One Ring to Rule them All

Transcription

1 One Ring to Rule them All A primer on virtualization enhanced Co-founder & CTO

2 Introduction We use micro-virtualization to secure endpoints We serve enterprises and government agencies We are experts in virtualization and security Team of ~180 in Cupertino, CA and Cambridge, UK A Microsoft Security Partner Bromium

3 The Threat Landscape In unique attacks / sec caused 79,790 incidents and 2,122 confirmed data breaches in61countries 71% Sadly of vulns had a patch available for over a year before 90% Over of all incidents were caused by a user 70% And over of malware was unique to the target org Source: Verizon DBIR 15 Bromium

4 The rise of the targeted attack is shredding what is left of the anti-malware market s stubborn commitment to reactive protection techniques. It is clear that the industry is failing in its primary goal of keeping malicious code off PCs. GARTNER MQ FOR ENDPOINT PROTECTION Q1, 2015, DOCUMENT G Bromium 2015

5 Virtualization Enhanced Security The essence of virtualization-enhanced security is the ability to arbitrarily shrink the OS and network attack surface of an application to the point that it is completely isolated from everything else on a system. Bromium

6 Why Endpoints Remain Vulnerable Today s arsenal Anti-Virus HIPS EMET (ROP Mitigation) Rootkit Detection EDR Depend on the integrity of the Windows kernel Easily disabled by malware that exploits a kernel 0day Bypassing endpoint protection for fun & BSides London Apr Bromium

7 Application.exe Application DLLs Application Sandbox ~400 NT calls ~800 Win32 calls Task NTDLL.DLL ntoskrnl.exe win32k.sys HAL Bromium

8 Application.exe Application DLLs CSRSS > download > execute > pwn3d! SVCHOST WINLOGON MSSECES LSASS Millions of LOC Task ntoskrnl.exe NTDLL.DLL HAL win32k.sys CVE (Hacking Team) Bromium

9 Application.exe Application DLLs Application Sandbox CVE NTDLL.DLL ntoskrnl.exe win32k.sys HAL Bromium

10 Application.exe Application DLLs Application Sandbox Task VM NTDLL.DLL ntoskrnl.exe win32k.sys HAL Hypervisor Bromium

11 Desktop Virtualization Enterprise Data Personal Data Centralization Manageability Compliance Bromium

12 Next-gen IDS Bromium

13 Virtualization uses an additional ring of hardware protection and a small TCB Bromium

14 Windows Host Microvisor New Micro-VM per user task Virtual File System, Network and Desktop Bromium

15 Protected OS Network Intranet SaaS Sites Applications Files Credentials Isolated Websites Attachments USB / shares Untrusted networks Vulnerable Applications Bromium

16 Real-time analytics & reporting 4 3 Complete record of execution state (diffs, pcaps, files) One task per micro-vm 2 5 Selfremediation Micro-VM introspection 1 Bromium

17 Low FP forensic detail for each attack Bromium Malware manifest 18

18

19 Windows 10 Device Guard Device integrity Cryptographic processor Virtualization Biometric sensors UEFI Secure Boot prevents device tampering and ensures OS starts with integrity TPM processor provides tamper proof integrity validation and prevents unauthorized access to sensitive information Processor based virtualization isolates critical system components and data and protects even in the event full system compromise Using a biometric for authentication increases the level of difficulty for an attacker to the highest level Bromium

20 Result A compromised PC is less valuable Device still has network access AD, Exchange, Intranet, shares Files/data can be stolen A keylogger / screen scraper can steal data & credentials Cryptolocker etc Application.exe Application DLLs NTDLL.DLL CSRSS SVCHOST WINLOGON MSSECES LSASS? WCIS Windows 10 Device Guard ntoskrnl.exe win32k.sys HAL Windows 10 VBS Hardware Isolation (client Hyper-V) Bromium

21 Micro-virtualization and Windows 10 Bromium

22 Bromium

23 27

24 Cloud Infrastructure Container Orchestration App Containers OS [VM] 28

25 29

26 30

27 31

28 Isolation = Protection 32

29 Micro-virtualization for Docker Containers Intel Clear Containers KVM Hypervisor Clear Linux OS Security and isolation advantages of virtualization to isolate containerized applications on Linux Fast booting small Linux VM per container Containers can reside in multitenant environments Hardware Bromium

30 Bromium

31 35

32