Next Generation Network Traffic Monitoring and Anomaly Detection. Petr Springl
|
|
- Rosa Carr
- 6 years ago
- Views:
Transcription
1 Next Generation Network Traffic Monitoring and Anomaly Detection Petr Springl
2 INVEA-TECH University spin-off company 10 years of development, participation in EU funded projects project Liberouter and programmable hardware, 10 mil Euro invested, creation of world's unique technologies Company profile Strong academic background: CESNET, MU, VUT Founded 2007 Expansion onto foreign markets since 2010: UK, US, Canada, Germany, Japan and others Key products: FlowMon: network traffic monitoring ADS: detection of anomalies, operational and security issues FlowMon + ADS = a complete solution for monitoring and security 2/42
3 Reference GEÁNT2, Federica monitoring of 7 European backbones CZ Ministry of Defense (via VDI META) Korea Telecom AVG, Aegon CESNET T-Mobile and more... 3/42
4 Agenda Network & Security interesting/surprising statistics? standard security tools overview Network Traffic & Security Monitoring FlowMon Solution Introduction Use Case Discovery of Botnet Chuck Norris 4/42
5 Network & Security
6 Malware Source: McAfee Threats Report: Fourth Quarter /42
7 Botnets infected devices Source: McAfee Threats Report: Fourth Quarter /42
8 Botnets infected devices Source: McAfee Threats Report: Fourth Quarter /42
9 Attackers Motivation Source: Radware 2011 Global Application & Network Security Report 9/42
10 Data Breaches Source: McAfee Threats Report: Fourth Quarter /42
11 Botnet as a Service Source: McAfee Threats Report: First Quarter /42
12 How to face attacks Attacks against any organization (SMBs, enterprises, government, education or other organizations) are rising Attackers use different approaches and attack types hacking, cracking, dictionary attacks, DOS/DDOS attacks, attacks against services, social engineering, identity theft, botnets Organizations don t know which specific threats to fight Many attacks are undetectable by standard approaches Advanced Persistent Threats, Zero-Day attacks, Polymorphic malware, What possibilities are there for organizations? for ISPs? 12/42
13 Organizations Perimeter Security firewall, IDS/IPS, UTM, application firewall, web filter, security, remote access Endpoint Security antivirus, personal firewall, antimalware, antirootkit, endpoint DLP Internal Network Security network traffic visibility flow monitoring, NBA - Network Behavior Analysis, automatic anomalies detection 13/42
14 ISPs ISPs are in different situation Have to face to the same threats, but don t have so many possibilities how to do that ISPs shouldn t protect only themselves, but also help to protect their customers protect Internet from their customers 14/42
15 ISPs Network Elements Security switches, routers configuration, secure management, services Network Security routing, rate limiting, filtering, redundancy Incident Detection alert from customer, ISP or other IDS, syslogs, SNMP monitoring network traffic visibility flow monitoring, NBA - Network Behavior Analysis, automatic anomalies detection 15/42
16 Summary All the tools and approaches mentioned are very important from a security point of view Most are aimed at protection from known threats and attackers That s why continuous monitoring and detailed information about activities in the network is important provides complete visibility into network able to detect sophisticated attacks (APTs, zero-day attacks) - even that which are not detected by other approaches 16/42
17 Network Traffic & Security Monitoring
18 Flow Monitoring Principles IP flows monitoring packet headers analysis only content (packets payload) is not monitored Modern method for network monitoring NetFlow v5/v9 Cisco standard 18/42
19 Architecture Source of network statistics switches, routers, specialized probes or other devices network traffic monitoring - generate and export flow data Flow data collectors flow data storage, collection & analysis 19/42
20 Network Traffic Monitoring Benefits Complete Network Visibility real-time & historically TOP N statistics (users/customers, services, sites) user defined profiles (based on user filters) drill down up to any communication alerting & reporting Security Enhancement, Incidents Tracking Benefits also for network management fast, precise and effective troubleshooting network performance monitoring trending, capacity planning, traffic engineering IP traffic based accounting and billing network management costs reduction 20/42
21 Network Behavior Analysis (NBA) Automatic advanced analysis of flow (NetFlow) data Modern approach to network security Undesirable behavior patterns detection internal and external threats undesirable services and application Behavior analysis behavior profiles anomalies and suspicious behavior detection Behavior detection NBA is about higher visibility in the behavior of your network to cover gabs left by signature based mechanism. Paul E. Proctor, Vice President, GARTNER Network level Signature detection Host level 21/42
22 NBA Benefits Internal & external attacks detection Fast overview about any events in the network including problem indication Enables to fight modern sophisticated attacks Detection of threats which are undetectable by standard approaches Effective for encrypted traffic 22/42
23 FlowMon solution
24 FlowMon Network Under Control Innovative network traffic & security monitoring solution using IP flows Based on NetFlow v5/v9 and IPFIX technology Provides information about who communicates with whom, how long, what protocol, traffic volume and more Best price/performance ratio in the industry Solution for networks of all dimensions Exceptional customer benefits Your network under control! 24/42
25 FlowMon Architecture FlowMon Probes passive standalone source of network statistics (NetFlow / IPFIX data) FlowMon Collectors visualization and evaluation of network statistics FlowMon plugins FlowMon ADS - automatic traffic analysis for reveal operational & security issues 25/42
26 FlowMon Probe High-performance standalone probe - source of IP flow records in NetFlow v5,9 and IPFIX format L2/L3 invisible - transparent for monitored network Standard and hardware accelerated models Remote configuration via a user-friendly web GUI 10/100/1000 Ethernet, 10 GbE, IPv4, IPv6, MPLS, VLAN Maintenance-free appliance with simple configuration Built-in collector (data storage redundancy) 26/42
27 FlowMon Probe Models Compact rack mount (1U) NetFlow probes Standard models suitable for the most networks, excellent price/performance ratio performance more than 500 k packets per second for 1GbE port up to 5 M packets per second for 10GbE port models from 1x 100MbE port up to 4x 10GbE ports Hardware-accelerated models (Pro) suitable for large networks and backbone links wire speed performance 10GbE models available, 40/100GbE models available soon 27/42
28 FlowMon Collector Standalone appliance for long term storage of flow statistics from multiple sources (probes, routers, switches) Support for NetFlow/IPFIX/sFlow data storage & analysis Professional solution for mid-size and large networks RAID, redundant power, remote management storage capacity from 1TB up to hundreds TBs unique performance more than 200k flows/s processing 28/42
29 FlowMon Collector - GUI Graphs, tables and form for further data processing Top N statistics (users, sites, services) Predefined set of profiles/views for standard protocols User defined profiles (based on IP address or ports) Intelligent reporting (online/offline /pdf/csv reports) Profile support and automatic alerts ( , syslog, SNMP etc.) 29/42
30 FlowMon Plugins 30/42
31 FlowMon ADS Undesirable behavior detection Attacks Undesirable services Operational and configuration problems Behavior profiles computing Communication partners Anomaly detection Traffic volume and structure Intuitive user interface Immediate network problems indication Interactive event visualization Integration with information from DNS, WHOIS, geolocation services Complex filtering, alerting, reporting 31/42
32 FlowMon ADS Detection of undesirable patterns in communication Attacks (port scanning, dictionary attacks, DOS/DDOS, telnet protocol) Data traffic anomalies (DNS, multicast, non-standard communications) Undesirable applications (P2P networks, anonymizer) Internal security problems (viruses, spyware, botnets) Mail traffic (outgoing spam) Operational problem (delays, high traffic, reverse DNS records) 32/42
33 FlowMon Benefits Long-term statistics storage about traffic Network capacity planning Connectivity optimization Peering agreements optimization Attacks, anomalies and suspicious behavior detection Data retention law fulfillment Accounting and billing based on traffic amount Possibility to graphs and tables integration to your IS 33/42
34 Use Case Discovery of Botnet Chuck Norris prepared in cooperation with CSIRT-MU
35 Botnet Chuck Norris Lot of attempts from all over the world to connect to TELNET service discovered by network security monitoring (flow monitoring) at Masaryk University Who nowadays use TELNET??? Why do devices from all over the world try to connect to TELNET port? Following detailed analysis lead to botnet revelation 35/42
36 Botnet Chuck Norris Back tracking infected devices are ADSL modems, WIFI routers Analysis of infected device Connection to C&C server Analysis of botnet behavior 36/42
37 Botnet Chuck Norris Attacks linux servers ADSL modems, WIFI routers Infected devices try to infect other devices port scanning TELNET dictionary attack only 15 passwords!!!! connect to C&C central server, which send him commands (IRC) 37/42
38 Botnet Chuck Norris Compilation timestamp in pnscan tool July 2008 First file uploaded to distribution servers May 2009 Botnet discovery at Masaryk University December 2009 Trying to shutdown the botnet (CSIRT-MU) Chuck Norris v2 May 2010 Different modification till nowadays Hydra Aidra??? 38/42
39 Attacks Continue 39/42
40 Chuck Norris - summary Attacks poorly-configured Linux MIPSEL devices - ADSL modems, WIFI routers, users are not aware about the malicious activities missing anti-malware solution to detect it possible to manipulate with complete traffic to/from the network Attack based on trivial dictionary attack (15 passwords) Lot of network operators underestimated possibility of trivial attack Discovered at Masaryk University. The malware got the Chuck Norris moniker from a comment in its source code [R]anger Killato : in nome di Chuck Norris! 40/42
41 PLNOG 2012 Is network traffic & security monitoring interesting for you? Visit our next PLNOG 2012 FlowMon Network Traffic & Security Monitoring in Examples Tomorrow at 11:50 New Technology section Visit our booth and discuss with us 41/42
42 Thank you for your attention High-Speed Networking Technology Partner Petr Špringl INVEA-TECH a.s. U Vodárny 2965/ Brno Czech Republic 42/42
Driving Network Visibility
Flowmon Price List EUR Driving Network Visibility Flowmon Hardware Appliances... 2 Flowmon Virtual Appliances... 3 Flowmon Cloud... 3 Flowmon ADS Anomaly Detection System... 4 Flowmon DDoS Defender...
More informationFlowMon ADS implementation case study
FlowMon ADS implementation case study Kamil Doležel Kamil.dolezel@advaict.com AdvaICT, a.s. Brno, Czech Republic Abstract FlowMon ADS implementation provides completely new insight into networks of all
More informationNetwork Security Monitoring with Flow Data
Network Security Monitoring with Flow Data IT Monitoring in Enterprises NPMD (Network Performance Monitoring & Diagnostics) SNMP basics Flow data for advanced analysis and troubleshooting Packet capture
More informationIt s Flow Time! The Role and Importance of Flow Monitoring in Network Operations and Security
It s Flow Time! The Role and Importance of Flow Monitoring in Network Operations and Security Pavel Minařík, Chief Technology Officer Neutral Peering Days 2018, The Hague Your customers depend on your
More informationFlow Measurement. For IT, Security and IoT/ICS. Pavel Minařík, Chief Technology Officer EMITEC, Swiss Test and Measurement Day 20 th April 2018
Flow Measurement For IT, Security and IoT/ICS Pavel Minařík, Chief Technology Officer EMITEC, Swiss Test and Measurement Day 20 th April 2018 What is Flow Data? Modern method for network monitoring flow
More informationFlows at Masaryk University Brno
Flows at Masaryk University Brno Jan Vykopal Masaryk University Institute of Computer Science GEANT3/NA3/T4 meeting October 21st, 2009, Belgrade Masaryk University, Brno, Czech Republic The 2nd largest
More informationFlow-based Traffic Visibility
Flow-based Traffic Visibility Operations, Performance, Security Pavel Minařík, Chief Technology Officer What is Flow Data? Modern method for network monitoring flow measurement Cisco standard NetFlow v5/v9,
More informationCase study: NBA as a Service at GÉANT
Case study: NBA as a Service at GÉANT Part of project NSHaRP Artur Kane kane@flowmon.com Our starts-liberouter Liberouter project 2002 (www.liberouter.org) acceleration of high-speed network application
More informationNetwork Visibility or Advanced Security?
Network Visibility or Advanced Security? TechDays 2017 Roman Cupka, Regional Country Manager SEE roman.cupka@flowmon.com Who We Are Founded in 2007 as a University Spinoff International Network & Security
More informationHOW TO ANALYZE AND UNDERSTAND YOUR NETWORK
Handbook HOW TO ANALYZE AND UNDERSTAND YOUR NETWORK Part 3: Network Traffic Monitoring or Packet Analysis? by Pavel Minarik, Chief Technology Officer at Flowmon Networks www.flowmon.com In previous two
More informationScrutinizer Flow Analytics
Scrutinizer Flow Analytics TM Scrutinizer Flow Analytics Scrutinizer Flow Analytics is an expert system that highlights characteristics about the network. It uses flow data across dozens or several hundred
More informationDDoS Protection in Backbone Networks
DDoS Protection in Backbone Networks The Czech Way Pavel Minarik, Chief Technology Officer Holland Strikes Back, 3 rd Oct 2017 Backbone DDoS protection Backbone protection is specific High number of up-links,
More informationFPGA accelerated application monitoring in 40 and 100G networks
FPGA accelerated application monitoring in 40 and 100G networks Campus network monitoring and security workshop CESNET workshop, 24.4.2014 Petr Kastovsky kastovsky@invea.com Company Introduction Czech
More informationDDoS Protection in Backbone Networks Deployed at Trenka Informatik AG (www.trenka.ch)
DDoS Protection in Backbone Networks Deployed at Trenka Informatik AG (www.trenka.ch) Pavel Minarik, Chief Technology Officer SwiNOG meeting, 9 th Nov 2017 Backbone DDoS protection Backbone protection
More informationCisco Cyber Range. Paul Qiu Senior Solutions Architect
Cisco Cyber Range Paul Qiu Senior Solutions Architect Cyber Range Service A platform to experience the intelligent Cyber Security for the real world What I hear, I forget What I see, I remember What I
More informationSeceon s Open Threat Management software
Seceon s Open Threat Management software Seceon s Open Threat Management software (OTM), is a cyber-security advanced threat management platform that visualizes, detects, and eliminates threats in real
More informationMonitoring and diagnostics of data infrastructure problems in power engineering. Jaroslav Stusak, Sales Director CEE, Flowmon Networks
Monitoring and diagnostics of data infrastructure problems in power engineering Jaroslav Stusak, Sales Director CEE, Flowmon Networks 35,000 kilometers of electric power, which feeds around 740,000 clients...
More informationCisco Stealthwatch Endpoint License
Data Sheet Cisco Stealthwatch Endpoint License With the Cisco Stealthwatch Endpoint License you can conduct in-depth, context-rich investigations into endpoints that exhibit suspicious behavior. In our
More informationIntelligent Cybersecurity for the Real World Scott Lovett Vice President, Global Security Sales
Intelligent Cybersecurity for the Real World Scott Lovett Vice President, Global Security Sales The Industrialization of Hacking Sophisticated Attacks, Complex Landscape Hacking Becomes an Industry Phishing,
More informationCISCO NETWORKS BORDERLESS Cisco Systems, Inc. All rights reserved. 1
CISCO BORDERLESS NETWORKS 2009 Cisco Systems, Inc. All rights reserved. 1 Creating New Business Models The Key Change: Putting the Interaction Where the Customer Is Customer Experience/ Innovation Productivity/
More informationFIREWALL PROTECTION AND WHY DOES MY BUSINESS NEED IT?
WHAT IS FIREWALL PROTECTION AND WHY DOES MY BUSINESS NEED IT? While firewalls started life simply protecting networks from outside hacks and attacks, the role of the firewall has greatly evolved to take
More informationCisco Cyber Threat Defense Solution 1.0
Cisco Cyber Threat Defense Solution 1.0 Contents 1. Introduction to the Cisco Cyber Threat Defense Solution 1.0 2. Technical overview of the Cisco Cyber Threat Defense Solution 1.0 3. Using the Cisco Cyber
More informationPerimeter Defenses T R U E N E T W O R K S E C U R I T Y DEPENDS ON MORE THAN
T R U E N E T W O R K S E C U R I T Y DEPENDS ON MORE THAN Perimeter Defenses Enterprises need to take their security strategy beyond stacking up layers of perimeter defenses to building up predictive
More informationCIH
mitigating at host level, 23 25 at network level, 25 26 Morris worm, characteristics of, 18 Nimda worm, characteristics of, 20 22 replacement login, example of, 17 signatures. See signatures SQL Slammer
More informationComprehensive datacenter protection
Comprehensive datacenter protection There are several key drivers that are influencing the DDoS Protection market: DDoS attacks are increasing in frequency DDoS attacks are increasing in size DoS attack
More informationNovetta Cyber Analytics
Know your network. Arm your analysts. Introduction Novetta Cyber Analytics is an advanced network traffic analytics solution that empowers analysts with comprehensive, near real time cyber security visibility
More informationCompare Security Analytics Solutions
Compare Security Analytics Solutions Learn how Cisco Stealthwatch compares with other security analytics products. This solution scales easily, giving you visibility across the entire network. Stealthwatch
More informationEU GENERAL DATA PROTECTION: TIME TO ACT. Laurent Vanderschrick Channel Manager Belgium & Luxembourg Stefaan Van Hoornick Technical Manager BeNeLux
EU GENERAL DATA PROTECTION: TIME TO ACT Laurent Vanderschrick Channel Manager Belgium & Luxembourg Stefaan Van Hoornick Technical Manager BeNeLux Is this the WAY you handle GDPR today 2 3 area s to consider
More informationAutomated Threat Management - in Real Time. Vectra Networks
Automated Threat Management - in Real Time Security investment has traditionally been in two areas Prevention Phase Active Phase Clean-up Phase Initial Infection Key assets found in the wild $$$$ $$$ $$
More informationFlexible network monitoring at 100Gbps. and beyond
Nadpis 1 Nadpis 2 Nadpis 3 Flexible network monitoring at 100Gbps Lukáš Kekely, Viktor Puš {kekely,pus}@cesnet.cz and beyond Jméno Příjmení Vysoké učení technické v Brně, Fakulta informačních technologií
More informationADVANCED, UNKNOWN MALWARE IN THE HEART OF EUROPE
ADVANCED, UNKNOWN MALWARE IN THE HEART OF EUROPE AGENDA Network Traffic Analysis: What, Why, Results Malware in the Heart of Europe Bonus Round 2 WHAT: NETWORK TRAFFIC ANALYSIS = Statistical analysis,
More informationFrom Signature-Based Towards Behaviour-Based Anomaly Detection (Extended Abstract)
From Signature-Based Towards Behaviour-Based Anomaly Detection (Extended Abstract) Pavel Minarik, Jan Vykopal Masaryk University CZECH REPUBLIC minarik@ics.muni.cz / vykopal@ics.muni.cz INTRODUCTION It
More informationCisco 5921 Embedded Services Router
Data Sheet Cisco 5921 Embedded Services Router The Cisco 5921 Embedded Services Router (ESR) is a Cisco IOS software router application. It is designed to operate on small, low-power, Linux-based platforms
More informationWatchGuard Total Security Complete network protection in a single, easy-to-deploy solution.
WatchGuard Total Security Complete network protection in a single, easy-to-deploy solution. Total Security. A stateful packet firewall, while essential, simply isn t enough anymore. The reality is that
More informationSeqrite Endpoint Security
Enterprise Security Solutions by Quick Heal Integrated enterprise security and unified endpoint management console Enterprise Suite Edition Product Highlights Innovative endpoint security that prevents
More information68 Insider Threat Red Flags
68 Insider Threat Red Flags Are you prepared to stop the insider threat? Enterprises of all shapes and sizes are taking a fresh look at their insider threat programs. As a company that s been in the insider
More informationCyber Security at large scale
Cyber Security & Data Summit June 18 Cyber Security at large scale www.telesoft-technologies.com copyright 2017 by Telesoft Technologies. All rights reserved. Agenda Telesoft Introduction Large scale Challenges
More informationERT Threat Alert New Risks Revealed by Mirai Botnet November 2, 2016
Abstract The Mirai botnet struck the security industry in three massive attacks that shook traditional DDoS protection paradigms, proving that the Internet of Things (IoT) threat is real and the grounds
More informationMcafee Network Intrusion Detection System. Project Report >>>CLICK HERE<<<
Mcafee Network Intrusion Detection System Project Report Selecting an intrusion detection and prevention system vendor can be a IDS/IPS protection, the current network configuration and the project budget,
More informationCAMNEP: Multistage Collective Network Behavior Analysis System with Hardware Accelerated NetFlow Probes
CAMNEP: Multistage Collective Network Behavior Analysis System with Hardware Accelerated NetFlow Probes Martin Rehak, Pavel Celeda, Michal Pechoucek, Jiri Novotny CESNET, z. s. p. o. Gerstner Laboratory
More informationDefense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
More informationThe Eight Components of a Strong Cyber Security Defense System
The Eight Components of a Strong Cyber Security Defense System SEG Secure Email Gateway An appliance that provides anti-spam and anti-malware protection. It is installed on top of a corporation s Email
More informationAutomating Security Response based on Internet Reputation
Add Your Logo here Do not use master Automating Security Response based on Internet Reputation IP and DNS Reputation for the IPS Platform Anthony Supinski Senior Systems Engineer www.h3cnetworks.com www.3com.com
More informationMAKING THE CLOUD A SECURE EXTENSION OF YOUR DATACENTER
MAKING THE CLOUD A SECURE EXTENSION OF YOUR DATACENTER Bret Hartman Cisco / Security & Government Group Session ID: SPO1-W25 Session Classification: General Interest 1 Mobility Cloud Threat Customer centric
More informationSpecialized Security Services, Inc. REDUCE RISK WITH CONFIDENCE. s3security.com
Specialized Security Services, Inc. REDUCE RISK WITH CONFIDENCE s3security.com Security Professional Services S3 offers security services through its Security Professional Services (SPS) group, the security-consulting
More informationCisco 5921 Embedded Services Router
Data Sheet Cisco 5921 Embedded Services Router The Cisco 5921 Embedded Services Router (ESR) is a Cisco IOS software router. It is designed to operate on small, low-power, Linux-based platforms to extend
More informationTHE RSA SUITE NETWITNESS REINVENT YOUR SIEM. Presented by: Walter Abeson
THE RSA NETWITNESS SUITE REINVENT YOUR SIEM Presented by: Walter Abeson 1 Reality Goals GOALS VERSUS REALITY OF SIEM 1.0 Single compliance & security interface Analyze & prioritize alerts across various
More informationNETWORK THREATS DEMAN
SELF-DEFENDING NETWORK NETWORK THREATS DEMAN NEW SECURITY: STRATEGIES TECHNOLOGIES Self-Propagating Threats A combination of: self propagating threats Collaborative applications Interconnected environments
More informationConfiguring Antivirus Devices
CHAPTER 9 Revised: November 11, 2007 Antivirus (AV) devices provide detection and prevention against known viruses and anomalies. This chapter describes how to configure and add the following devices and
More informationSynchronized Security
Synchronized Security 2 Endpoint Firewall Synchronized Security Platform and Strategy Admin Manage All Sophos Products Self Service User Customizable Alerts Partner Management of Customer Installations
More informationCOMPUTER NETWORK SECURITY
COMPUTER NETWORK SECURITY Prof. Dr. Hasan Hüseyin BALIK (9 th Week) 9. Firewalls and Intrusion Prevention Systems 9.Outline The Need for Firewalls Firewall Characterictics and Access Policy Type of Firewalls
More informationSecuring Your Most Sensitive Data
Software-Defined Access Securing Your Most Sensitive Data Company Overview Digital Growth Means Digital Threats Digital technologies offer organizations unprecedented opportunities to innovate their way
More informationKaspersky Open Space Security
Kaspersky Open Space Security Flexible security for networks and remote users Kaspersky Open Space Security Kaspersky Open Space Security offers new flexibility to network security by extending beyond
More informationIronPort C100 for Small and Medium Businesses
I R O N P O R T E M A I L S E C U R I T Y A P P L I A N C E S S I M P L E I N S TA L L AT I O N, E A S Y M A N A G E M E N T, A N D P O W E R F U L P R O T E C T I O N F O R Y O U R E M A I L I N F R A
More informationUTM 5000 WannaCry Technote
UTM 5000 WannaCry Technote The news is full of reports of the massive ransomware infection caused by WannaCry. Although these security threats are pervasive, and ransomware has been around for a decade,
More informationMaximize Network Visibility with NetFlow Technology. Adam Powers Chief Technology Officer Lancope
Maximize Network Visibility with NetFlow Technology Adam Powers Chief Technology Officer Lancope Agenda What is NetFlow h Introduction to NetFlow h NetFlow Examples NetFlow in Action h Network Operations
More informationplixer Scrutinizer Competitor Worksheet Visualization of Network Health Unauthorized application deployments Detect DNS communication tunnels
Scrutinizer Competitor Worksheet Scrutinizer Malware Incident Response Scrutinizer is a massively scalable, distributed flow collection system that provides a single interface for all traffic related to
More informationDelivering Integrated Cyber Defense for the Cloud Generation Darren Thomson
Delivering Integrated Cyber Defense for the Generation Darren Thomson Vice President & CTO, EMEA Region Symantec In 2009 there were 2,361,414 new piece of malware created. In 2015 that number was 430,555,582
More informationAdvanced Threat Intelligence to Detect Advanced Malware Jim Deerman
Advanced Threat Intelligence to Detect Advanced Malware Jim Deerman jdeerman@isc8.com Safe Harbor Statement All statements included or incorporated by reference in these slides, other than statements or
More informationSecurity. Risk Management. Compliance.
Richard Nichols Netwitness Operations Director, RSA Security. Risk Management. Compliance. 1 Old World: Static Security Static Attacks Generic, Code-Based Static Infrastructure Physical, IT Controlled
More informationTraining UNIFIED SECURITY. Signature based packet analysis
Training UNIFIED SECURITY Signature based packet analysis At the core of its scanning technology, Kerio Control integrates a packet analyzer based on Snort. Snort is an open source IDS/IPS system that
More informationCopyright 2011 Trend Micro Inc.
Copyright 2011 Trend Micro Inc. 2008Q1 2008Q2 2008Q3 2008Q4 2009Q1 2009Q2 2009Q3 2009Q4 2010Q1 2010Q2 2010Q3 2010Q4 2011Q1 2011Q2 2011Q3 2011Q4 M'JPY Cloud Security revenue Q to Q Growth DeepSecurity/Hosted/CPVM/IDF
More informationFIREWALL BEST PRACTICES TO BLOCK
Brought to you by Enterprie Control Systems FIREWALL BEST PRACTICES TO BLOCK Recent ransomware attacks like Wanna and Petya have spread largely unchecked through corporate networks in recent months, extorting
More informationProtecting Against Online Fraud. F5 EMEA Webinar August 2014
Protecting Against Online Fraud F5 EMEA Webinar August 2014 Agenda Fraud threat trends and business challenges Web fraud protection Mobile fraud protection Security operations center Example architecture
More informationMonitoring network bandwidth on routers and interfaces; Monitoring custom traffic on IP subnets and IP subnets groups; Monitoring end user traffic;
NetVizura NetFlow Analyzer enables you to collect, store and analyze network traffic data by utilizing Cisco NetFlow, IPFIX, NSEL, sflow and compatible netflow-like protocols. It allows you to visualize
More informationBuilt-in functionality of CYBERQUEST
CYBERQUEST Knows everything Built-in functionality of CYBERQUEST Summary Demonstration of CyberQuest functionality E-mail: office@nextgensoftware.solutions Content Intro... 3 Built-in functionality of CYBERQUEST...
More informationEMERGING THREATS & STRATEGIES FOR DEFENSE. Paul Fletcher Cyber Security
EMERGING THREATS & STRATEGIES FOR DEFENSE Paul Fletcher Cyber Security Evangelist @_PaulFletcher Threats by Customer Environment Cloud Environment On Premise Environment 1.96% 0.13% 0.02% application-attack
More informationEmpower stakeholders with single-pane visibility and insights Enrich firewall security data
SonicWall Analytics Transforming data into information, information into knowledge, knowledge into decisions and decisions into actions SonicWall Analytics provides an eagle-eye view into everything that
More informationIntel Security Advanced Threat Defense Threat Detection Testing
Intel Security Advanced Threat Defense Threat Detection Testing DR150724C July 2015 Miercom www.miercom.com Contents 1.0 Executive Summary... 3 2.0 Overview... 4 Products Tested... 4 3.0 How We Did It...
More informationIntelligent and Secure Network
Intelligent and Secure Network BIG-IP IP Global Delivery Intelligence v11.2 IP Intelligence Service Brian Boyan - b.boyan@f5.com Tony Ganzer t.ganzer@f5.com 2 Agenda Welcome & Intro Introduce F5 IP Intelligence
More informationEN6200 Series Feature Sheet
+ 7500 Successful Installation EN6200 Series Feature Sheet Security Solutions Antivirus UTM AAA User Management VPN Connectivity www.tacitine.com EN 6200 Series Unified Threat Management with AAA Hotspot
More informationACS-3921/ Computer Security And Privacy. Chapter 9 Firewalls and Intrusion Prevention Systems
ACS-3921/4921-001 Computer Security And Privacy Chapter 9 Firewalls and Intrusion Prevention Systems ACS-3921/4921-001 Slides Used In The Course A note on the use of these slides: These slides has been
More informationSales Training
Sales Training Extensible Content Security 16.03.2010 2009 WatchGuard Technologies Market Opportunity Total Addressable Market, ($M) Total Addressable Market by Segment, ($M) 16,000 14,000 11.2% CAGR 16,000
More informationHardware Acceleration in Computer Networks. Jan Kořenek Conference IT4Innovations, Ostrava
Hardware Acceleration in Computer Networks Outline Motivation for hardware acceleration Longest prefix matching using FPGA Hardware acceleration of time critical operations Framework and applications Contracted
More informationWHITEPAPER The Firewall Market
WHITEPAPER The Firewall Market Choosing The Right Product Author SecureData May 2012 CONTENTS Executive Summary...2 Part 2: Analysis of key findings... 3 Part 3: Summary...6 Appendix...6 Introduction Firewalls
More informationStopping Advanced Persistent Threats In Cloud and DataCenters
Stopping Advanced Persistent Threats In Cloud and DataCenters Frederik Van Roosendael PSE Belgium Luxembourg 10/9/2015 Copyright 2013 Trend Micro Inc. Agenda How Threats evolved Transforming Your Data
More informationCato Cloud. Solution Brief. Software-defined and Cloud-based Secure Enterprise Network NETWORK + SECURITY IS SIMPLE AGAIN
Cato Cloud Software-defined and Cloud-based Secure Enterprise Network Solution Brief NETWORK + SECURITY IS SIMPLE AGAIN Legacy WAN and Security Appliances are Incompatible with the Modern Enterprise The
More informationCisco Stealthwatch Improves Threat Defense with Network Visibility and Security Analytics
Solution Overview Cisco Stealthwatch Improves Threat Defense with Network Visibility and Security Analytics BENEFITS Gain visibility across all network conversations, including east-west and north-south
More informationBuilding Resilience in a Digital Enterprise
Building Resilience in a Digital Enterprise Top five steps to help reduce the risk of advanced targeted attacks To be successful in business today, an enterprise must operate securely in the cyberdomain.
More informationThe Future of Threat Prevention
The Future of Threat Prevention Bricata is the leading developer of Next Generation Intrusion Prevention Systems (NGIPS) technology, providing innovative, disruptive, high-speed, high-performance network
More informationChapter 9. Firewalls
Chapter 9 Firewalls The Need For Firewalls Internet connectivity is essential Effective means of protecting LANs Inserted between the premises network and the Internet to establish a controlled link however
More informationSIEM (Security Information Event Management)
SIEM (Security Information Event Management) Topic: SECURITY and RISK Presenter: Ron Hruby Topics Threat landscape Breaches and hacks Leadership and accountability Evolution of security technology What
More informationCato Cloud. Software-defined and cloud-based secure enterprise network. Solution Brief
Cato Cloud Software-defined and cloud-based secure enterprise network Solution Brief Legacy WAN and Security Appliances are Incompatible with the Modern Enterprise Cato Networks: Software-defined and Cloud-based
More informationCisco s Appliance-based Content Security: IronPort and Web Security
Cisco s Appliance-based Content Security: IronPort E-mail and Web Security Hrvoje Dogan Consulting Systems Engineer, Security, Emerging Markets East 2010 Cisco and/or its affiliates. All rights reserved.
More informationPalo-Alto PCNSE7. Palo Alto Networks Certified Network Security Engineer.
Palo-Alto PCNSE7 Palo Alto Networks Certified Network Security Engineer http://killexams.com/exam-detail/pcnse7 Answer: B, E (https://www.paloaltonetworks.com/documentation/60/panorama/panorama adminguide/se
More informationGladiator Incident Alert
Gladiator Incident Alert Allen Eaves Sabastian Fazzino FINANCIAL PERFORMANCE RETAIL DELIVERY IMAGING PAYMENT SOLUTIONS INFORMATION SECURITY & RISK MANAGEMENT ONLINE & MOBILE 1 2016 Jack Henry & Associates,
More informationMcAfee Network Security Platform Administration Course
McAfee Network Security Platform Administration Course Education Services administration course The McAfee Network Security Platform Administration course from McAfee Education Services is an essential
More informationProxy server is a server (a computer system or an application program) that acts as an intermediary between for requests from clients seeking
NETWORK MANAGEMENT II Proxy Servers Proxy server is a server (a computer system or an application program) that acts as an intermediary between for requests from clients seeking resources from the other
More informationFEATURE OVERVIEW. FGX Series firewall. Last updated February 2012
FEATURE OVERVIEW FGX Series firewall Last updated February 2012 Celestix FGX Features Deep Packet Firewall VPN Virtual system DoD/DDoS attach defense Intrusion protection Anti-virus Anti-spam URL iltering
More informationAgile Security Solutions
Agile Security Solutions Piotr Linke Security Engineer CISSP CISA CRISC CISM Open Source SNORT 2 Consider these guys All were smart. All had security. All were seriously compromised. 3 The Industrialization
More informationCIRT: Requirements and implementation
CIRT: Requirements and implementation By : Muataz Elsadig Sudan CERT Joint ITU-ATU Workshop on Cyber-security Strategy in African Countries Khartoum, Republic of Sudan, 24 26 July 2016 There is no globally
More informationCheck Point 1100 Appliances Frequently Asked Questions
CHECK POINT SOFTWARE TECHNOLOGIES Check Point 1100 Appliances Frequently Asked Questions Table of Contents Overview:... 2 Ordering Information:... 3 Technology:... 4 Hardware:... 6 Performance:... 6 Updated
More information2017 Annual Meeting of Members and Board of Directors Meeting
2017 Annual Meeting of Members and Board of Directors Meeting Dan Domagala; "Cybersecurity: An 8-Point Checklist for Protecting Your Assets" Join this interactive discussion about cybersecurity trends,
More informationBe certain. MessageLabs Intelligence: May 2006
Be certain MessageLabs Intelligence: May 2006 Introduction Welcome to the May edition of the MessageLabs Intelligence monthly report. This report provides the latest threat trends for May 2006 to keep
More informationCroatian National CERT ACDC project Darko Perhoc, Head of National CERT CISSP, CEH, CCNP Security R&S,CCDP
Croatian National CERT ACDC project Darko Perhoc, Head of National CERT CISSP, CEH, CCNP Security R&S,CCDP Croatian National CERT (HR-CERT) mission: Promoting and preserving information security of public
More informationn Given a scenario, analyze and interpret output from n A SPAN has the ability to copy network traffic passing n Capacity planning for traffic
Chapter Objectives n Understand how to use appropriate software tools to assess the security posture of an organization Chapter #7: Technologies and Tools n Given a scenario, analyze and interpret output
More informationAnalyzing Huge Data for Suspicious Traffic. Christian Landström, Airbus DS
Analyzing Huge Data for Suspicious Traffic Christian Landström, Airbus DS Topics - Overview on security infrastructure - Strategies for network defense - A look at malicious traffic incl. Demos - How Wireshark
More informationBusiness Strategy Theatre
Business Strategy Theatre Security posture in the age of mobile, social and new threats Steve Pao, GM Security Business 01 May 2014 In the midst of chaos, there is also opportunity. - Sun-Tzu Security:
More information3 Ways to Prevent and Protect Your Clients from a Cyber-Attack. George Anderson Product Marketing Director Business October 31 st 2017
3 Ways to Prevent and Protect Your Clients from a Cyber-Attack George Anderson Product Marketing Director Business October 31 st 2017 Agenda One ounce of prevention is worth a pound of protection 01 Aiming
More informationA Unified Threat Defense: The Need for Security Convergence
A Unified Threat Defense: The Need for Security Convergence Udom Limmeechokchai, Senior system Engineer Cisco Systems November, 2005 1 Agenda Evolving Network Security Challenges META Group White Paper
More information