Agenda. Introduction & Drivers of Networks DLP. Requirements, Challenges of Network DLP. Addressing Network DLP with Fidelis XPS

Transcription

1 Agenda Introduction & Drivers of Networks DLP Requirements, Challenges of Network DLP Addressing Network DLP with Fidelis XPS 1

2 The Value of Network DLP low high 2

3 DLP Issues Top Concern for CSOs Merrill Lynch CISO Survey, June 27, 2007 The 2008 Global Information Security Workforce Study, Frost & Sullivan, April 22,

4 What do you need to protect? Identity Information Customer, employee, student, patient, taxpayer identity information Digital Assets Intellectual property What is the impact of data leakage?» Compliance violations» Loss of competitive advantage» Negative branding» Financial consequences» Customer trust 4

5 Key DLP Driver Preventing Leakage of Identity Information The Agriculture Department announced Friday it has publicly exposed the personal information of up to 63,000 citizens.

6 Requirements, Challenges of Network DLP 6 CONFIDENTIAL

7 The Requirements for Data Leakage Prevention Maximize Risk Reduction Fast Time-to-Value Low Total Cost-of-Ownership Enterprise Scalability Significant Quick deployment risk reduction with No Comprehensive No maintenance of labor-intensive minimal resources data visibility, registered registration all data Comprehensive applications Easy to manage over prevention all Accurate ports Granular Wire-speed Prevent control leaks performance Address all zones of control 7

8 Address Data Security in the Network Problem: Protect privacy sensitive information Protect digital assets Prevent risky communications Rogue applications Rogue encryption Port-hopping and tunneling to subvert security infrastructure Govern use of consumer applications Manage IM, Webmail & P2P, including attachments and file types Solution: Direct content control: full enterprise content inspection and control Communication management: control channels and applications 8

9 Data Security Challenge: Controlling All Outbound Traffic > Analysts estimate 90% of organizations do not adequately control outbound traffic with their firewall. Firewall Non-Sensitive Data PII Instant Messaging Port 25 Port 7190 Authorized Unauthorized 65,535 ports 9

10 10 CONFIDENTIAL Addressing Network DLP with Fidelis XPS

11 Network Data Leakage Prevention Fidelis Security Systems enables global enterprises to prevent network data leakage protecting their brand, intellectual property, and resources. 11

12 Fidelis Security Systems: At a Glance Company Founded in 2002 the market leader in nextgeneration data leakage prevention solutions Awards Leadership Seasoned management team with more than 150 years combined network and information security experience Operations Headquarters in Boston, MA & Washington, DC Investors Blue-chip private equity funds Tudor Ventures, Inflection Point, Ascent, Point Judith Partners Best-of-breed partnerships with industry leaders: IBM, Verdasys, PGP 12

13 Network World Selects Fidelis XPS as Clear Choice Winner in Review for Best DLP Tools Fidelis XPS Achieves the Highest Score rating out of a perfect 4.0 scale Fidelis XPS: Overall winner Fidelis XPS was the most developed product in overall features, general flexibility and its ability to block. Our Clear Choice winner is Fidelis' XPS because of its easy-to-use interface, flexible rule-set, amazing reporting, and better-thanaverage detection and blocking ability. - Nate Evans & Benjamin Blakely, Network World

14 Fidelis XPS: Best-of-Breed DLP Powerful Policy Engine Accuracy without data registration Pre-built policies Granular control Deep Session Inspection Platform Comprehensive visibility Prevention on all 65,535 ports Wire-speed performance Network Appliance Fast to deploy = quick time-to-value Easy to manage Enables zones of control Delivering the Next Generation of DLP Security Focused Common Criteria / NIAP registered FIPS encryption

15 Why A New Generation Is Needed Control: Prevention Scalability: Performance 65,535 Ports 0 Fidelis XPS Gen 1 Limited Mitigation prevention for 1-4 ports 1000 Mbps Fidelis XPS Gen 1 Typically fails between Mbps Accuracy: Visibility Customer Benefit Fidelis XPS Compliance Reporting Network Security Channels Gen 1 Gen 1 Ports 65,535 Less channels only on well-known ports Fidelis XPS 15

16 Visibility to What Happens on the Network First Generation Visibility Firewall Fidelis XPS Visibility 65,535 ports

17 The Foundation of Next Generation DLP World s First Deep Session Inspection Platform 17

18 How It Works Content Analysis Ten different content analysis technologies all can be logically combined. Goes beyond matching to powerful, accurate profiling of information. Payload Decoding Opens files to extract content for analysis. Decoders are built for Fidelis XPS enabling high performance and prevention. Channel and Application Control Port independent fine-grain controls ranging from protocols, application, file attachments, encryption, and other attributes. Session Reassembly Packet are reassembled into sessions in real-time inmemory. Partial sessions are passed on for analysis. Packet Capture 18 Fidelis XPS captures all packets from the network.

19 Fidelis Information Gateway Platform

20 Pre-built Policies in Fidelis XPS Direct Content Control Digital Asset Leakage Classified Design Files Logos Sources Code Identity Leakage Personally Identifiable (PII) Credit Card (PCI) Healthcare (HIPAA) Finance (GLBA) Federal DoD Inappropriate Offensive Communication Management Unauthorized Traffic Proxy Circumvention Rogue Channels Rogue Encryption Weak Encryption Application Management Attachments Instant Messaging P2P Terminal & Desktop Webmail Attachment Management Audio Executables Images Video 20

21 Policy Engine: Power of Context In addition to pre-built policies, customer-specific policies can easily be built using Fidelis XPS powerful policy engine. Policy = group of one or more rules Rule = logical combination of one or more triggers delivers context Trigger > Content Sensitive information defined in content analyzers 1. Smart Identity Profiling 2. Keyword 3. Keyword Sequence 4. Regular Expressions 5. Binary Signatures 6. Encrypted Files 7. File Names 8. Exact File Matching 9. Partial Document Matching 10. Embedded Images Trigger > Location Sender and recipient information 1. source IP address 2. destination IP address 3. Geographical Data the country in which the IP address is registered 4. Username 5. LDAP directory attributes Trigger > Channel Details about the information flow 1. Application / protocol (port -independent) 2. Application-specific Attributes (e.g., user, address, subject, filename, URL, encrypted, cipher, and many more) 3. Port (Source / Destination) 4. Session length / size 5. Day of week / Time of day 6. Session duration 7. Decoding path 21 context. (2008). In Merriam-Webster Online Dictionary. Retrieved August 11, 2008, from

22 Deploying Next Generation DLP ICAP File Servers Fidelis XPS Internal Web Proxy Servers Fidelis XPS Proxy Databases Fidelis XPS Direct SMTP SMTP Milter Fidelis XPS Mail Fidelis XPS Mail Directories Servers Gateways

23 IBM & Fidelis: Partners in DLP IBM Global Services resells Fidelis XPS appliances as part of the IBM Internet Security Systems' professional and managed security services portfolio. IBM Network DLP managed security services and professional services is powered by Fidelis XPS. We spent months and months and many man hours looking at a variety of products in the data leakage prevention (DLP) market. We did not begin with an assumption that having a single vendor for both endpoint and network would be necessary and decided to look at each type of product individually. We found that many DLP providers that offered both network and endpoint protection products didn t have a very compelling combined solution After a very detailed handson and aggressive analysis, it was clear that Fidelis had the best product for network DLP. -- Duncan Hoopes, IBM 23

24 The Value of Fidelis XPS It s the next generation of Control Prevent on all 65,535 ports, including non-proxied traffic Most options for how prevention experience is handled Enable prevention today in unauthorized channels without halting normal business Accuracy Powerful rules engine accurately detects information without resource-intensive data registration Visibility into more applications, over all ports avoids costly false negatives Scalability Wire-speed performance support for gigabit networks without sampling Enable internal zones of control - protect the data center and transfers between divisions/organizations 24

25 Contact Details: Ivan Dolensky Regional Director South & East Europe M: E: 25