Products and Services

Transcription

1 Products and Services

2 VirusBlokAda 1 2 Metadefender-Threat Detection and Prevention Platform Metadefender Core technology includes scanning with many anti-malware engines, heuristics, file type detection, data sanitization, archive scanning, and other features that enable organizations to detect and prevent both known and unknown threats. Multi-scanning Engines Increase Detection Rates, Detect Unknown Threats, and Reduce Response Time to Outbreaks 30+ EMBEDDED ANTI-MALWARE ENGINES MULTI-SCANNING ENGINE FILE TYPE VERIFICATION ARCHIVE EXTRACTION 30+ SUPPORTED ARCHIVES ar, arj, cab, chm, cpio, cramfs, dmg, ext, fat, gpt, hfs, ihex, iso, lzh, lzma, mbr, msi, nsis, ntfs, qcow2, rar, rpm, squashfs, udf, uefi, vdi, vhd, vmdk, wim, xar, z Multi-scanning with Metadefender Core is designed to be effective, efficient, and fast. We leverage both signature and heuristic scanning from 30+ scan engines on premises and 40+ scan engines in the cloud to increase malware detection rates. The combined threat research from those engines (using a range of methods like behavioral analysis and emulation techniques) contribute to Metadefender's comprehensive detection of malware. Metadefender Core Package Options SIGNATURES & HEURISTICS* Workflow Engine DATA SANITIZATION 90+ DATA SANITIZATION ENGINES SUPPORT 15 FILE TYPES, doc, docx, xls, xlsx, ppt, pptx, rtf, html, jpeg,,, riff,, gif Windows Core 4 Core 8 Core 12 Core 16 Core 20 VULNERABILITY ENGINE OESIS UPDATE ENGINE VULNERABILITY ENGINE The Vulnerability Engine supports over a million binaries and 15,000 applications with support for version checks and reported known vulnerabilities. * Heuristics is a feature of every engine and can be turned on and off ON PREMISES AIR-GAP CLOUD These technologies are available for either cloud or on-premises deployements PRODUCT OFFERINGS Linux Core 1 Core 5 Core 10 Windows Custom Engines APIs KIOSK ENDPOINT POSTURE ENDPOINT FORENSICS PROXY VirusBlokAda

3 3 4 Data Sanitization Engines Absolute Protection from Unknown and Zero-day Attacks Metadefender's 90 data sanitization engines offer users flexibility by supporting 15 file types. The engines meticulously deconstruct and then reconstruct files in the most common formats to ensure virtually no usability impact. As part of the reconstruction process, the file type itself can be converted (e.g. from.docx to. or.) for even greater security. Vulnerability Engine Prevent Binaries with Known Vulnerabilities from Entering your Organization Identify known application vulnerabilities with their severity levels (critical, important, moderate, low, and unknown). The Vulnerability Engine supports over a million binaries and 15,000 applications with support for version checks and reported known vulnerabilities. FIRST SEEN 3 WEEKS LATER AFTER Scanning Scan engines found a track Scan engines found a track Detected only by heuristics Detected by heuristics and signature based AFTER Sanitization Scan engines found a track File Type Verification Engine Prevent Spoofed Files from Entering your Organization Spoofed files are a common technique used to exploit an organization s security system. By changing the file extension, it s easy to bypass the majority of existing systems that allow you to configure access based on file type. The Vulnerability Engine identifies and corrects over 1,000 file types, including: Engines List: File Types: DOC DOCX PPT PPTX XLS XLSX RTF HTML PDF JPG BMP PNG TIFF SVG GIF PDF IMAGE DOCUMENT TEXT EXECUTABLES GRAPHIC ARCHIVE MEDIA DOC DOCX PPT PPTX XLS XLSX RTF HTML PDF JPG BMP PNG TIFF SVG GIF PDF EML VMDK DOC TXT EXE DWG RAR MP3 doc docx txt html ppt pptx xls xlsx csv html rtf txt html gif e gif e gif e gif e gif e e eml/msg vmx vmdk doc one p/ppt rtf suo xls/xla w clb cpx cue htm html php inf, ini jnlp log rdp reg sql txt, xml apk ax com cpl dbf dll exe ins msi ocx pl scr sh bs, cel cdr, cpt dwg gif, ico, pcx, pdn pic, d, tga tif, 7z arj bh bz2 cab daa gz gzip, iso jar, lha lzh, rar tar, tgz war, xar z, zip 3g2 atp, avi flv, htc hsc, koz m4r, m4v mid, mov mp3, mp4 mpa, mpeg mpg, ogg prx, pva rm, swf wav, wma wmv, vmx

4 R 5 6 Archive Extraction Engine Prevent Archive Bombs from Entering your Organization and Speed up the Multi-scanning Process The Archive Extraction Engine supports dozens of archive formats, specializing in the most commonly used ones like: zip, pklite, 7z, jar, jarc, rar, rar5, tar, taz, iso, gzip, cab, arc, arj, lzh, rpm, deb, lzma, wim, sfx, and xz. Self-extracting archives created by 7zip and winrar are also supported. All Microsoft Office document formats (2007 and higher) are handled as archives when scanning (extracting and scanning each item inside the archive separately). OESIS Auto-update Engine Manage and Push Updates for Solutions Integrating with OESIS Framework OESIS Framework is updated on a constant basis. The OESIS auto-update engine enables granular update management by integration partners and their end-user administrators. ARCHIVE EXTRACTION Deployment Options Offline Online Cloud Support for all isolated (air gapped) networks. Easy update mechanism for engines and applications. Supported with autoupdates enabled for all anti-virus engines. Available via REST API or through a private deployment in your own cloud infrastructure.

5 7 8 Threat Prevention for Secure and Air-Gapped Networks EXTERNAL NETWORK Media processed according to user's profile Prevent Advanced Threats and Targeted Attacks All files being considered for transfer to a secure network are first scanned by Metadefender Core to check for potential threats, which is deployed either on the same system as Metadefender Kiosk or on the same network as a kiosk. Files entering an organization are encrypted and then deposited into the Secure File Transfer solution. File sharing is limited and based on configuration settings. M METADEFENDER KIOSK WITH METADEFENDER CORE Control Users and Data Flow All data and user traffic is recorded and made available for audit to provide insight for administrators. Based on the configuration settings, you can allow guests (such as contractors) using the system to upload files and have the option to integrate with Active Directory for better user control. Depending on how you choose to set up your configuration, you can permit both allowed and blocked files to enter the organization, potentially making blocked files only available to users with administrator roles. We recommend a separate Secure File Transfer instance for any blocked files so that malware analysts can investigate the potential threat further. Transfer through one-way connection DATA DIODE Limit Media Entering the Organization By using a data diode that only allows traffic to move one way, any leaking of information out of the network is impossible, enhancing the security needed for critical infrastructure. The organization will still remain secure and air gapped, and can eliminate the need to allow external media into the organization. INTERNAL NETWORK SFT SECURE FILE TRANSFER These best practices enforce tight restrictions at the network level, allowing data to enter the organization in a controlled and supervised manner, while still complying with regulations. ID User logs into secure portal and retrieves files

6 9 10 Available Security Modules Metadefender Kiosk offers a kiosk-based user interface that allows users to authenticate and analyze any media-based files after processing them with Metadefender Core's multi-scanning technology. Once processed, the files are sent to a secure location within the organization. Threat Prevention Metadefender adds a second layer of defense to protect organizations from ransomware and targeted attacks, integrating with existing gateway solutions including: gateway administrators can easily route inbound and outbound traffic through Metadefender Core to perform an extensive check using multi-scanning, file type verification, archive extraction and data sanitization technologies to increase detection of threats and to prevent unknown or targeted threats by disarming active content in attachments that might be malicious. Administrator Console Dashboard INCOMING ATTACHMENTS OUTGOING ATTACHMENTS Metadefender Secure File Transfer acts as a secure file storage solution, which is responsible not only for storing files received from the kiosk, but also for handling and auditing all data flows and user interactions. 34 SUSPICIOUS ATTACHMENTS 3 KNOWN MALWARE 5 PASSWORD PROTECTED OUT OF 412 INCOMING ATTACHMENTS 7 FILES SANITIZED 12 SUSPICIOUS ATTACHMENTS 2 KNOWN MALWARE 6 PASSWORD PROTECTED OUT OF 245 OUTGOING ATTACHMENTS 0 FILES SANITIZED Data Diode (recommended, though optional) also known as cross-domain solution is used to provide secure, one-way data transfer between low- and- high security networks. Access OPSWAT S data diode buying guide at htt:// to see a comparison of existing data diodes. 49 INCOMING THREATS DETECTED 20 OUTGOING THREATS DETECTED SUSPICIOUS KNOWN MALWARE SUSPICIOUS KNOWN MALWARE PASSWORD PROTECTED FILES SANITIZED PASSWORD PROTECTED FILES SANITIZED

7 11 12 Proxy Threat Prevention Metadefender adds a second layer of defense to protect organizations from ransomware and targeted attacks, exposing an ICAP interface that integrates with your existing web proxy or reverse proxy solution. Reverse Proxy Implementation R WEB SERVER Administrators can easily route inbound and outbound traffic through Metadefender Core to perform an extensive check using multi-scanning, file type verification, archive extraction, and data sanitization technologies to increase detection of threats and to prevent unknown or targeted threats. THE INTERNET WEB SERVER WEB SERVER METADEFENDER Metadefender Dashboard Web Proxy Implementation METADEFENDER FTP SERVER FIREWALL THE INTERNET WEB SERVER PROTECTED DATA HTTPS SERVER

8 13 14 Metadefender.com Metadefender.com is a threat intelligence platform with more than 1 billion submissions analyzed from millions of machines. Data collected is exposed through REST APIs, making integrations seamless and fast. Metadefender.com provides the following types of data: Metadefender Libraries Vast binary vulnerability database Comprehensive reputation service Binary classification for popular applications and OS Network traffic reported by each application Loaded libraries for each application Our reputation service computes the confidence level for each unique file based on: Its associated applications Vulnerabilities associated with these applications Reputation of the IP/domains to which these applications connect Digital signatures of associated applications Analysis by anti-malware engine partners Learn more about our Threat Intelligence Platform by visiting metadefender.com. Reputation P File P Hash P IP P URL Threat Intelligence P Vulnerability P Binary Classification P Malware Classification P Network Traffic P Shared Components P Operating System P Digital Signature P Portable Executable Info P Top Threats Demo Purposes P Scan Report P Data Sanitization P Dynamic Analysis - Available Soon! Network Connections for Common Applications

9 15 16 Support 24 hours/7 days a week OPSWAT is dedicated to delivering the best service, made possible through our three support centers located in San Francisco, Romania, and Vietnam. This enables us to provide true 24 hours a day/7 days a week support with an average response time of just two hours. Learn about our Standard, Gold, and Premium Customer Support offerings at Evaluating Metadefender To evaluate Metadefender, login to the OPSWAT Portal at portal.owat.com. Contacting Sales Contact sales@owat.com or visit for more information about licensing our technologies. We can also be reached at +1 (415) Support Centers San Francisco Romania Vietnam Sales Centers San Francisco Japan United Kingdom Washington DC R&D Centers San Franciso Hungary Romania Worldwide Support OPSWAT Headquarters in San Francisco, CA, USA Technical Support Global Offices Standard Gold Platinum San Francisco Hungary Japan 9 Hours 12 Hours 24 Hours (Headquarters) 398 Kansas St. San Francisco, CA 94103, USA H-8200 Veszprem Bajcsy-Zs. u.15. Hungary Grains Bldg. #61 Nihonbashi-Kakigara-cho, Chuo-Ku, Tokyo, Japan Romania United Kingdom Vietnam 8:00 to 17:00 Mon - Fri support 7:00 to 19:00 Mon - Fri & Phone support 24 Hours Everyday & Phone support Martin Luther Street, no.2, 4th Floor, Timisoara Romania Call: +44 (0) Fax: +44 (0) Harbour View Tower 35 Nguyen Hue, 1 4th floor, District 1 Ho Chi Minh city, Vietnam

10 ,000+ Satisfied Customers OPSWAT s Metadefender products are trusted by thousands of customers, including large corporations, financial institutions, and government and defenserelated agencies to provide comprehensive threat protection and prevention. GOVERNMENT DEFENSE ENERGY Certified Security Application Program OPSWAT certifications represent high performance, protection, usability, and ensured compatibility with 200,000,000 endpoints and leading network access controls. Applications awarded OPSWAT certification signify: P Compatibility with all leading CASB, NAC, SSL-VPN, and SSO solutions P Superior quality ratings from AV-TEST and/or AV-Comparatives P False positive responsiveness Compatibility Tests Applications undergo compatibility testing with leading CASB, NAC, SSL-VPN, and SSO technologies. Certified compatibility ensures applications can be detected, classified, and displayed from over 200,000,000 endpoints worldwide, by over 1,000 products from vendors like Elastica, SecureAuth, Cisco, Citrix, and Palo Alto Networks. Quality Tests OPSWAT partners, AV-TEST and AV-Comparatives, examine the performance, protection, and usability of anti-malware applications. FINANCE MANUFACTURING TECHNOLOGY Applications meeting the Gold-certification standard can: P Protect against emerging threats P Protect endpoints in real time P Perform efficiently P Maintain device usability False Positive Tests False alarms waste time, resources, and can damage the reputation of a security product. Applications bearing OPSWAT certified logos are able to log, report, and respond to false positives. Get Certified 1) Log In Create an account at htt://portal.owat.com/en 2) Upload Provide basic information and a licensed installer through our support form at For More Information Learn more about certification criteria at