Agile Security Solutions - Cisco...Agile Security Solutions Piotr Linke ... Based on user and user...
Transcript of Agile Security Solutions - Cisco...Agile Security Solutions Piotr Linke ... Based on user and user...
Agile Security Solutions Piotr Linke
Security Engineer
CISSP CISA CRISC CISM
2
Open Source SNORT
3
Consider these guys…
All were smart. All had security. All were seriously compromised.
4 Icons: attack vectors
Attackers and defenders drive each other to innovate… …resulting in distinct threat cycles
The Industrialization of Hacking
VIRUSES
MACRO VIRUSES
APTs MALWARE
WORMS HACKERS
1985 1995 2000 2005 2010
SPYWARE / ROOTKITS
Goal: Glory, mode: Noise Goal Profit, mode: Stealth
5
So what are you trying to protect…?
SERVER INFRASTRUCTURE DESKTOPS
BYOD USERS
6
Who are we fighting with?
6
7
Black Hole v2
8
Black Hole v2
9
Nuclear Pack 2.0
10
Note the advertising strip.
11
Agile Security process
12
Lockheed Martin’s “APT Kill Chain”
13
APPLIANCES | VIRTUAL
NGFW NGIPS AMP
One platform addresses entire attack continuum through software licenses
BEFORE See it,
Control it
DURING Intelligent &
Context Aware
AFTER Retrospective
Security
14
Sourcefire Agile Security Solutions
COLLECTIVE
SECURITY
INTELLIGENCE
Management Center APPLIANCES | VIRTUAL
NEXT- GENERATION
FIREWALL
NEXT- GENERATION INTRUSION
PREVENTION
ADVANCED MALWARE
PROTECTION
CONTEXTUAL AWARENESS HOSTS | VIRTUAL MOBILE
APPLIANCES | VIRTUAL
15
FireSIGHT is built into all Sourcefire next-generation security solutions to provide the network intelligence and context you need to respond to changing conditions and threats.
FireSIGHT™ Saves Money and Improves Security
IT Insight Spot rogue hosts, anomalies, policy
violations, and more
Impact Assessment Threat correlation reduces
actionable events by up to 99%
Automated Tuning Adjust IPS policies automatically
based on network change
User Identification Associate users with security
and compliance events
17
FirePOWER supports a range of Sourcefire security solutions with unmatched performance, threat protection and energy efficiency.
18
FirePOWER™ Hardware Features
LCD Display Quick and easy headless configuration
Device Stacking Scale monitoring capacity through stacking
Connectivity Choice Change and add connectivity inline with network requirements
Hardware Acceleration For best in class throughput, security, Rack size/Mbps, and price/Mbps
Lights Out Management Minimal operational impact SSD
Solid State Drive for increased reliability
Configurable Bypass or Fail Closed Interfaces For IDS, IPS or Firewall deployments
19
7030
8270
8260
8250
8140
8120
7120
All appliances include: • Integrated lights-out management
• Sourcefire acceleration technology
• LCD display
7110
7020
7010
20 Gbps
10 Gbps
6 Gbps
4 Gbps
2 Gbps
1 Gbps
500 Mbps
250 Mbps
100 Mbps
50 Mbps
SSL2000
IPS Throughput
Modula
r C
onnectivity
Sta
ckable
8130
SSL1500 1.5 Gbps
40 Gbps
30 Gbps
8290
SSL8200
FirePOWER™ Appliances
7125
750 Mbps 7115
1.25 Gbps
Fix
ed C
onnectivity
Mix
ed / S
FP
NG
IPS
/ A
pp
Co
ntr
ol /
NG
FW /
AM
P
20
What is a Next-Generation IPS?
defining_nextgeneration_netw_218641.pdf
Gartner Definition Sourcefire
Support bump in the wire configuration without disrupting network traffic
✔
Act as a platform for network traffic inspection and intrusion detection and enforcement
• Standard first generation IPS capabilities • Application awareness and full-stack visibility • Context awareness • Content awareness • Agile engine
✔ ✔ ✔ ✔ ✔ ✔
21
Next Generation Firewall (NGFW) with Application Control
22
Reduce Risk Through Granular Application Control
Control access for applications, users and devices
→ “Employees may view Facebook, but only Marketing may post to it”
→ “No one may use peer-to-peer file sharing apps”
Over 2300 apps, devices, and more!
23
Block non-business-related sites by category
Based on user and user group
Provide URL reputation information
URL Filtering and reputation
24
Advanced Malware Protection (AMP)
25 25
FireAMP Building Blocks Visibility and Control
Lightweight Connector
•Watches for move/copy/execute •Traps fingerprint & attributes
Web-based Manager
•Transaction Processing
•Analytics
•Intelligence
Mobile Connector
•Watches for apps •Traps fingerprint & attributes
Advanced Malware Protection
• Network Defense Against Malware
• Identifies and Blocks Malicious Files
26
Comprehensive AMP Features
Feature Benefit Network Endpoint
Malware Detection and
Blocking
Stop malware before it can compromise systems
At the network and endpoints ✔ ✔
Retrospective Detection Turn back the clock against malware
Continuous, persistent monitoring of files for retrospective malware detection/blocking ✔ ✔
File Trajectory Quickly understand the scope of the malware problem
Malware tracking and visualization of malware and suspicious files across the network ✔ ✔
Device Trajectory Deep analysis of root causes
Visualization of system level activities for root cause determination ✔
Device Flow Correlation Stop proliferation of malware and root causes at the endpoint
Block malware communication and dropper activity at the endpoint ✔
File Analysis Fast and safe file forensics
Full file analysis to quickly understand malware and file behavior ✔
Outbreak Control Quickly stop malware from spreading
Control a suspicious file or malware outbreak across endpoints ✔
Indications of
Compromise
Spotlight systems at risk of active breach
Prioritized list of compromised devices with links to inspect and remediate the problem ✔
27 27
Visibility & Control with FireAMP
Reporting
Trajectories
Analysis (Sandbox)
Control (Compliance)
28 28
Spotlight: Reporting
Customize by Group – Schedule or On Demand
Applications Introducing Malware
Threats Resident on First Scan
Possible APT
29 29
Spotlight: File Trajectory
Malware “Flight Recorder” shows point of entry and extent of outbreak
Discover the malware
gateway to reduce the
risk of re-infection
Identify systems that
have
downloaded/executed
a specific malware file
30 30
Spotlight: Device Trajectory
Extremely powerful malware behavioral analysis
and forensics tool.
Analyze operating
system behavior
prior, during and post
infection
Trace each stage of
infection and
communication to
other internal and
external hosts
31 31
FireAMP Mobile
Advanced Malware Protection Using Big Data Analytics
Visibility: detect & analyze
▸ Android (2.1+) threats
▸ Cloud-based, real time
Control: contain & remediate
▸ Blacklists
Enterprise Ready
32 32
Leverages VMware’s EPSec API to integrate with vShield
Deployed as virtual appliance on each host
Managed via FireAMP’s cloud portal
FireAMP Virtual
Note: Because file activity is offloaded,
File Trajectory will not display parent SHA
33
Continuous analysis
Never forgets
Network and devices
Retrospective Alerting
What systems are affected? What is the point and method of entry?
Turns back the clock against malware
34
Collective Security Intelligence
Collective Security Intelligence
Private & Public Threat Feeds
File Samples (>180,000 per day)
Advanced Microsoft & Industry Disclosures
FireAMP™ Community
Snort® & ClamAV™ Open Source Communities
Sourcefire AEGIS™ Program
IPS Rules
Malware Protection
Reputation Feeds
Vulnerability Database Updates Sourcefire
Vulnerability
Research
Team
Sandboxing Machine Learning
Big Data Infrastructure
SPARK Program
Honeypots Sandnets
36
Protecting Your Network
2 SEU/SRU, 1 VDB
updates per week 2
> 10 CVE’s covered per day
>250,000 malware submissions
per day
4,310 new IPS
rules
100% Same-day protection for Microsoft vulnerabilities
98.9% Vulnerability
coverage per NSS Labs IPS group test
37
STP and a Threat Centric Ecosystem
38
Thank you very much for attention!