Deep instinct For MSSPs

Size: px

Start display at page:

Download "Deep instinct For MSSPs"

John Powell
5 years ago
Views:

Deep instinct For MSSPs Deep Instinct Solution Deep Instinct is the first and only Endpoint & Mobile Cybersecurity solution that is based on a proprietary deep learning framework that was

1 Deep instinct For MSSPs Deep Instinct Solution Deep Instinct is the first and only Endpoint & Mobile Cybersecurity solution that is based on a proprietary deep learning framework that was specifically designed for cybersecurity. Our solution provides detection and prevention, against any file-based or file-less attack, for every operating system, on any device, in one unified platform, delivering unmatched accuracy and efficiency. The result - unparalleled cybersecurity prowess in blocking and preventing even the most evasive unknown, first-seen malware, including Advanced Persistent Threats (APT), zero-day attacks, and ransomware. Deep Instinct provides the best Advanced EndPoint Solution with Multi-Tenant Management specifically built for MSSPs allowing you to extend your offering with minimal overhead to your team. Why partner with us? AEP Security: Offer your customers an easy to use Advanced Endpoint and Mobile Protection with the highest detection rates and lowest false positives for all their devices - Windows, Mac, Android and ios Management Manage your customer s deployed AEP product via a unified, scalable, simple to use, web-based management console that supports a totally segregated Multi-Tenant environment built specifically for MSSPs Customer SLAs: Meet your customer s strict SLA requirements for handling malwares & APTs through the autonomous Deep Instinct client s immediate Prevention (or detection and response) with minimal overhead to your team Go-to-Market: Get Deep Instinct expert assistance to set up the operation; receive training and materials to position & sell the new offering. Manage and support any support issue during business days or on 24x7 basis Ease of Business: Low setup costs, flexible licenses scheme through quarterly billed license bundles with a single, all inclusive price per seat 1

2 Program Highlights: You will be able to offer your customers the Deep Instinct Advanced Endpoint and Mobile Protection Product on a cost per device quarterly fee basis. Get bulks of endpoint and mobile licenses and distribute to your customers as needed Recurring revenue opportunity using quarterly billing Manage Deep Instinct deployments to multiple segregated customers from a single management infrastructure, using a unified management console built specifically for MSSPs. Connect the Deep Instinct environment to your SIEM/syslog infrastructure We support another hierarchy level (i.e. MSP of MSSPs ) Deep Instinct will help you with the operation setup and provide the following resources to enable you to sell and continuously provide the service to your customers: Deployment of the dedicated Multi-Tenancy server. Annual on-site training for the MSSP personnel on how to position, sell, manage and maintain the Deep Instinct product. Marketing and technical material on the Deep Instinct product. Backend technical support for any issue that will arise two tiers: Standard support, during business days Premium support, 24x7 basis for an additional fee A quarterly co-branded threat-analysis report that includes all events detected and prevented for the customer that quarter the MSSP can send the report to all their customers Sign up to the MSSP program (through approaching your distributor or Deep Instinct representative) and get started within weeks 2

3 Deep Instinct Architecture: Deep instinct TM neural network Continuous Deep Learning Prediction Model managment D-Cloud Services (Optional) File Classifications Management Server Deployments, brain and policy updates Management Console D-Clients Autonomous Analysis Entities 3

4 Deep Instinct Protection Layers Autonomous on-device protection detecting and preventing threats in real- time without requiring any supplemental analysis. PRE-EXECUTION On-Access Static file-based analysis - Real-time threat prevention using a lightweight prediction model based on deep learning (D-Brain) that autonomously prevents zero-day and APT cyber threats. Supports the broadest file types in the industry, including executable files (PEs), PDF, Office files, archive files and more. D-Cloud services Provides a fast and scalable file reputation infrastructure in the cloud (AWS) adding a second layer of validation & protection. The service is optional and can be disabled by policy. Script control Protects against fileless attacks that are based on scripts, including PowerShell, JavaScript, VBScript, HTML applications and more. Macro control Using the D-Brain, identifies files containing embedded macros and determines whether the macro is malicious or benign. ON-EXECUTION Behavioral analysis Provides an additional layer of protection for extended coverage of file-less attacks by monitoring and preventing on-execution malicious behavior, including Ransomware, code injection and shellcode attacks. POST EXECUTION: Response and Remediation Remediation Once a problem has been identified, it is resolved using Deep Instinct's response and remediation features, including file quarantine, file restore, file delete, terminate process, infographic of the process chain and more. Deep Classification Determines the malware family type of PE (Portable Executable) files. After a PE file is scanned by the D-Brain and detected as malicious, the file is scanned again by the Deep Classification brain providing results in milliseconds. Our classification model categorizes the malware into 7 different types: Ransomware, Backdoor, Dropper, Virus, Worm, Spyware and PUA. Scanning Performs a full file scan during the initial installation to identify pre-existing malware and new threats on the device. Scheduled periodic scans can be implemented, as defined by the administrator. Deep Classification Prevention < ms Ransomware Backdoor Virus Worm < ms Dropper PUA New File Devices* Spyware No action *Lightweight D-Client Low memory footprint (<120MB), requires less than 1% CPU usage on average. 4

Deep Instinct Management The management system uses a central cross-platform management and monitoring server, hosted in AWS for maximum scalability, manages all endpoints (desktop, server and mobile

Group based Policy - Provides tools for configuring the organization's security policy. Manages different policies for groups or individual devices.

5 Deep Instinct Management The management system uses a central cross-platform management and monitoring server, hosted in AWS for maximum scalability, manages all endpoints (desktop, server and mobile devices). Monitoring - Easy monitoring of the organization's security and deployment status. Easily integrates to MSSPs SMTP and SIEM environments. Group based Policy - Provides tools for configuring the organization's security policy. Manages different policies for groups or individual devices. Groups can be imported from the Active Directory tree, or pre-defined according to device name, OS version, D-Client version, IP range, tag, Tenant ID and more. Intelligence - Provides an Advanced Threat Analysis feature that performs additional threat analysis for any malware file identified. Produces reports with a wide range of information for further analysis. Multi-Tenancy - Provides MSSPs with the capabilities to manage all entities from the same instance and management console. It includes features to allow administrators and SOC teams to manage multi-msp and multi-tenant environments. Using the Multi-Tenancy feature you can define a management instance per customer (tenant) that is fully segregated for the other tenants. Logs and Reports - Provides advanced logging and reporting capabilities for security, deployment and threat analysis events. Integrates with lead SIEM products and SMTP servers for log forwarding. Role Based Access Control - Ability to set different user roles to groups or individual users in the organization. Simple Deployment and Registration Flow - Integrates with Windows deployment tools, such as SCCM or GPO. Upgrades directly from the management console. Does not require rebooting after installation or upgrade. Flexible Licensing Get bulks of licenses at the MSSP level and assign them as needed per tenant. Integrator MSP-1 MSP-2 MSP-3 Tenant 1.1 Tenant 2.1 Tenant 3.1 The regular Management Console allows the MSSP to manage multiple tenants. Each tenant has his own dedicated dashboard, policies, deployment monitor, and event management panel. A new console, The MSP Hub, allows control over several MSPs and their relevant tenants Tenant 1.2 Tenant 1.3 Tenant 2.2 Tenant 3.2 5

Deep Instinct Technical Support Deep Instinct s Technical Services Organization will handle any technical issue you may encounter missing knowledge on how to use the product, errors or issues

Standard Support Premium Support Hot Fixes New Versions Unlimited Support Support Availability Business Days: 9 x 5 All Days: 24 x 7 First time Response Critical: 2 Hours High: Next-Business-Day

Hours High: Daily Other: twice a week Periodic Report Periodic Report of Threat Analysis findings at your customer s environment statistics, events, analysis of malicious files etc.

analysis 14 14 PUA Admin Tool Malicious software. Any file/software created to disrupt a computer, gather sensitive information, or gain access to private data.

Spyware 10 Any software that can compromise privacy, weaken the computer s security, deceive the victim into scams or being used to gain money by using ads.

It is recommended to keep prevention events as prevented and to blacklist any detection events as long Virus as it 7 does not harm organizational functionalities.

6 Deep Instinct Technical Support Deep Instinct s Technical Services Organization will handle any technical issue you may encounter missing knowledge on how to use the product, errors or issues encountered by using the product, etc. as well as additional services to ensure high level of customer success using Deep Instinct from the get-go and throughout the lifecycle. Standard Support Premium Support Hot Fixes New Versions Unlimited Support Support Availability Business Days: 9 x 5 All Days: 24 x 7 First time Response Critical: 2 Hours High: Next-Business-Day Other: Next-Business-Day Critical: Minutes High: 4 Hours Other: 8 Hours Work on Fix Business Days Continuous Follow-up Frequency Critical: Daily High: Daily Other: twice a week Critical: Every 8 Hours High: Daily Other: twice a week Periodic Report Periodic Report of Threat Analysis findings at your customer s environment statistics, events, analysis of malicious files etc. (you can provide your customers quarterly to show the value) Sample Periodic Threat Analysis Report: 20 Malware Malware PUA Admin tool Threat Analysis Report customer name 04/19/ /19/2018 event analysis PUA Admin Tool Malicious software. Any file/software created to disrupt a computer, gather sensitive information, or gain access to private data. It is recommended to keep prevention events as prevented, and to blacklist any detection events. Ransomware 25 Potentially Unwanted Application. Spyware 10 Any software that can compromise privacy, weaken the computer s security, deceive the victim into scams or being used to gain money by using ads. Legitimate software often bundle such unwanted applications with their original software to Backdoor 8 gain money, and may not provide a clear option to not installing it. It is recommended to keep prevention events as prevented and to blacklist any detection events as long Virus as it 7 does not harm organizational functionalities. Worm Legitimate tools in its nature that are already installed in the victim s environment, or admin, forensic Dropper or system tools 20 that are usually used by network administrators. Those tools can be abused maliciously. It is recommended to keep prevention events as prevented and to blacklist any detection events as long as it does not harm organizational functionalities. 53 False Positive 4 D-Cloud verified 17 N/A intro Deep Instinct provides real-time detection and prevention of malware, zero-day threats and advanced persistent threat (APT) Threat Analysis Report customer name 04/19/2018 for - 05/19/2018 endpoints and mobile devices. event The analysis proactive protection Threat Analysis Report customer name 04/19/ /19/2018 provides unprecedented accuracy in detection and real-time prevention, protecting the organization s entire assets from any threat (known and unknown). This threat analysis report provides analysis for the events occurred during the dates hightlights Executive Summary 4 Ransomware attacks were detected and prevented 2 Spyware were detected and prevented 3 Worms were detected and prevented 04/19/ /19/2018. ADRMS2012 LAP-PC SM-T533 LAP-PC SM-T533 PE 15 Mach-O 35 Office Events Threat Severity File Events Script Events 27 Open Macros Unique PDF Open Prevented rtf 74 Unique SWF Unique 48 High 15 Moderate Very High Low TIFF 35 Fonts Top Risks devices JAR Archive False Positive Files that were tagged mistakenly as malicious. It is recommended to whitelist prevention or detection events. Ransomware Ransom software. Malware that locks the usage of the computer, by encryption of files, locker screen or by damaging the hard disk. D-Cloud verified n/a Files that were recovered by the D-Cloud file reputation. Spyware No action should be taken. Backdoor Not Available. Files that were not available for Deep Instinct s analysis. For further analysis recommendations, it is recommended to share the files with Deep Instinct. Spying software. Malware that gathers information from the end user, such as passwords, keystrokes or cookies. Top Risks Users Malware that opens an access for an attacker to send additional commands (manually, or automatically as part of a bot/botnet system). adam.m john.d bill.k adam.m john.d Virus Malware that has infection capabilities of other files in local the computer, to get persistence. 2 Worm Malware that has propagation capabilities. It tries to spread out to other computers using various methods, such as brute forcing passwords, exploiting vulnerabilities in network protocols or sending an to mailing lists. 1 Dropper A piece of malware that is usually the initial part of an attack, and then downloads the next stages. 3 6

Summary: Deep Instinct Differentiators The Deep Learning neural

Autonomous, no cyber expert is required Non-linear model:

Any file type; Any major OS Any endpoint, server and mobile device

detect & response Unique malware classification On-prem or cloud

7 Summary: Deep Instinct Differentiators The Deep Learning neural network Brain Proprietary DL framework Raw data, 100% data Autonomous, no cyber expert is required Non-linear model: correlation and context within the data Omni-cybersecurity platform Any file type; Any major OS Any endpoint, server and mobile device Against any file / fileless-based attack Full protection: Prevent, detect & response Unique malware classification On-prem or cloud native by design Autonomous on-device prevention Lightweight: <50MB, <1% CPU Connectionless protection 7

SentinelOne Technical Brief

SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by behavior-based threat detection and intelligent automation.