BITDEFENDER GRAVITYZONE TANEL JEVSTIGNEJEV ALTACOM

Transcription

1 BITDEFENDER GRAVITYZONE TANEL JEVSTIGNEJEV ALTACOM

2 BUKAREST RUMEENIA

3 KASUTAJAID

4 THE MOST ADVANCED CYBERSECURITY IN THE WORLD BITDEFENDER CLOUD PÄRINGUT PÄEVAS

5 ÜLE 120 OEM PARTNERI

6 BITDEFENDERI TOOTEPORTFELL

7 BITDEFENDER TÕHUS KAITSE Maik Morgenstein, AV-TEST Chief Technology Officer "Highly secure product which hardly slows down PC resources at all" AV Comparatives: Joint highest scores overall in 2015 and Received Advanced Plus awards in all 8 main categories and tests, wins gold award in proactive protection and file detection, and others.

8 BITDEFENDERI KIHILINE KAITSE URL BLOCKER HTTP / JS SCANNING SIGNATURES B-HAVE MACHINE LEARNING ANTI-ROOTKIT ATC & ANTI-EXPLOIT

9 BITDEFENDERI KIHILINE KAITSE

10 ZERO PERFORMANCE IMPACT BITDEFENDER PHOTON 2012 AASTAL TÕUSIS BITDEFENDER AV-COMPARATIVES PERFORMANCE TESTS TESTIDES #8 KOHALT #1

11 RANSOMWARE: ENDPOINT PROTECTION MATTERS 78% 93% of phishing s Of all ransomware came through an endpoint Source: Osterman research now contain some variant of ransomware. Companies that suffers from security incidents often invest in Endpoint Protection

12 BITDEFENDERI LUNAVARA KAITSE VACCINE ATC ANTI-EXPLOIT ML According to Bitdefender Labs, over 400,000 new malware/ransomware variants are created daily, and 99% are only seen once before they are modified. To date, there are roughly 2.8 million known unique samples of ransomware and the numbers keep growing, with DIY ransomware creation tools readily available.

13 HVI JUBA TESTITUD KAITSE SUUNATUD RÜNNETE VASTU Näiteks Carbanak, Turla, APT28, NetTraveler, Wild Neutron, Wannacry, Zeus jne.

14 Windows Server 2003 SP Exchange Windows XP SP3 - Windows 10 Mac OS x Red Hat Ent., CentOS, Ubuntu jne. ios 5.1+ ja Android 2.2+

15 BITDEFENDERI TOOTEPORTFELL

16 BITDEFENDERI TOOTEPORTFELL

17 BITDEFENDERI TEHNOLOOGIA

18

19 BITDEFENDER VIIRUSED, LUNAVARA JNE. NUMBRITES From new unique malware every day to in 6 years! Source: AV-Test in Germany.

20 Security Permutations Klientide reaktsioon kasutatakse mitmeid lahendusi koos

21 BITDEFENDER ENDPOINT SECURITY : HYPER-DETECT & SANDBOX SUBMISSIONS Threat Protection Stack (Pre-execution) Signatures B-HAVE 1. Detects Hacking Tools 2. Detects Suspicious network traffic 3. Detects Suspicious Files that are obfuscated using an unknown packer 4. Detects Ransomware Aggressively 5. Detects Greyware Files Classic Machine Learning Models Hyper-Detect Sandbox Submission Heuristic Bitdefender SANDBOX ANALYZER 1. Detonates suspicious files in an isolated environment 2. Performs in-depth, dynamic analysis of file behavior 3. Returns sample verdict and detailed analysis summary

22

23

24 Sandbox Report

25 LUNAVARA LEVIKU PEATAMINE Unauthorized Access Unauthorized Use delivery Exploit/install C&C privileged operations Resource Access Exfiltration Malicious Activity Social Engineering Drive-by download Attachments (exploit) Instructions/scripts, encryption keys Lateral movement/ search/ encrypt Data theft Defense Web traffic scanning Security Anti-Exploit Real-time process monitoring (ATC) Process termination URL black listing Machine learning antimalware Clean up Vaccine Quarantine App control Prevention Detection Remediation & Response

26 BITDEFENDER GRAVITYZONE

27 GRAVITYZONE ON-PREMISE

28 GRAVITYZONE DEPLOYMENT

29 GRAVITYZONE PLATFORM-AGNOSTIC SECURITY SOLUTION FOR DATACENTERS

30 SECURITY FOR VIRTUALIZED ENVIRONMENTS MULTIPLATFORM ARCHITECTURE GravityZone Control Center VM VM VM VM Security Server BEST with Central Scan

31 SECURITY FOR VIRTUALIZED ENVIRONMENTS MULTIPLATFORM ARCHITECTURE DB CS WS US SVA Database Communication Server Web Server Update Server Scanning Virtual Appliance (Security Server) DB CS WS US SVA SVA

32 SECURITY FOR EXCHANGE SECURING THE MESSAGING AND COLLABORATION ENVIRONMENT Bitdefender Security for Exchange provides antimalware, antispam, antiphishing, attachment and content filtering seamlessly integrated with the Microsoft Exchange Server.

33 SECURITY FOR EXCHANGE

34 SECURITY FOR ENDPOINTS

35 SECURITY FOR ENDPOINTS BEST SCANNING ENGINES Bitdefender Security Cloud Security Server HVI Local Scan Hybrid Scan Central Scan

36 Benefits Security Efficacy - detect sophisticated threats Low false positive Automatic actions to limit damages Better visibility Light weight, integrated agent, single pane of glass

37 GRAVITYZONE HVI

38 Attack techniques Advanced threats rely on attack techniques to get a foothold The number of techniques used by attackers to exploit code is very small: Buffer overflows Heap spray Code injection API hooking Techniques exploit software bugs to execute attacker code Rootkits Kernel exploits Zero-days

39 How does HVI work? Using Intel extensions (EPT) HVI SVA is granted access to protect guest memory. Using an understanding of guest memory, the SVA registers rules with XenServer that allow it to trap and inspect operations that are not permitted. Analyzes raw memory image of guest OS and applications by Hooks / 4k memory pages Audits access of those areas by the code running in VM Write attempts, execute attempts Allow or deny attempts decision provided by security logic

40 How does HVI work? NO AGENT runs in the VM Memory is monitored via Xen Malicious activity is blocked

41 How does HVI work? NO AGENT runs in the VM Memory is monitored via Xen Malicious activity can be blocked or sandboxed Remediation tools injected into VM

42 K&V

43