Trend Micro: Experienced, Innovative, Market Leader. Emirhan AŞÇI WhiteSpace Sales Leader, MED. Murat HANÇER Regional Account Manager, MED

Transkript

1 Trend Micro: Experienced, Innovative, Market Leader Emirhan AŞÇI WhiteSpace Sales Leader, MED Murat HANÇER Regional Account Manager, MED

2 Trend Micro Kuruluş: 1988 yılında kuruldu Merkez: Tokyo, Japonya 50 Ülkede Çalışan Borsada işlem görüyor: Tokyo Borsası 4704 CEO Eva Chen 500k Ticari Müşteri 250M+ Uç Nokta Koruması Başkan Wael Mohamed 2

3 3

4 4

5 What We ve Seen 69% 97% 90% Ağlarda ZeroDay veya Şirketlerde ağ saldırısı veya istismar var. Şirket ağlarında aktif komuta ve bilinmeyen kontrol mekanizması zararlı yazılımvar. var. 5 Source: Live proof of concepts 330 organizations, 2016/17

6 Global Reach: Research Centers Ottawa Toronto Dallas Austin Cork Munich Prague Nanjing Bangalore Singapore Tokyo Taipei Manila Sao Paulo Melbourne 6

7 Internet Enterprise Security System TippingPoint Appliance Network Environments Deep Discovery Appliance Vulnerability Shielding Early Zero-Day Protection IP/DNS/URL Reputation Deep Packet Inspection SSL Inspection Machine Learning Gateway Next Generation IPS Breach Detection Advanced Threat & Lateral Movement Detection Monitors Over 100 Protocols & All Ports Custom Sandbox Analysis Multiple Detection Techniques Machine Learning Smart Protection Suites Software Anti-malware with Behavioral Analysis & Machine Learning Vulnerability Protection Application Control Content Filtering Data Loss Prevention Endpoint Encryption Web Gateway Custom Sandbox Deep Security Anti-malware with Behavioral Analysis & Machine Learning Firewall Software IPS Application Control Integrity Monitoring Log Inspection User Environments Data Center & Cloud Environments MS Exchange MS SharePoint Physical, Virtual, & Container Workloads Public Cloud Workloads Storage Area Network (SAN) 7

8 CONNECTED Speeds time to protect, detect and respond 8

9 OPTIMIZED Minimizes IT impact Sandbox Analysis Intrusion Prevention Application Control Machine Learning Integrity Monitoring Behavioral Analysis Anti-Malware & Content Filtering Response & Containment 9

10 TANIMLAR SMART: Right Technique at Right Time Tanımlanmış iyi Tanımlanmış kötü Tanımlanmamış Web ve dosya itibarı İstismar önleme Uygulama kontrolü Değişken koruma Çalıştırma öncesi makine öğrenimi Davranış analizi Güvenli dosyalara izin verildi Çalıştırma süresi makine öğrenimi Zararlı dosyalar engellendi 10

11 Why Machine Learning Samples Look Different on the Surface Ransom-Tescrypt1 (Known sample) Ransom-Tescrypt2 (Unknown) Need a new example for machine learning since this would be caught by variant protection Jon Oliver working on this example now. 11

12 Machine Learning Predicts Maliciousness When features are looked at and compared Ransom-Tescrypt3 (Known sample) Ransom-Tescrypt4 (Unknown) Opcode normalized in graph Example of 2 code elements machine learning found to have similar characteristics API calls displayed in import table 12

13 Unknown threat found by machine learning 13

14 1. Katman Bilinen Tehditler 2. Katman Bilinmeyen Tehditler 3. Katman Aksiyon Web & URL Reputation Behavioral Analysis Exploit Detection Vulnerability Protection Investigation & Root Cause Analysis Quarantine & Isolation Endpoints Malware Signatures Pre-execution and Run-time ML Application Control Incident Cleanup Sandbox Analysis 14

15 Trend Micro Security Portfolio Smart Protection for Office 365 Internet Gateway - SaaS [Hosted Security] Service Integration - SaaS [Cloud App Security] Gateway - SW [InterScan Messaging Security] Free Phishing Simulation & Education Service [Phish Insight] Adv Threat Protection - HW [Deep Discovery Inspector] Service Integration - SW [ScanMail for Exchange/ Domino]

16 16

17 1

18 Hybrid Cloud Security Solution Network Security System Security Malware Prevention Intrusion Prevention Firewall Vulnerability Scanning Application Control Integrity Monitoring Log Inspection Anti-Malware Behavioral Analysis & Machine Learning (2H/17) Sandbox Analysis Stop network attacks, shield vulnerable applications & servers Lock down systems & detect suspicious activity Stop malware & targeted attacks 18

19 Faster Protection Against Unknown Threats TREND MICRO CUSTOMERS PROTECTED AHEAD OF PATCH 72 OTHER VENDORS ADD PROTECTION DAYS Vulnerability is submitted to ZDI 19 Vendor Notified Digital Vaccine Filter Created Earlier Protection with Trend Micro Vendor Response Vulnerability is Patched or Remains Unfixed Public Disclosure *Average days of zero-day coverage prior to public disclosure in 2017

20 20

21 21

22 DEEP DISCOVERY Ağlar karmaşık ve daima değişiyor. Tehditler için çevresel tabanlı yaklaşımlar bazı korumalar sunar, ancak: Kullanıcılar ve sistemler ağdan ayrılıyor. Verilerin hâlâ içeri girmesi gerekiyor.

23 DEEP DISCOVERY DDI

24 DEEP DISCOVERY Deep Discovery Inspector (DDI) Tüm bağlantı noktaları DDI

25 DEEP DISCOVERY Deep Discovery Inspector (DDI) Tüm bağlantı noktaları 107 protokol Yanal hareket algılama DDI

26 DEEP DISCOVERY Deep Discovery Inspector (DDI) Tüm bağlantı noktaları 107 protokol Yanal hareket algılama Senkronize yeni tehdit bilgisi DDI

27 DEEP DISCOVERY DDI Deep Discovery Inspector (DDI) Tüm bağlantı noktaları 107 protokol Yanal hareket algılama Senkronize yeni tehdit bilgisi Üçüncü parti güvenlik çözümlerini bilgilendirme

28 2 Deep Discovery Inspector Ağ Üzerindeki Saldırı Algılama Tek ağ cihazı Tüm network trafiğini analiz etme Malware, ransomware, C & C, 100'den fazla protokol ve tüm bağlantı noktalarında saldırgan aktivitesi Custom sandboxing desteği Küresel tehdit istihbaratı ile hızlı değerlendirme ve yanıt. BYOD ve tüm karmaşık ortamların analizi Windows'un ötesinde algılama: Mobil, Mac, Android, eski sistemler ve özel cihazlar...

29

30 Deep Discovery Inspector Ortamınız ile birebir Sandboxes Sistem yapılandırmaları, sürücüler, yüklü uygulamalar ve dil ayarları URL'leri, C&C'yi ve daha fazlasını bulmak ve analiz etmek Attachment Analizi Ekler sıkıştırılmış formattan çıkarılır, açılır ve çalıştırılır. Algılama motorları, gelişmiş kötü amaçlı yazılımları, belge istismarlarını ve fidye yazılımlarını belirler. Desteklenen dosya türleri: Windows yürütülebilir dosyaları, Microsoft Office, PDF, Zip, Java URL Analizi Smart Protection Network üzerinden canlı url analizi Sayfa içeriği taranır ve yönlendirmeleri, gelişmiş zararlı yazılımları ve sürücü tabanlı indirmelerde kullanılan istismarları keşfetmek için sandbox yapılır.

31 31 Malicious Ransomware Attachment

32 Trend Micro Portable Security 2 Overview Malware Scanning & Cleanup tool for Standalone PC / Closed system Provide on-demand scan for the following PCs with the latest pattern file: - PC/terminal without Internet connection - PC/terminal not allowed to install anti-malware products Key Features 1. No installation required *1 2. Easy Operation LEDs for notification of scan results Malware scan / cleanup, pattern update by Scanning Tool only 3. Centralized Management Operation Closed Network 1. Configure scanning tool setting and update malware pattern files*2 AU Server Internet Office PC with Internet connection Scanning tool 2. Malware scan Standalone *1 Although drivers are temporarily created on the PCs to be scanned and files are created on local HDDs, these drivers and files do not remain on the scanned PCs once the scan has been completed. *2 Malware scans are performed on computers with the latest pattern files at the timing of updating. * When use USB boot search, it is possible to choose whether to save a scanning log on the HDD of the target PC. When execute pattern file update and virus scan automatically, You need to install Scanning tool agent to the target PC. When use Suspend Scan, a journal file is created and saved in the target PC.

33 In Action [Animation] 33

34 Layered Defense: WannaCry SMB v1 File Sharing Protocol SMB Vulnerability Install Ransomware Encrypt Data Files Spread Again WCRY Network: NGIPS Traffic Inspection Virtual Patching: Host IPS to block SMB exploit Pre-execution: Application control Predictive ML Variant protection File-level signature 34 reactive Run-time: Behavioral analysis & run-time ML

35 Suspicious Objects SHA-1 IPs URL Deep Discovery Nasıl Çalışır?

36 Detects Deep Security Nasıl Çalışır?

37 Deep Security Nasıl Çalışır?

38 Deep Discovery Analyzer Nasıl Çalışır?

39 SANS/CIS TOP 20 CRITICAL SECURITY CONTROLS 1. Inventory of Authorized & Unauthorized Devices 11. Secure Configurations for Network Devices 2. Inventory of Authorized & Unauthorized Software 12. Boundary Defense Helping with 14 of 20 Critical Security Controls 3. Secure Configurations for Hardware & Software on Mobile Devices, Laptops, Workstations, & Servers 13. Data Protection 4. Continuous Vulnerability Assessment & Remediation 14. Controlled Access Base on the Need to Know 5. Controlled Use of Administrative Privileges 15. Wireless Access Control 6. Maintenance, Monitoring, & Analysis of Audit Logs 16. Account Monitoring & Control 7. and Web Browser Protections 17. Security Skills Assessment & Appropriate Training to Fill Gaps 8. Malware Defenses 18. Application Software Security 9. Limitation and Control of Network Ports, Protocols, and Services 19. Incident Response Management 10. Data Recovery Capability 20. Penetration Tests & Red Team Exercises 39

40 Leadership 8 yıldır Dünyanın en iyi sunucu güvenliği ödülü Önerilen ihlal algılama istemi ve Önerilen Next-generation IPS 14 yıldır Gartner da liderler arasında ve son 4 yıldır lider Source: IDC, Securing the Server Compute Evolution: Hybrid Cloud Has Transformed the Datacenter, January 2017 #US Saldırı tespit ve Sistemleri için Gartner Magic lideri NSS Labs Breach Detection Test Results ( ); NSS NGIPS Test Results, #1 in protection and performance Endpoints.html av-test.org (Jan 2014 to Dec 2016)

41 Industry Proven 41

42 42 Sorularınız?

43 Teşekkürler EMİRHAN AŞÇI MURAT HANÇER 43