Security Landscape Thorsten Stoeterau Security Systems Engineer - Barracuda Networks

Transcription

1 Security Landscape 2018 Thorsten Stoeterau Security Systems Engineer - Barracuda Networks

2 Traditional threat vectors Network Perimeter User Remote Access Web Applications Remote Users

3

4 In the beginning Legitimate Mail Internet Mail Server Corporate Inbox Users

5 Started with Security and Archiving Archiving Spam/malware Legitimate Mail Internet Mail Server Corporate Inbox Users Spam & Virus Protection, DLP, Encryption

6 Extended to the Cloud and added Backup Spam/malware Legitimate Mail Internet Spam & Virus Protection, DLP, Encryption Backup, Archiving Corporate Inbox Users

7 Advanced Threat Protection Spam/Malware Legitimate Mail Internet Zero Hour Corporate Inbox Users Spam & Virus Protection, DLP, Encryption Backup, Archiving, Sandboxing

8 Antivirus Signature-based tools alone A B C Malware constantly changes to evade AV tools Not enough diversity of threat data to be effective across all vectors Modern attacks evade IPS and gateway based detection solutions A Safe Signatures Database B Virus C Trojan

9 Advanced Threat Protection

10 Example: Advanced Threat 0-day attachment (RAR)

11 Global Threat Intelligence Network

12 Network Perimeter User Remote Access Web Applications Remote Users

13 New threats can bypass gateways Spam/Malware Legitimate Mail Internet Zero Hour Corporate Inbox Executives Spam & Virus Protection, DLP, Encryption Backup, Archiving, Sandboxing

14 Attacks are entering through the back door Spam/Malware Internet Legitimate Mail Zero Hour unified inboxes Personal Spear Phishing Spam & Virus Protection, DLP, Encryption Backup, Archiving, Sandboxing

15 So what is SPEAR PHISHING?

16 Multi-stage spear phishing bait, hook and catch Step 1 Infiltrate Step 2- Reconnaissance Step 3 Extract Value

17 Can you guess which ones are legitimate? Sender name Sender link Subject DocuSign net struments.com/js/doc u.php Completed: Please DocuSign Amazon.com om/gp/r.html Most Read from The Washington Post Dropbox m m.br/folder/document / Your Financial Institution just sent you an important documents via Dropbox FedEx trackingupdates@fede x.com m/insight/findit/nrp.js p?tracknumbers=7762 FedEx MPS Shipment Delivered

18 Can you guess which ones are legitimate? Sender name Sender link Subject DocuSign net struments.com/js/doc u.php Completed: Please DocuSign Amazon.com om/gp/r.html Most Read from The Washington Post Dropbox m m.br/folder/document / Your Financial Institution just sent you an important documents via Dropbox FedEx trackingupdates@fede x.com m/insight/findit/nrp.js p?tracknumbers=7762 FedEx MPS Shipment Delivered

19 Ransomware

20 The business model

21 The business model (contd.)

22 Network Perimeter User Remote Access Web Applications Remote Users

23 Securing the gateway is still necessary, but no longer sufficient

24 Next Generation Protection Human Firewall Fraud Protection Phishing Simulation and Training AI-based spear phishing protection DMARC to prevent domain spoofing Resiliency Cloud Backup Continuity Gateway Defense Inbound/Outbound Security Encryption and DLP for secure messaging Archiving for compliance O365 Exchange Confidential

25 So is bad. What else is new?

26

27 Timeline of the Equifax breach

28 WAF Extends Your Network Security Posture Layer 7 Network Firewall Applications are in the open Exploits are visible Layer 7 Network Firewall Applications are insulated Exploits are contained

29 What a Web Application Firewall Does Comprehensive Application Security Data Loss Prevention OWASP Top-10 Attacks Credit Card Numbers Application DDOS Social Security Number Proactive Defense Custom Patterns Application Cloaking Geo-IP Control Inbound Inspection Outbound Inspection

30 Network Perimeter User Remote Access Web Applications Remote Users

31 Anatomy of the Target breach HVAC Servers Step 2 Step 3 POS Step 1 Internet

32 Network Perimeter User Remote Access Web Applications Remote Users

33 From Next Generation to Cloud Generation Vertical Scaling Backhauled Networks Aggregated Policy Monolithic Architecture Feature Heavy Not Orchestrated Expensive Next Gen Cloud Gen Horizontal Scaling Distributed Policy Central Management Secure Connectivity No-MPLS Traffic Regulation 0-touch deployment Visibility Security at source Elastic Scaling Dispersed Workloads Orchestration API Support Cloud Use Cases Cloud Integrations Flexible Licensing

34 WAN Networking 5+ years ago Centralized Internet Break Out Internet Servers & HQ or DC Headquarters Central Policy Headquarters MPLS with VPN backup

35 WAN Networking in the Cloud Era: Today Internet SaaS IaaS Headquarters Most companies still have WAN by MPLS with VPN backup

36 Headquarters WAN Networking in the Cloud Era: Tomorrow Internet SaaS IaaS SDWAN to reduce MPLS cost

37 Where will your applications be in 2 years? Some SaaS Public Cloud & SaaS Public Cloud & SaaS HQ HQ HQ Apps On Premises Data Center Apps Hybrid Public Cloud all in

38 Public Cloud Service Responsibility Customer Cloud Access Network Security Customer Applications & Content Identity & Access Control Operating Systems / Platform Data Encryption Backup/Restore You define controls and security IN the Cloud Public Cloud Platform Physical Infrastructure Network Infrastructure Virtualization Layer Provider takes care of the Security OF the Cloud

39

40 Network Perimeter User Remote Access Web Applications Remote Users

41 Thank you