented real-time cloud lookup for scanning of suspicious files Global Intelligence Network (GIN) NETWORK FIREWALL & INTRUSION PREVENTION ANTIVIRUS ADVANCED MACHINE LEARNING REPUTATION ANALYSIS EMULATOR DEVICE CONTROL BEHAVIOR MONITORING MEMORY EXPLOIT MITIGATION Blocks malware before it spreads to your machine and controls traffic Scans and eradicates malware that arrives on a system Pre-execution detection of new and evolving threats Determines safety of files and websites using the wisdom of the community Virtual environment detects malware hidden using custom packers Control file, registry, and device access and behavior; whitelisting, blacklisting, etc. Monitors and blocks files that exhibit suspicious behaviors Blocks zero-day exploits against vulnerabilities in popular software INCURSION INFECTION INFESTATION and EXFILTRATION 10

11 WannaCry Ransomware timeline March 14th April14th April 24th May 10th May 12th Microsoft releases patch for vulnerability in Windows SMB protocol CVE An exploit of this vulnerability (EternalBlue) is revealed in a huge leak of NSA hacking tools by an underground group called Shadow Brokers Symantec releases IPS signature to block attempts to exploit the vulnerability CVE exploit is added to Exploit.DB Wave of WannaCry attacks begin using EternalBlue exploit to spread Symantec observes increased attempts to exploit CVE WannaCry infects more than 230,000 computers in over 150 countries Microsoft releases CVE patch for Windows XP A Security Researcher identified an unregistered domain that the malware tried to contact as a test for virtual environments. He registered that domain, causing the malware to halt and stop spreading. May 23rd Symantec researchers tie WannaCry Ransomware to Lazarus cybercrime group 11

12 Next Gen Endpoint Protection and its role in a security eco system 12

13 Next Gen Endpoint Protection as part of the eco system Cloud Access Security Broker (CASB) Data Loss Prevention (DLP) Cloud Data Protection (CDP) advanced Global Intelligence Network (GIN) Web Secure Web Gateway Endpoint Protection (SEP+DLP) SSL VA Content Analysis System (CAS) Malware Analysis Appliance (MAA), Sandbox basic Mail Secure Mail Gateway (SMG) Multitenant, hybrid, virtual Web Security Service (WSS) 13

14 Next Gen Endpoint Protection as part of the eco system Cloud Access Security Broker (CASB) Data Loss Prevention (DLP) Cloud Data Protection (CDP) advanced Global Intelligence Network (GIN) Web Secure Web Gateway Symantec Endpoint Protection (SEP+DLP) SSL VA Content Analysis System (CAS) Malware Analysis Appliance (MAA), Sandbox basic Mail Secure Mail Gateway (SMG) Multitenant, hybrid, virtual Web Security Service (WSS) 14

15 MAGENTA SECURITY 15