The Future of Threat Prevention

Size: px

Start display at page:

Download "The Future of Threat Prevention"

Arleen Henry
6 years ago
Views:

providing innovative, disruptive, high-speed, high-performance

1 The Future of Threat Prevention Bricata is the leading developer of Next Generation Intrusion Prevention Systems (NGIPS) technology, providing innovative, disruptive, high-speed, high-performance network security and data protection solutions. Yasser Mohamed Senior Sales Engineer

2 About Bricata - Overview Where IDS came from How IPS is different Current threat landscape and challenges How Bricata is different Live demo 2

3 WAN 3

4 WAN 4

5 WAN TAP IDS 5

6 WAN TAP IDS Passive system Traffic still passes to destination Limited to alerting or TCP resets 6

7 IPS WAN Active system Sits in-line and can stop attacks immediately Signature based Some include heuristic and anomaly detection 7

8 Enterprise Data Growth Source: IDC 8

9 Data Growth means more data to inspect and process. WAN Legacy IPS solutions cannot handle the traffic alone. 9

10 To keep up with traffic flow increases, devices are stacked. Stacking WAN 10

11 To keep up with traffic flow increases, devices are stacked. Stacking WAN Expensive Hard to manage Takes up a lot of space 11

12 IPS systems are needed to stop 99% or more of known attacks. But targeted Zero-Day attacks can still compromise organizations. Stacking WAN 12

13 IPS systems are needed to stop 99% or more of known attacks. But targeted Zero-Day attacks can still compromise organizations. Stacking WAN More sophisticated attackers Designed to evade most security devices Time-delay execution Can persist and grow for months or years 13

number of days attack groups were present on a

14 2014 Threat Report 66% of organizations were notified of a breach by an external entity 229 Days Median number of days attack groups were present on a network before discovery Source: Mandiant 2014 Threat Report 14

15 The Bricata Difference 15

16 Ultra High-Speed Performance Stacking 8 RU 60 Gbps 4 RU 100 Gbps 16

17 Deployed in-line as an active IPS solution Speeds range from 500 Mbps to 300 Gbps WAN Much smaller footprint Lower cost Lower operational expenses Easier to manage 17

18 BTX New Signatures WAN 18

19 BTX Simplified GUI New Signatures WAN PCAP Full payload and metadata 1 click query to pull PCAP Rapid investigation Open format Session reconstruction Contextual understanding of security incidents 19

20 BTX Simplified GUI Unknown Threats New Signatures WAN NEW (v2.0): Threat Regression PCAP What do we know today that we didn t know yesterday 20

21 21

22 22

23 BTX Simplified GUI New Signatures WAN NEW (v2.0): Threat Regression PCAP Breach Detection 23

Bricata ProAccel NGIPS Feature Set At-a-Glance Threat Isolation Engine Traffic monitoring & event management Cassandra data analytics engine Central management console (CMC) for complete dashboard

contextual understanding of security incidents Malware, vulnerabilities that are known and unknown Threat Intelligence Eco-system Port/Protocol independent inspection Custom signature creation GeoIP

24 Bricata ProAccel NGIPS Feature Set At-a-Glance Threat Isolation Engine Traffic monitoring & event management Cassandra data analytics engine Central management console (CMC) for complete dashboard control Log aggregation, correlation & forwarding to SIEM Regularly updated signature library & threat intelligence sharing Data exfiltration prevention automation Full packet capture for complete contextual understanding of security incidents Malware, vulnerabilities that are known and unknown Threat Intelligence Eco-system Port/Protocol independent inspection Custom signature creation GeoIP reputation & location Signature-less detection via Anomaly-based Decision Module Application awareness Full packet capture, NetFlow and contextual analytics Highly scalable global event management Event aggregation, correlation and forwarding 24

25 Bricata Deployment Options Remote offices and branches Virtual machines (VMs) Tele-workers, partners, and customers 25

Why Bricata: The New, Smarter Breed of Automated Threat Defense Reduced costs by as much as 50% over legacy IPS solutions Created by leading NGIPS experts in the security industry Offers High-speed

26 Why Bricata: The New, Smarter Breed of Automated Threat Defense Reduced costs by as much as 50% over legacy IPS solutions Created by leading NGIPS experts in the security industry Offers High-speed IPS, full packet capture, and breach detection Exceeds feature parity of other leading NGIPS vendors Leverages your existing FW investment Improves visibility from the core to the perimeter Ease of deployment and management o All legacy SNORT and Suricata rule sets can be ingested with no rewrite Zero Day Threat detection with our Anomaly-based Decision Module Performance Versatility Value 26

27 Demonstration 27

SOLUTION BRIEF RSA NETWITNESS EVOLVED SIEM

SOLUTION BRIEF RSA NETWITNESS EVOLVED SIEM RSA NETWITNESS EVOLVED SIEM OVERVIEW A SIEM is technology originally intended for compliance and log management. Later, as SIEMs became the aggregation points for security alerts, they began to be more