Using Intelligent Whitelisting to Effectively and Efficiently Combat Today’s Endpoint Malware

Made possible by:

Brought to you by

Speakers• Chris Chevalier, Senior Product Manager• Chris Merritt, Director of Solution Marketing

http://www.lumension.com/Solutions/Intelligent-Whitelisting.aspx

Preview of Key Points

Whitelisting is critical for defense-in-depth against endpoint malware

Challenges with traditional whitelistingMaking whitelisting intelligent

Treat each PC as uniqueTrusted agents of changeIntelligent trust decisions

Whitelisting is critical for defense-in-depth against endpoint malware

No substitute for patch and AV but both are: ReactiveNegative security model Straining to deal with pace and sophistication of today’s financially- / politically-motivated attackers

Whitelisting is critical for defense- in-depth against endpoint malware

For real defense-in-depth Additional layer needed

Fundamentally different approach

Application whitelistingProactivePositive security model

Whitelisting also helps addressrisks inherent with local admins

Neither patch or AV protect against end-users with admin authority Adding unwanted softwareAccessing/modifying restricted system settings

• Regedit, ftp, telnet, security settings

Whitelisting prevents local admins From installing new, unauthorized softwareOr accessing restricted system components

Challenges with traditional whitelisting

Each PC is uniquePCs are not staticStarting from a pristine

environment unrealisticIdentifying trusted

applications

Challenges to Application Whitelisting

Identifying ALL trusted applications

Endpoint uniqueness and Constant Change

Existing PCs

Needing Immediate Protection

Making whitelisting intelligent

Acknowledge the uniqueness of each PC Ensure user productivity by making more

intelligent trust decisionsRecognize trusted agents of change Progressive implementation

Treat each PC as unique

Implement local whitelist for each PCBased on software already present

New malicious or unwanted software instantly stopped

Existing unwanted software addressedBlacklistLater policy development

Centrally build list of all software present throughout all endpoints To be leveraged as prevalence knowledge

Trusted agents of change

Whitelists require continual maintenance since PC software is constantly updated

Specify trusted agents of change e.g. patch agents, system management processes and other software deployment agents

No coordination or maintenance required by IT staff when software updated

More intelligent trust decisions

Trusted updaters Trusted publishers Trusted paths Denied applications Trusted authorizersLeverage

Prevalence information collected by agents

Progressive Implementation

Bottom Line

Patch management and AV aren’t enough Don’t provide defense-in-depth

Application Whitelisting provides a 3rd and fundamentally different approach

All 3 together provide synergistic, true defense-in-depth Intelligent whitelisting addresses the traditional problems of

application whitelisting by Acknowledging uniqueness of each PC Making more intelligent trust decisions Automatically updating whitelist with changes made by trusted

agents Allowing progressive implementation with existing fleet of PCs

Brought to you by

Speakers• Chris Chevalier, Senior Product Manager• Chris Merritt, Director of Solution Marketing

http://www.lumension.com/Solutions/Intelligent-Whitelisting.aspx

Using Intelligent Whitelisting to Effectively and Efficiently Combat Today’s Endpoint Malware

Technology

Transcript of Using Intelligent Whitelisting to Effectively and Efficiently Combat Today’s Endpoint Malware

Malwarebytes Anti-Malware vs. Competitors Malwarebytes Anti-Malware ... Symantec Corp Symantec Endpoint ... Malwarebytes Anti-Malware vs. Seven Endpoint Security Products PassMark

AAnnttii--MMaallwwaarreehelp.kaseya.com/webhelp/EN/AM/9050000/EN_AMguide_R95.pdf · Anti-Malware provides Malwarebytes' Anti-Malware Pro endpoint security for managed machines. Anti-Malware

Next-Generation Endpoint Protection - SentinelOne file-based malware involved a simple installation ... Next Generation Endpoint Protection Platform ... can be prevented from executing

KASPERSKY ENDPOINT SECURITY FOR BUSINESS - stw … · 13 KASPERSKY ENDPOINT SECURITY FOR BUSINESS ANTI-MALWARE Schutz vor bekannten, unbekannten und hoch entwickelten Bedrohungen

Panda Endpoint Protection Suitespandasecurity.s3.amazonaws.com/enterprise/solutions/pep/PEPA-EN… · Panda Endpoint Protection Suites Endpoint Security » Granular policy-based whitelisting,

McAfee Complete Endpoint Threat Protection Data Complete Endpoint Threat Protection provides ... detect in near real time zero-day malware that signature-based scans ... reduces risk

Symantec™ Endpoint Protection 12.1 - Insight NL · Symantec™ Endpoint Protection 12.1.6 Data Sheet: Endpoint Security Overview Last year, we saw 317 million new malware variants,

KASPERSKY LAB - cappi.org.ar Sponsors/Kaspersky... · graph shows infection map. ... 6 anti-malware application control with dynamic whitelisting mobile security system management

Endpoint Security For Remote Scenarios€¦ · Endpoint security suites for malware prevention, detection and remediation (e.g., Carbon Black, Sophos, Symantec) Base: 505 Infrastructure

EntErprisE Endpoint protEction · 2 Enterprise Endpoint Protection April - June 2020 SE Labs tested a variety of anti-malware (aka ‘anti-virus’; aka ‘endpoint security’) products

Defense in Depth: How Application Whitelisting Can ... · Defense in Depth: How Application Whitelisting Can Increase Your Desktop Security. Defense in Depth: How Application Whitelisting.

Malware evolution and Endpoint Detection and Response Technology

trend Micro enDPoInT SecurITy · endpoint security overview ... Sandbox malware analysis detects zero-day malware and malicious code hidden in office and PDF documents. And all of

Symantec™ Endpoint Protection 14 - Insight NL · 2020-05-21 · Symantec™ Endpoint Protection 14 Data Sheet: Endpoint Security Overview Last year, we saw 431 million new malware

Malwarebytes Endpoint Security Quick Start Guide · • Malwarebytes Anti -Malware for Business – Our award -winning Windows-based anti-malware client which is which detects and

Symantec White Paper - Symantec Endpoint Suite Product Guidei.crn.com/custom/Symantec-Endpoint-Suite-Solution-Brief.pdf · Symantec Endpoint Protection--Protect against APT malware

KASPERSKY ENDPOINT SECURITY FOR BUSINESSkaspersky.nts.com.vn/document/endpoint-overview.pdf · And then, there’s the rise of malware… 1999 2001 2003 2005 2007 2009 2011 Malware

Multilayered technology, machine learning and …...An endpoint protection platform (EPP) is a solution deployed on endpoint devices to prevent file-based malware attacks, detect malicious

AAnnttii--MMaallwwaarree - Kaseyahelp.kaseya.com/webhelp/EN/AM/9030000/EN_AMguide_R93.pdf · 2017-03-17 · Anti-Malware provides Malwarebytes' Anti-Malware Pro endpoint security

Enterprise Endpoint Security: Anti-Malware Solutions€¦ · Enterprise Endpoint Security: Anti-Malware Solutions Report No.: 71172 Page 9 of 50 Runtime analysis Includes several