Cisco Advanced Malware Protec3on

Transcription

1 Cisco Advanced Malware Protec3on

2 Malware is an ever- growing problem

3 The Reality: Organiza3ons Are Under AAack 95% of large companies targeted by malicious traffic 100% of organiza3ons interacted with websites hos3ng malware Source: 2014 Cisco Annual Security Report Cybercrime is lucra3ve, barrier to entry is low Hackers are smarter and have the resources to compromise your organiza3on Malware is more sophis3cated Organiza3ons face tens of thousands of new malware samples per hour Phishing, Low SophisEcaEon Hacking Becomes an Industry SophisEcated AFacks, Complex Landscape Viruses Worms Spyware and Rootkits 2005 Today APTs Cyberware Today +

4 The Reality: Organiza3ons Are Under AAack 95% of large companies targeted by malicious traffic 100% of organiza3ons interacted with websites hos3ng malware Source: 2014 Cisco Annual Security Report

5 Impact of a Breach Breach occurs 60% data in is stolen in hours 54% of breaches remain undiscovered for months Informa3on of up to 750 million individuals on the black market over last three years START HOURS MONTHS YEARS Source: Verizon Data Breach Report 2014

6 Selec3ng your malware protec3on technology based upon detec3on rates is really just selec3ng your method of failure

7 Why has detec3on failed? Malware no longer infects as individual files The ini3al virus is oyen bespoke custom wriaen for a single aaack campaign Once the infec3on has taken place, more unique malware is downloaded and the cycle is repeated. Local detec3on lacks the processing power, storage and perspec3ve necessary The bad- guys are clever, resourceful and well mo3vated

8 If you knew you were going to be compromised, would you do security differently?

9 It s 3me for a new approach

10 The New Security Model AAack Con3nuum BEFORE Discover Enforce Harden DURING Detect Block Defend AFTER Scope Contain Remediate Firewall Patch Mgmt IPS IDS AMD App Control Vuln Mgmt An3virus FPC Log Mgmt VPN IAM/NAC /Web Forensics SIEM Visibility and Context

11 Comprehensive Environment Protec3on with AMP Cisco Advanced Malware Protec3on AMP Protec3on Content Network Endpoint Threat Vector and Web Networks Devices Method License with ESA or WSA Stand Alone Solu3on - or- Enable AMP on FirePOWER Appliance Install on endpoints Ideal for New or exis3ng Cisco or Web Security customers IPS/NGFW customers Windows, Mac, Android, VMs

12 Cisco Advanced Malware Protec3on Built on unmatched collec3ve security intelligence Cisco Sourcefire VRT SIO (Vulnerability Cisco Collec3ve Research Team) Security Intelligence WWW Endpoints Web Networks IPS Devices 180,000+ File Samples per Day FireAMP Community 1.6 million global sensors 100 TB of data received per day 150 million+ deployed endpoints 600+ engineers, technicians, and researchers 35% worldwide traffic 13 billion web requests 24x7x365 opera3ons 40+ languages Advanced MicrosoY and Industry Disclosures Snort and ClamAV Open Source Communi3es Honeypots Sourcefire AEGIS Program Private and Public Threat Feeds Dynamic Analysis 8 10 million samples per month sandboxed

13 AMP Offers Point- in- Time and Con3nuous Protec3on Point- in- Time Protec3on Retrospec3ve Security Breadth and Control points: Network Endpoints IPS WWW Web Devices Telemetry Stream One- to- One Signature Fuzzy Finger- prin3ng Machine Learning Advanced Analy3cs Dynamic Analysis File Fingerprint and Metadata File and Network I/O Con3nuous feed Process Informa3on File Reputa3on & Sandboxing Con3nuous Analysis

14 Con3nuous Protec3on when advanced malware evades point- in- 3me detec3on Antivirus Sandboxing Point-in-time Detection Initial Disposition = Clean Analysis Stops Not 100% Sleep Techniques Unknown Protocols Encryption Polymorphism Actual Disposition = Bad = Too Late!! AMP Retrospective Detection, Analysis Continues Initial Disposition = Clean Actual Disposition = Bad = Blocked

15 Con3nuous Analysis Enables Retrospec3ve Security Breadth and Control points: WWW Endpoints Web Network IPS Devices Telemetry Stream Retrospective Detection Behavioral Indications of Compromise Trajectory Threat Hunting File Fingerprint and Metadata File and Network I/O Process Informa3on Con3nuous feed Con3nuous analysis

16 Detec3on

17 Delivers the first line of detec3on All detec3on is less than 100% One- to- One Signature Fuzzy Finger- prin3ng Machine Learning Advanced Analy3cs Dynamic Analysis Reputa3on Filtering and File Sandboxing

18 One to One Akin to tradi3onal an3- virus SHA256 of the file must match exactly the SHA256 in the cloud Quick and Accurate Reduces the load on other detec3on systems All results end up in this list Easily Evaded

19 Fuzzy Fingerprin3ng (ETHOS) Employs a Fuzzy Signature that is invariant to shallow modifica3ons Designed to detect families of viruses Generated by employing large scale data- mining techniques Successful largely due to the cast volumes of data available to Talos

20 Machine Learning (SPERO) Backend constructs models based upon a corpus of training data composed of: Known malware Known clean files These models are created by applying machine learning algorithms to create classifiers that dis3nguishes clean files from malware If new files match these classifiers then they are flagged appropriately Machine Intelligence can unearth classifiers that humans are unable to find, largely due to the volumes of data analysed

21 Advanced Analy3cs Global, rather than file- centric Again, made possible through the vast volume of data available to Talos Uses the context of the file to augment the other detec3on engines Examples: File has been hosted on known malware sites File has been downloaded by malware File downloads malware

22 Dynamic Analysis Sandbox Can be evaded by malware Nevertheless, it is a useful technology Cisco recently acquired ThreatGRID and is in the process of integra3ng that technology into AMP

23 Nevertheless, malware WILL get through Detec3on is s3ll important because it reduces the volume of events that security professionals have to deal with

24 Remedia3on

25 Tradi3onal Incident Response is Tough High Cost of Response Average cost of responding to a breach is over $500,000, but costs can skyrocket into the millions of dollars Too many tools to manage Prolifera3on of tools in place, all with their own consoles, making an integrated response difficult High volume of alerts It is impossible to effec3vely manage the countless events generated daily Time Without the right tools, response takes 3me and ac3onable data can decay in minutes or even seconds

26 AMP s Incident Response Capabili3es Gives you Intelligence, Scope, and Control Ques3ons that Need Answers The Complexity of the Problem that AMP Solves Where do I start? What systems were/are impacted? What did the threat do? How do we recover? How do we keep it from happening again? Confirm Infec3on No3fica3on Quaran3ne Triage Analyze Malware Build Test Bed Malware Prolifera3on Sta3c Analysis Device Analysis Cannot Iden3fy Infec3on Network Analysis Update Profile Confirm Stop No Infec3on Prolifera3on Analysis Malware Profile Infec3on Iden3fied Remediate Search Network Traffic Search Device Logs Scan Devices Define Rules (from profile) Search for Re- infec3on

27 Where do I start? Con3nuous Analysis Breadth and Control points: WWW Endpoints Web Network IPS Devices Recording Watching ALL FILES Telemetry Stream File Fingerprint and Metadata File and Network I/O Process Informa3on Con3nuous feed Con3nuous analysis

28 What systems are / were affected? Track a file across your en3re network

29 What did the threat do? Gives you detailed view of sample behaviour No presence in the VM like other sandboxes 300+ Behavioural indicators (and growing) Malware families, malicious behaviours and more Detailed descrip3on, ac3onable Priori3ze threats with confidence Increases speed and accuracy of incident response teams

30 What did the threat do? Review a historical record of what a device is doing And take the appropriate ac3on

31 How do we recover? Simple Custom Detec3ons Quickly and easily write custom signatures Advanced Detec3ons Create Clam AV signatures

32 How do we keep it from happening again? AAack Con3nuum BEFORE Discover Enforce Harden DURING Detect Block Defend AFTER Scope Contain Remediate

33 In conclusion You can no longer rely on detec3on What s needed is visibility and control In a world where infec3on is inevitable you need to have the tools in place to find and eliminate the threat The goal is to remove the Persistence from Advanced Persistent Threats

34 QUESTIONS