Implementation of an Automated Virus Response System
|
|
|
- Miranda Underwood
- 5 years ago
- Views:
Transcription
1 Implementation of an Automated Virus Response System October 26, 2004 Todd Acheson, David Alexander, Terry Kelleher, Brandon Saunders {acheson alexandd kelleher Communication Network Services
2 Introduction Onslaught in late summer of 2003 of worms like Blaster and Nachi exploited the RPC DCOM vulnerability in MS Windows Could Ohio University (OU) handle the onslaught? Communication Network Services 2
3 OU Environment Open, heterogeneous network No firewall 13,000 nodes 650 switches Wireless network Separate IP address space for ResNet and Admin networks Communication Network Services 3
4 Network Diagram Communication Network Services 4
5 OU Environment (cont.) Mixture of OU-owned and user-owned desktop machines (4,500 OU-owned machines in the dorms) Potential explosive rate of infection at the start of fall quarter when thousands of machines arrive and connect to the network Less than a month to develop and deploy a solution Communication Network Services 5
6 Related Work Quarantine (Zou et al.) Block infected hosts from the network for short periods of time Can mask the problem Communication Network Services 6
7 Related Work (cont.) Throttling (Williamson) Limit rate of anomalous traffic coming out of a host Requires changes to host network stack Can mask the problem Communication Network Services 7
8 Related Work (cont.) Gatekeeper (UConn and U of Florida) Restrict a host s network access until it has been cleaned Can t track ongoing state of host Requires network infrastructure changes Communication Network Services 8
9 Related Work (contd.) Hybrid Gatekeeper/Intrusion-Prevention Cisco Security Agent Agent gatekeeper installed on host Agent can be compromised Requires installation and management of host software Vendor dependent Communication Network Services 9
10 Automated Virus Response System Developed tool based on quarantine method Leveraged existing work at CNS (Network Metadata Infrastructure) Didn t require network or host changes Rapid deployment Self-correcting Does not mask the problem Forces user education and problem correction Detect infected machines and automatically block them from the network Communication Network Services 10
11 Communication Network Services 11 Implementation
12 Network Metadata Infrastructure (NMI) Abstract framework for collecting and storing network metadata Used to locate a device on the network in near real-time Maps IP address to switch port and location Communication Network Services 12
13 Detection Methods Signature-based Examine Argus data for signatures of Virus/Worms (Blaster, Nachi, SQL Slammer, etc.) Behavior-based Look for anomalous behavior (eg. Spam-bot) Heuristics limit false positives Number of neighbors White-list Grey-list/Intervention Static IP addresses vs. DHCP addresses Communication Network Services 13
14 Automated Detection Schemes Nachi Blaster Netsky Glider MyDoom Spam-bot Naldem Sdbot Sasser SQL Slammer Blubster Communication Network Services 14
15 Port Block System Once detected, NMI is used to find the switch port where a host connects to the network The system uses SNMP to automatically disable the switch port or wireless connection Results are stored in a database Administrative interface to the database is used by support staff to enable ports upon user assertion Communication Network Services 15
16 Administrative Input Communication Network Services 16
17 Results Port block statistics 5,145 total port blocks as from 9/03 to 10/04 Average time to disable port = 51 sec. Average time to enable port = 32 sec. Peak blocks/month = 1,062 (9/03) Peak blocks/day = 381 (3/8/04) Peak blocks/hour = 57 (2/25/04) Communication Network Services 17
18 Results (cont.) Extensibility Blubster (September 2004) Rogue DHCP server detection (Future) Unblock by assertion Self-correcting Quick User education Good neighbor Infected hosts removed from global Internet rather than masking the problem on the local network Communication Network Services 18
19 Results (cont.) Blaster/Nachi Port Blocks by Day (September 2003) Port Blocks ResNet Admin Day Communication Network Services 19
20 Results (cont.) Port Blocks By Reason Number of Port Blocks spam-bot nachi blubster sasser sdbot netsky glider bagle sql-slammer mydoom other/manual Communication Network Services 20
21 Issues Notifying users Transient users Malicious denial of service attacks False positives Intervention records Timing New detection schemes created manually Communication Network Services 21
22 Conclusions Tool was initially developed to prevent a disaster and not prove a concept The tool met the goal of weathering the Nachi/Blaster outbreak in September 2003 without network disruption The tool has continued to evolve to handle new classes of problems Work to empirically analyze effectiveness of port block system is ongoing Communication Network Services 22
Defense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
SYMANTEC ENTERPRISE SECURITY. Symantec Internet Security Threat Report September 2005 Power and Energy Industry Data Sheet
SYMANTEC ENTERPRISE SECURITY Symantec Internet Security Threat Report September 00 Power and Energy Industry Data Sheet An important note about these statistics The statistics discussed in this document
Hazardous Endpoints Protecting Your Network From Its Own Devices
Hazardous Endpoints Protecting Your Network From Its Own Devices Abstract The increasing number and types of attacks launched from endpoint devices can no longer be ignored, and organizations must shift
Malware Research at SMU. Tom Chen SMU
Malware Research at SMU Tom Chen SMU tchen@engr.smu.edu www.engr.smu.edu/~tchen Outline About SMU and Me Virus Research Lab Early Worm Detection Epidemic Modeling New Research Interests TC/BT/11-5-04 SMU
White Paper February McAfee Policy Enforcer. Securing your endpoints for network access with McAfee Policy Enforcer.
White Paper February 2006 McAfee Policy Enforcer Securing your endpoints for network access with McAfee Policy Enforcer White Paper February 2006 Page 2 Table of Contents Executive Summary 3 Enforcing
The UCSD Network Telescope
The UCSD Network Telescope Colleen Shannon cshannon @ caida.org NSF CIED Site Visit November 22, 2004 UCSD CSE Motivation Blocking technologies for automated exploits is nascent and not widely deployed
NETWORK THREATS DEMAN
SELF-DEFENDING NETWORK NETWORK THREATS DEMAN NEW SECURITY: STRATEGIES TECHNOLOGIES Self-Propagating Threats A combination of: self propagating threats Collaborative applications Interconnected environments
Configuring Anomaly Detection
CHAPTER 12 This chapter describes how to create multiple security policies and apply them to individual virtual sensors. It contains the following sections: Understanding Policies, page 12-1 Anomaly Detection
CIH
mitigating at host level, 23 25 at network level, 25 26 Morris worm, characteristics of, 18 Nimda worm, characteristics of, 20 22 replacement login, example of, 17 signatures. See signatures SQL Slammer
ROYAL INSTITUTE OF INFORMATION & MANAGEMENT
ROYAL INSTITUTE OF INFORMATION & MANAGEMENT MCSE SYLLABUS Course Contents : Exam 70-290 : Managing and Maintaining a Microsoft Windows Server 2003: Managing Users, Computers and Groups. Configure access
Symantec Client Security. Integrated protection for network and remote clients.
Symantec Client Security Integrated protection for network and remote clients. Complex Internet threats require comprehensive security. Today's complex threats require comprehensive security solutions
IBM Managed Security Services for security intelligence
IBM Global Services April 2005 IBM Managed Security Services for security intelligence By: David Mackey, security intelligence Jeff Lahann, security intelligence Page 2 Contents 2 Foreword 3 Introduction
Cisco ASA 5500 Series IPS Edition for the Enterprise
Cisco ASA 5500 Series IPS Edition for the Enterprise Attacks on critical information assets and infrastructure can seriously degrade an organization s ability to do business. The most effective risk mitigation
Securing the Modern Data Center with Trend Micro Deep Security
Advania Fall Conference Securing the Modern Data Center with Trend Micro Deep Security Okan Kalak, Senior Sales Engineer okan@trendmicro.no Infrastructure change Containers 1011 0100 0010 Serverless Public
Configuring Anomaly Detection
CHAPTER 9 This chapter describes anomaly detection and its features and how to configure them. It contains the following topics: Understanding Security Policies, page 9-2 Understanding Anomaly Detection,
Tracking Global Threats with the Internet Motion Sensor
Tracking Global Threats with the Internet Motion Sensor Michael Bailey & Evan Cooke University of Michigan Timothy Battles AT&T Danny McPherson Arbor Networks NANOG 32 September 7th, 2004 Introduction
Annexure E Technical Bid Format
Annexure E Technical Bid Format ANTIVIRUS SOLUTION FOR MAIL SERVER SECURITY AND SERVER SECURITY FOR DESKTOP,LAPTOP Sr. No Description Compliance (Y/N) Remark 01 Must offer comprehensive client/server security
Fighting the. Botnet Ecosystem. Renaud BIDOU. Page 1
Fighting the Botnet Ecosystem Renaud BIDOU Page 1 Bots, bots, bots Page 2 Botnet classification Internal Structure Command model Propagation mechanism 1. Monolithic Coherent, all features in one binary
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 13
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 13 Announcements Project 2 is on the web. Due: March 15th Send groups to Jeff Vaughan (vaughan2@seas) today. Plan for today: Automatic
Deployment of security devices can result in significant financial savings from reduction or redirection of IT staff resources needed to deploy,
SECURITY APPLIANCES True Security Appliances reduce the complexity and increase the reliability of network security, while enhancing control, efficiency, and overall functionality for enterprises of all
Security in Mobile Ad-hoc Networks. Wormhole Attacks
Security in Mobile Ad-hoc Networks Wormhole Attacks What are MANETs Mobile Ad-hoc Network (MANET) is a collection of wireless mobile hosts without fixed network infrastructure and centralized administration.
A Unified Threat Defense: The Need for Security Convergence
A Unified Threat Defense: The Need for Security Convergence Udom Limmeechokchai, Senior system Engineer Cisco Systems November, 2005 1 Agenda Evolving Network Security Challenges META Group White Paper
CIS 551 / TCOM 401 Computer and Network Security. Spring 2006 Lecture 22
CIS 551 / TCOM 401 Computer and Network Security Spring 2006 Lecture 22 Nmap screen shot http://www.insecure.org/nmap http://www.insecure.org/nmap/nmap-fingerprinting-article.html 4/11/06 CIS/TCOM 551
Locking down a Hitachi ID Suite server
Locking down a Hitachi ID Suite server 2016 Hitachi ID Systems, Inc. All rights reserved. Organizations deploying Hitachi ID Identity and Access Management Suite need to understand how to secure its runtime
Security Gap Analysis: Aggregrated Results
Email Security Gap Analysis: Aggregrated Results Average rates at which enterprise email security systems miss spam, phishing and malware attachments November 2017 www.cyren.com 1 Email Security Gap Analysis:
Introducing Next Generation Symantec AntiVirus: Symantec Endpoint Protection. Bernard Laroche Endpoint security Product marketing
Introducing Next Generation Symantec AntiVirus: Symantec Endpoint Protection Bernard Laroche Endpoint security Product marketing Agenda 1 Organizational Risk and Endpoint Challenges 32 Symantec Endpoint
ForeScout Agentless Visibility and Control
ForeScout Agentless Visibility and Control ForeScout Technologies has pioneered an agentless approach to network security that effectively helps address the challenges of endpoint visibility and control
(Botnets and Malware) The Zbot attack. Group 7: Andrew Mishoe David Colvin Hubert Liu George Chen John Marshall Buck Scharfnorth
(Botnets and Malware) The Zbot attack Group 7: Andrew Mishoe David Colvin Hubert Liu George Chen John Marshall Buck Scharfnorth What Happened? Type of Attack Botnet - refers to group of compromised computers
BYOD the HP Way: Secure, Device-Agnostic Network Access Management Jochen Fischer Solution Architect (MASE) September 2013
BYOD the HP Way: Secure, Device-Agnostic Network Access Management Jochen Fischer Solution Architect (MASE) September 2013 Bring Your Own???? 2 Bring Your Own Device cannot be ignored About 50% Workers
SYMANTEC SECURITY UPDATE JUNE 2005
SYMANTEC SECURITY UPDATE JUNE 005 Symantec Security Update - June 005 Worldwide and APAC Monthly report examining recent high severity vulnerabilities, cyber attacks, malicious code and spam activity.
Configuring Anomaly Detection
CHAPTER 9 Caution Anomaly detection assumes it gets traffic from both directions. If the sensor is configured to see only one direction of traffic, you should turn off anomaly detection. Otherwise, when
CCNA R&S: Introduction to Networks. Chapter 11: It s a Network
CCNA R&S: Introduction to Networks Chapter 11: It s a Network Frank Schneemann 11.0.1.1 Introduction 11.0.1.2 Activity Did You Notice? Take a look at the two networks in the diagram. Visually compare and
Barracuda Advanced Threat Protection. Bringing a New Layer of Security for . White Paper
Barracuda Advanced Threat Protection Bringing a New Layer of Security for Email White Paper Evolving Needs for Protection Against Advanced Threats IT security threats are constantly evolving and improving,
Security Threats & Trends Arvind Sahay, Enterprise Manager India, McAfee
7/26/2005 Security Threats & Trends Arvind Sahay, Enterprise Manager India, McAfee 7/26/2005 Page 2 Outline Some Threats Current Trends Corporate Dilemma Challenges Security solutions available Q&A 7/26/2005
Agenda. Why we need a new approach to endpoint security. Introducing Sophos Intercept X. Demonstration / Feature Walk Through. Deployment Options
Agenda Why we need a new approach to endpoint security Introducing Sophos Intercept X Demonstration / Feature Walk Through Deployment Options Q & A 2 Endpoint Security has reached a Tipping Point Attacks
Securing Your Business Against the Diversifying Targeted Attacks Leonard Sim
Securing Your Business Against the Diversifying Targeted Attacks Leonard Sim Manager, Client & Partner Services, Asia 1 Agenda 2010 Threats Targeted Attacks Defense Against Targeted Attacks Questions 2
FIREWALL BEST PRACTICES TO BLOCK
Brought to you by Enterprie Control Systems FIREWALL BEST PRACTICES TO BLOCK Recent ransomware attacks like Wanna and Petya have spread largely unchecked through corporate networks in recent months, extorting
Endpoint Protection : Last line of defense?
Endpoint Protection : Last line of defense? First TC Noumea, New Caledonia 10 Sept 2018 Independent Information Security Advisor OVERVIEW UNDERSTANDING ENDPOINT SECURITY AND THE BIG PICTURE Rapid development
A Firewall Network System for Worm Defense in Enterprise Networks
1 A Firewall Network System for Worm Defense in Enterprise Networks Cliff C. Zou, Don Towsley, Weibo Gong {czou,gong}@ecs.umass.edu, towsley@cs.umass.edu Univ. Massachusetts, Amherst Technical Report:
1. Which network design consideration would be more important to a large corporation than to a small business?
CCNA 1 Chapter 11 v5.0 Exam Answers 2015 (100%) 1. Which network design consideration would be more important to a large corporation than to a small business? Internet router firewall low port density
Check Point DDoS Protector Simple and Easy Mitigation
Check Point DDoS Protector Simple and Easy Mitigation Jani Ekman janie@checkpoint.com Sales Engineer DDoS Protector 1 (D)DoS Attacks 2 3 4 DDoS Protector Behavioral DoS Protection Summary 2 What is an
CERT-In. Indian Computer Emergency Response Team ANTI VIRUS POLICY & BEST PRACTICES
CERT-In Indian Computer Emergency Response Team ANTI VIRUS POLICY & BEST PRACTICES Department of Information Technology Ministry of Communications and Information Technology Government of India Anti Virus
Comparison of Firewall, Intrusion Prevention and Antivirus Technologies
Comparison of Firewall, Intrusion Prevention and Antivirus Technologies (How each protects the network) Dr. Gaurav Kumar Jain Email: gaurav.rinkujain.jain@gmail.com Mr. Pradeep Sharma Mukul Verma Abstract
Imperva Incapsula Website Security
Imperva Incapsula Website Security DA T A SH E E T Application Security from the Cloud Imperva Incapsula cloud-based website security solution features the industry s leading WAF technology, as well as
INTRODUCING SECURITYPLUS FOR MDAEMON
INTRODUCING SECURITYPLUS FOR MDAEMON Alt-N Technologies is introducing SecurityPlus for MDaemon as a new product name for the next version of AntiVirus for MDaemon. Because SecurityPlus will include additional
Worm Detection, Early Warning and Response Based on Local Victim Information
Worm Detection, Early Warning and Response Based on Local Victim Information Guofei Gu, Monirul Sharif, Xinzhou Qin, David Dagon, Wenke Lee, and George Riley Georgia Institute of Technology ACSAC'04 1
SYMANTEC SECURITY UPDATE JUNE 2005
SYMANTEC SECURITY UPDATE JUNE 2005 Symantec Security Update - June 2005 Worldwide and Japan Monthly report examining recent high severity vulnerabilities, cyber attacks, malicious code and spam activity.
Security Assessment Checklist
Security Assessment Checklist Westcon Security Checklist - Instructions The first step to protecting your business includes a careful and complete assessment of your security posture. Our Security Assessment
GFI product comparison: GFI MailEssentials vs. Barracuda Spam Firewall
GFI product comparison: GFI MailEssentials vs. Barracuda Spam Firewall Features GFI MailEssentials Barracuda Spam Firewall Integrates with Microsoft Exchange Server 2007/2010/2013 Scans incoming and outgoing
Our Narrow Focus Computer Networking Security Vulnerabilities. Outline Part II
Our Narrow Focus 15-441 15-441 Computer Networking 15-641 Lecture 22 Security: DOS Peter Steenkiste Fall 2016 www.cs.cmu.edu/~prs/15-441-f16 Yes: Creating a secure channel for communication (Part I) Protecting
County of El Paso Purchasing Department 800 E. Overland Room 300 El Paso, Texas (915) / Fax: (915)
County of El Paso Purchasing Department 800 E. Overland Room 300 El Paso, Texas 79901 (915) 546-2048 / Fax: (915) 546-8180 www.epcounty.com ADDENDUM 1 To: From: All Interested Proposers Blanca Güereca,
Motorola AirDefense Retail Solutions Wireless Security Solutions For Retail
Motorola AirDefense Retail Solutions Wireless Security Solutions For Retail Wireless Risks in Retail The PCI Security Standards Council is an open global forum, founded by American Express, Discover Financial
FIREWALL PROTECTION AND WHY DOES MY BUSINESS NEED IT?
WHAT IS FIREWALL PROTECTION AND WHY DOES MY BUSINESS NEED IT? While firewalls started life simply protecting networks from outside hacks and attacks, the role of the firewall has greatly evolved to take
Changing face of endpoint security
Changing face of endpoint security S A N T H O S H S R I N I V A S A N C I S S P, C I S M, C R I S C, C E H, C I S A, G S L C, C G E I T D I R E C T O R S H A R E D S E R V I C E S, H C L T E C H N O L
GFI product comparison: GFI MailEssentials vs. McAfee Security for Servers
GFI product comparison: GFI MailEssentials vs. McAfee Security for Email Servers Features GFI MailEssentials McAfee Integrates with Microsoft Exchange Server 2003/2007/2010/2013 Scans incoming and outgoing
Protecting DNS Critical Infrastructure Solution Overview. Radware Attack Mitigation System (AMS) - Whitepaper
Protecting DNS Critical Infrastructure Solution Overview Radware Attack Mitigation System (AMS) - Whitepaper Table of Contents Introduction...3 DNS DDoS Attacks are Growing and Evolving...3 Challenges
Internet of Things. The Digital Oilfield: Security in SCADA and Process Control. Mahyar Khosravi
Internet of Things The Digital Oilfield: Security in SCADA and Process Control Mahyar Khosravi makhosra@cisco.com Critical infrastructures worldwide not ready to battle cyber attacks, claims new study.
Monterey County Office of Education Quarantine (Spam ) System - User Guide
Monterey County Office of Education Quarantine (Spam E-Mail) System - User Guide With the new Spam firewall recently deployed in the MCOE network, e-mail users now have more power and flexibility against
Chapter 11: It s a Network. Introduction to Networking
Chapter 11: It s a Network Introduction to Networking Small Network Topologies Typical Small Network Topology IT Essentials v5.0 2 Device Selection for a Small Network Factors to be considered when selecting
Free Download BitDefender Client Security 1 Year 50 PCs softwares download ]
![Free Download BitDefender Client Security 1 Year 50 PCs softwares download ]](/thumbs/94/120569721.jpg "Free Download BitDefender Client Security 1 Year 50 PCs softwares download ]")
Free Download BitDefender Client Security 1 Year 50 PCs softwares download ] Description: The foundation of business security The security requirements for any new or existing company no matter how large
A Survey of Defense Mechanisms Against DDoS Flooding A
DDoS Defense: Scope And A Survey of Defense Mechanisms Against DDoS Flooding Attacks IIT Kanpur IEEE COMMUNICATIONS SURVEYS & TUTORIALS, VOL. 15, NO. 4, FOURTH QUARTER 2013 DDoS Defense: Scope And Outline
The 2017 State of Endpoint Security Risk
The 2017 State of Endpoint Security Risk Attacks are evolving. As a result, today s organizations are struggling to secure their endpoints, and paying a steep cost for each successful attack. To discover
Data Sheet: Endpoint Security Symantec Multi-tier Protection Trusted protection for endpoints and messaging environments
Trusted protection for endpoints and messaging environments Overview creates a protected endpoint and messaging environment that is secure against today s complex data loss, malware, and spam threats controlling
Our Narrow Focus Computer Networking Security Vulnerabilities. IP-level vulnerabilities
Our Narrow Focus 15-441 15-441 Computer Networking 15-641 Lecture 22 Security: DOS Peter Steenkiste Fall 2014 www.cs.cmu.edu/~prs/15-441-f14 Yes: Creating a secure channel for communication (Part I) Protecting
Flashback.. Internet design goals. Security Part One: Attacks and Countermeasures. Why did they leave it out? Security Vulnerabilities
Flashback.. Internet design goals Security Part One: Attacks and Countermeasures 15-441 With slides from: Debabrata Dash,Nick Feamster, Vyas Sekar 15-411: F08 security 1 1. Interconnection 2. Failure resilience
IT Digital Chat. July 14, 2017
IT Digital Chat July 14, 2017 Agenda Strategic Goals & Action Plans Enterprise Firewall Project Overview Identity Management Update General Announcements 2 Strategic goals Transforming Teaching & Learning
External Supplier Control Obligations. Cyber Security
External Supplier Control Obligations Cyber Security Control Title Control Description Why this is important 1. Cyber Security Governance The Supplier must have cyber risk governance processes in place
McAfee Complete Endpoint Threat Protection Advanced threat protection for sophisticated attacks
McAfee Complete Endpoint Threat Protection Advanced threat protection for sophisticated attacks Key Advantages Stay ahead of zero-day threats, ransomware, and greyware with machine learning and dynamic
IBM Proventia Network Multi-Function Security MX1004
Delivering comprehensive protection from a single device IBM Proventia Network Multi-Function Security MX1004 Comprehensive, affordable network protection for any size business The IBM Proventia Network
Lecture 12. Application Layer. Application Layer 1
Lecture 12 Application Layer Application Layer 1 Agenda The Application Layer (continue) Web and HTTP HTTP Cookies Web Caches Simple Introduction to Network Security Various actions by network attackers
Hardening the Education. with NGFW. Narongveth Yutithammanurak Business Development Manager 23 Feb 2012
Hardening the Education IT Environment with NGFW Narongveth Yutithammanurak Business Development Manager 23 Feb 2012 Technology Trends Security Performance Bandwidth Efficiency Manageability Page 2 What
Trend Micro s SMB Solutions
Press to Advance to Next Slide Copyright 2004 Trend Micro, Inc. Trend Micro s SMB Solutions Trend Micro Sales Training Module RUNNING HEADER, 14 PT., ALL CAPS, Line Spacing=1 line COURSE OBJECTIVES
Real Security. In Real Time. White Paper. Preemptive Malware Protection through Outbreak Detection
Real Security. In Real Time. White Paper Preemptive Malware Protection through Detection Table of Contents Executive Summary...2 Response Time to New s The Achilles Heel of the Anti-Virus Industry...3
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 3 Protecting Systems
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 3 Protecting Systems Objectives Explain how to harden operating systems List ways to prevent attacks through a Web browser Define
CYBER SECURITY MALAYSIA AWARDS, CONFERENCE & EXHIBITION (CSM-ACE) Securing Virtual Environments
CYBER SECURITY MALAYSIA AWARDS, CONFERENCE & EXHIBITION (CSM-ACE) 2010 October 25 29, 2010 Kuala Lumpur Convention Centre Securing Virtual Environments Raimund Genes CTO Trend Micro The Changing Datacenter
Win32/Msblast: A Case Study from Microsoft s Perspective. Matthew Braverman Program Manager Microsoft Corporation
Win32/Msblast: A Case Study from Microsoft s Perspective Matthew Braverman Program Manager Microsoft Corporation mattbrav@microsoft.com Win32/Msblast & Win32/Sasser: Overview Msblast Sasser Advantage Vulnerability
Managed Endpoint Defense
DATA SHEET Managed Endpoint Defense Powered by CB Defense Next-gen endpoint threat detection and response DEPLOY AND HARDEN. Rapidly deploy and optimize endpoint prevention with dedicated security experts
Network Access Control Whitepaper
Network Access Control Whitepaper There is nothing more important than our customers. Enterasys Network Access Control Executive Summary With the increasing importance Network Access Control (NAC) plays
Flow-Level Traffic Analysis of the Blaster and Sobig Worm Outbreaks in an Internet Backbone
Flow-Level Traffic Analysis of the Blaster and Sobig Worm Outbreaks in an Internet Backbone Thomas Dübendorfer, Arno Wagner, Theus Hossmann, Bernhard Plattner ETH Zurich, Switzerland duebendorfer@tik.ee.ethz.ch
August knac! 10 (or more) ways to bypass a NAC solution. Ofir Arkin, CTO
knac! 10 (or more) ways to bypass a NAC solution August 2007 Ofir Arkin, CTO In Memory of Oshri Oz September 13, 1972 - May 27, 2007 Agenda What is NAC? NAC Basics 10 (or more) ways to bypass NAC Ofir
CS 356 Operating System Security. Fall 2013
CS 356 Operating System Security Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5 Database
INSIDE. Symantec AntiVirus for Microsoft Internet Security and Acceleration (ISA) Server. Enhanced virus protection for Web and SMTP traffic
Virus Protection & Content Filtering TECHNOLOGY BRIEF Symantec AntiVirus for Microsoft Internet Security and Acceleration (ISA) Server Enhanced virus protection for Web and SMTP traffic INSIDE The need
July 6 Rescheduled for July 13 Rinker Psychology. July 13 Rescheduled for July 20. Building Baughman Center Building 1604.
To: All CNS Wall Plate Customers From: Todd Hester; Wall Plate Project Deployment Manager, CNS; (352) 392 2341 Date: July 08 2008 [Revised from 6/30/08 original memo] Subject: Wall Plate Network Edge Protection
ISO27001 Preparing your business with Snare
WHITEPAPER Complying with ISO27001 Preparing your business with Snare T he technical controls imposed by ISO (International Organisation for Standardization) Standard 27001 cover a wide range of security
TRAPS ADVANCED ENDPOINT PROTECTION
TRAPS ADVANCED ENDPOINT PROTECTION Technology Overview Palo Alto Networks Traps White Paper Despite continuous investments in traditional and next-gen antivirus solutions, many organizations continue to
Feasibility study of scenario based self training material for incident response
24th Annual FIRST Conference Feasibility study of scenario based self training material for incident response June 21, 2012 Hitachi Incident Response Team Chief Technology and Coordination Designer Masato
How Cisco IT Upgraded Intrusion Prevention Software to Improve Endpoint Security
How Cisco IT Upgraded Intrusion Prevention Software to Improve Endpoint Security Cisco Security Agent Version 4.5 thwarts malicious behavior while reducing costs associated with virus and worm remediation.
Carbon Black PCI Compliance Mapping Checklist
Carbon Black PCI Compliance Mapping Checklist The following table identifies selected PCI 3.0 requirements, the test definition per the PCI validation plan and how Carbon Black Enterprise Protection and
TRAPS ADVANCED ENDPOINT PROTECTION
TRAPS ADVANCED ENDPOINT PROTECTION Technology Overview Palo Alto Networks White Paper Most organizations deploy a number of security products to protect their endpoints, including one or more traditional
Cisco ASA 5500 Series IPS Solution
Cisco ASA 5500 Series IPS Product Overview As mobile devices and Web 2.0 applications proliferate, it becomes harder to secure corporate perimeters. Traditional firewall and intrusion prevention system
Improving SCADA System Security
Improving SCADA System Security NPCC 2004 General Meeting Robert W. Hoffman Manager, Cyber Security Research Department Infrastructure Assurance and Defense Systems National Security Division, INEEL September
Lecture 12 Malware Defenses. Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides based on Bailey s ECE 422
Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides based on Bailey s ECE 422 Malware review How does the malware start running? Logic bomb? Trojan horse?
The Future of Threat Prevention
The Future of Threat Prevention Bricata is the leading developer of Next Generation Intrusion Prevention Systems (NGIPS) technology, providing innovative, disruptive, high-speed, high-performance network
Understanding Network Access Control: What it means for your enterprise
Understanding Network Access Control: What it means for your enterprise Network access control is a term that is highly used, but not clearly defined. By understanding the reasons for pursuing a network
CompTIA E2C Security+ (2008 Edition) Exam Exam.
CompTIA JK0-015 CompTIA E2C Security+ (2008 Edition) Exam Exam TYPE: DEMO http://www.examskey.com/jk0-015.html Examskey CompTIA JK0-015 exam demo product is here for you to test the quality of the product.
Item Brand & specification Quantity Remarks Antivirus software user Licenses for windows. McAfee Complete Endpoint Protection Business Suite (CEB)
ISLAMI BANK BANGLADESH LIMITED OPERAIONS WING, ENGINEERING DIVISION PROCUREMENT OF COMPUTER HARDWARE AND ACCESSORIES DEPARTMENT 20, DILKUSHA C/A (9 th Floor), DHAKA 1000. Annexure-A NOTICE INVITING TENDER
McAfee Endpoint Security Threat Prevention Product Guide - Windows
McAfee Endpoint Security 10.6.0 - Threat Prevention Product Guide - Windows COPYRIGHT Copyright 2019 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator,
DDoS Protector. Simon Yu Senior Security Consultant. Block Denial of Service attacks within seconds CISSP-ISSAP, MBCS, CEH
DDoS Protector Block Denial of Service attacks within seconds Simon Yu Senior Security Consultant CISSP-ISSAP, MBCS, CEH 2012 Check Point Software Technologies Ltd. [PROTECTED] All rights reserved. 2012
Fast Detection of Scanning Worm Infections
ast Detection of canning Worm Infections Jaeyeon Jung Arthur W. Berger MIT CAIL Harvard DEA This work is sponsored by the Department of Defense under the Air orce Contract 19628-00-C-0002. Opinions, interpretations,
Beyond Testing: What Really Matters. Andreas Marx CEO, AV-TEST GmbH
Beyond Testing: What Really Matters Andreas Marx CEO, AV-TEST GmbH Microsoft Security Response Alliance Summit 2013 - July 10th, 2013 1 AGENDA About AV-TEST GmbH Innovations and Presentations The AV-TEST