New Software Blade and Cloud Service Prevents Zero-day and Targeted Attacks

Transcription

1 New Software Blade and Cloud Service Prevents Zero-day and Targeted Attacks 1

2 WOULD YOU OPEN THIS ATTACHMENT? Over 90% of targeted s use malicious file attachments as the payload or infection source Wall Street Journal Nov,

3 From the news. RSA Hack Hits Lockheed, Remote Systems Breached PC Mag (Mar, 2011) e-card arrives with malicious attachment containing Backdoor.Trojan. CNET (Feb, 2013) 3

4 TARGETED ATTACKS BEGIN WITH ZERO-DAY EXPLOITS Duqu Worm Causing Collateral Damage in a Silent Cyber-War Worm exploiting zero-day vulnerabilities in a Word document 4

5 Exploiting Zero-day vulnerabilities New vulnerabilities Countless new variants nearly 200,000 new malware samples appear around the world each day - net-security.org, June

6 Check Point introducing Check Point Threat Emulation PREVENTION OF ZERO-DAY ATTACKS! 6

7 INSPECT EMULATE SHARE PREVENT Stop undiscovered attacks with Check Point Threat Emulation 7

8 Identify files in attachments and downloads over the web Upload file to virtual sandbox in the cloud or on local appliance INSPECT Exe files, PDF and Office documents 8

9 EMULATE Emulating Multi OS environments WIN 7, 8, XP & user customized Open file and monitor abnormal behavior Monitored behavior: file system system registry network connections system processes 9

10 PREVENT Security Gateway Inline stopping of malicious files on any gateway 10

11 SHARE Immediate update of all gateways 11

12 INSPECT EMULATE SHARE PREVENT Stop undiscovered attacks with Check Point Threat Emulation 12

13 Threat Work A STANDARD CV? 13

14 Threat Work Abnormal file activity Naive processes created Joseph_Nyee.pdf Tampered system registry Remote Connection to Command & Control Sites File System Activity System Registry System Processes Network Connections 14

15 Real Life Example Prevented 140 phishing s targeting 4 customers in 2 days! New exploit variant of vulnerability (CVE ) Installs a bot agent Opens network ports for bot communication Steals user credentials 15

16 Most Accurate and Fastest Prevention Zero false-positive in document emulation Optimize analysis by inspecting only files at risk THREAT EMULATION with ongoing innovation 16

17 Threat Emulation Cloud Service Branch Headquarters Threat Emulation Cloud Service Branch Agent for Exchange Server Entire Enterprise can Verify files with Check Point Threat Emulation Cloud service 17

18 Threat Emulation Deployment Options Threat Emulation Cloud Service Local Emulation Appliance Security Gateway, R77 The Only Solution to provide Multiple Deployment Options 18

19 Anyone can submit files for THREAT EMULATION threatemulation.checkpoint.com 19

20 Check Point Threat Prevention Solution Multi-Layered Protection Against all Incoming Cyber Threats 20

21 Check Point Multi-Layered Threat Prevention IPS Antivirus Anti-Bot Stops exploits of known vulnerabilities WHAT ABOUT Block download of malware infested files NEW ATTACKS? Detect and prevent bot damage 21

22 Boosting the Collaborative Power of ThreatCloud Real-time sharing for immediate Protection 22

23 Summary Check Point Prevents Zero-day Attacks Stopping undiscovered malware Prevent infections from malicious documents (office & PDF) & executables Very Flexible deployment options Integral part of Check Point multilayered Threat Prevention 23

24 Thank You 24