Integrating Metascan and CyberArk

Transcription

1 Integrating Metascan and CyberArk Tony Berning Senior Product Manager Yoav Melamed Bulwarx Co-Founder and CTO 3 April2014

2 Agenda Metascan Overview CyberArk Overview Bulwarx Overview Solution Overview Live Demo Further Resources

3 What is Metascan? Multi-scanning engine An API driven server application that allows customers to incorporate multiple AV engine scanning technologies into their security architecture Supports 0 to 30 anti-malware engines [and growing!] Simultaneously scans files with all engines Scan directories, files, archives, buffers, and boot sector Automatic online definition updates or manual offline updates

4 What is Metascan? Multi-scanning engine Flexible and scalable API driven solution Many programming Interfaces C++ Java PHP C#/ASP.NET RESTful (Web API)/HTTP ICAP CLI[command line interface] Analyzes files locally on a single server or remotely accesses files from Windows, Macintosh, or Linux systems

5 What is CyberArk? Sensitive Information Management Solution (IBV) A single platform for sharing information between users or in automated processes, providing convenient access through web, endpoint, mobile and solutions. Multiple layers of security, including encryption in transit and at rest, protect data at all times. Enterprise-level scalability and reliability meets the needs of growing organizations including high availability and disaster recovery. Trusted viewing of documents improves business collaboration, team productivity and cross-functional efficiency. An intuitive web interface, plug-ins and mobile applications provide anytime, anywhere access to information regardless of network connectivity, device or application. Granular access controls allow users to openly share content internally or externally without introducing risk of unauthorized access. One solution for server-to-server communications, user-to-user file sharing and encrypted streamlines deployment and management while maximizing investment.

6 What is CyberArk? Distribution Collection Agent The CyberArk Distribution and Collection Automation Engine (DCA) is a file-transfer management system that enables reliable and secure data transfer between organizations and their partners, suppliers and customers, providing a crucial platform for business operation and continuity. The Distribution and Collection Automation Engine (DCA) enables you to control all aspects of movement of your business data between any two entities, and provides you with a combination of the following unique features: Secure file transfer based on CyberArk s patented Vaulting technology Flexibility to support file transfer processes in which any business logic can be deployed Easy integration with Legacy or Enterprise systems High performance and scalability Reliability that ensures delivery Easy process management enables you to add new process and trading partners Auditing and monitoring that generates log files and enables you to track transferred files activity.

7 Bulwarx Overview Bulwarx Ltd. is an integration company which specializes in integration services within the cyber world. The founders of Bulwarx, Ltd. Tamir Lavi and Yoav Melamed, both bring with them over 20 years of work experience and proven practice within the field of information systems, and cyber security in particular. Their experience integrates professional management skills as well as advanced technical knowledge. Our vision is to become the leading cyber security solutions company and to a catalyst in the battle against cyber-attacks.

8 Solution Overview CyberArk users need a way to automatically scan all files being moved into or out of the vault for viruses and malware Metascan can be inserted into the file handling workflow to ensure only clean files enter the organization or are downloaded from the vault

9 Metascan-CyberArk Integration Acts as a CyberArk Validator Files are scanned through the REST API using the Metascan Client Connector After scanning, files can either be blocked, allowed, or trigger an alert Alerts are logged to Windows Event Log All files are kept in the DMZ and deleted after scanning

10 Metascan CyberArk Integration System Diagram

11 Metascan - CyberArk Integration Installation and Configuration Install and Configure CyberArk DCA Increase Thread Pool Copy Client Connector DLL Register Copy Plugin and XML Edit the CyberArk XML Metascan Server Address Server Response Timeout How to handle dirty files How to handle large files Threshold for how many engines need to find a file dirty What to do with encrypted archives Set up correct authentication options for CyberArk user Validator

12 Integration Demo Configuration and Setup Script Users End to End Flow Copying files Viewing Event Logs

13 Further Resources Metascan installation files available at (requires creation of a free OPSWAT Portal account) For further questions on Metascan contact sales@opswat.com For more questions on the Metascan-CyberArk integration contact yoav@bulwarx.com