Breach Detection Systems: What Are They and Do You Need One?
13
BREACH DETECTION SYSTEMS: WHAT ARE THEY AND DO YOU NEED ONE? NSS Labs Research October 7, 2015 Jason Pappalexis, Research Director Andrew Braunberg, Research VP Thomas Skybakmoen, Research VP
-
Upload
nss-labs -
Category
Technology
-
view
354 -
download
1
Transcript of Breach Detection Systems: What Are They and Do You Need One?
BREACHDETECTIONSYSTEMS:WHATARETHEYANDDOYOUNEEDONE?
NSSLabsResearchOctober7,2015
JasonPappalexis,ResearchDirector
AndrewBraunberg,ResearchVP
ThomasSkybakmoen,ResearchVP
Slide2
Agenda
• BDSDefiniJon• Market• ArchitecturalOverview• TesJng• Methodology• Results
• ProductMaturity• BDS:WorththeInvestment?• Q&A
Slide3
BDSDefinedThreeKeyCharacteris.cs
1. Aproductorservicedeployedoutofband2. VarietyofdynamicdetecJontechniques
• Lookingforpreviouslyunknownand/orhighlytargetedmaliciouscontent
3. IdenJtyindicatorsofcompromisesthatalerttoanexisJngbreach
MalwareidenJficaJon(signatures,heurisJcs,or
both)
Networktrafficanalysis(flowmonitoring,
contentanalysis,orboth)
Sandboxingthatmodelsinternal
systems(workstaJonsandservers)
BrowseremulaJon
ReputaJon
DynamicDetec.onTechniques
Slide4
StateoftheMarket(CY2014)
• MarketSize• $714Min2014• $1.1Bin2015(NSSest.)
• Currentbuyers• LargeEnterprisemadeup85%ofsalesin2014
• Evolvingmarketrequirements
FireEye49%
Others24%
Fidelis15%
PaloAltoNetworks
7%
BlueCoat5%
Slide5
ThreeKeyMarketDrivers
1. Securityeffec.veness• BestchanceofdetecJngazeroday
2. TimetoDetec.on• “Malwareresearchteaminabox”working24/7/365
3. ImprovedForensics• “SmokingGun”enablespromptandaccurateincidentresponse
Slide6
• Deploymentop.ons• Complexity• Protocolsupport• EndpointversusNetwork• Dynamicanalysis• Sandboxes,emulaJon,virtualizaJon• OSsupport(sandboxes)
Architecture&Deployment
Slide7
World’sLeadingSecurityTestingFacility
LargestlivetesJngharnessintheworld
3TbpsrealworldtraffictesJngcapacity
RichestmulJ-vendortestinfrastructure
$30Milliondatacenterinvestment
Network,endpointandcloudtestexperJse
2MillionHrsaccumulatedtest
experience
Slide8
SecurityEffectivenessTesting
Exploits EvasionsMalware Stability&Reliability• Social• Drive-By
• HTTP• Email(IMAP/SMTP)
• SMB
• Packers• Compressors• VirtualMachine• Sandbox• HTMLObfuscaJon
• LayeredEvasions
• DetecJonunderExtendedAiack
• ProtocolFuzzingAndMutaJon
• PersistenceofData
Data from BDS 2.0 Group Test
Slide9
PerformanceTesting
UDP HTTPCapacityMaxCapacity RealWorldTrafficMixes• 64to1514BytePackets
• MaxconcurrentTCPconnecJons
• MaxTCPconnecJonspersecond
• MaxHTTPconnecJonspersecond
• NoTransacJonDelays
• WithTransacJonDelays
• EnterprisePerimeter• EducaJon
Data from BDS 2.0 Group Test
Slide10
GroupTestResults• Security
• SecurityEffecJveness51.8%to99.2%
• AverageSecurityEffecJvenessRaJng86.8%
• EvasioneffecJveness87.1%to100%
Data from BDS 2.0 Group Test
• Performance• Throughput750Mbpsto4.583Gbps
• TotalCostofOwnership• 3YearTCOrangedfrom$68,922to$448,793• Average3yearTCOwas$277,349
Slide11
BDS:WorththeInvestmenttoYou?
• Architecturallycomplex• OnenrequiremulJpledevicestoscandiversetraffictypes
• PerformanceissueswilleventuallydrivemanyBDS’stothecloud• Notdesignedtoperformatlinerate• Sandboxlifecyclemanagement• Sandboxevasions• Totalcostofownership• Agents• Requireadultsupervision
Nosecurityproductiswithoutlimita3ons
Slide12
In-DepthResearch
• MarketAnalysis
• BuyersGuide
• CompanyReports
TechnicalBriefs
TestReports
ComparaJvesReports• SecurityValueMap
• TCO• Security• Performance
ProductTestReports
Slide13
Ques.ons?
