HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND....

28
www.menaisc.com Connected Threat Defense HUSSAM ABU-RIDA TECHNICAL LEAD TREND MICRO

Transcript of HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND....

Page 1: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

w w w . m e n a i s c . c o m

Connected Threat Defense

HUSSAM ABU-RIDATECHNICAL LEAD

TREND MICRO

Page 2: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

It was already difficult to securethe enterprise five years ago…

Page 3: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

3

The modern workplace has noboundaries

Page 4: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

On-premise or perimeter defenses aren’t enough

85%HAVE A MULTI-CLOUD STRATEGY

80%OF WORKLOADS ARE VIRTUALIZED

95%RUNNING APPS OR EXPERIMENTING WITH INFRASTRUCTURE AS A SERVICE

Page 5: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

5

The threat landscape is

evolving

Ransomware

Macro Malware

Point of SaleRAM Scrapers

Targeted Attacks

Flash Exploits

Page 6: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Difficult to get visibilityacross the

environment

Many points of entry to protect

Page 7: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Risk Management Requires Layered Protection

Servers

Protect server workloads wherever

they may be -- physical, virtual or cloud

Page 8: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Networks

Risk Management Requires Layered Protection

Servers

Detect and block threats hitting the data center and

user environments, maximizing efficiency

Page 9: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Users

Networks

Risk Management Requires Layered Protection

Protect user activities anywhere on any device reducing initial point of

infection Need for connected threat defense and centralized visibility

increases

Servers

Page 10: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

Gain centralized visibility across the system, and

analyze and assess impact of threats

Enable rapid response through shared threat

intelligence and delivery of real-time security

updates

Detect advanced malware, behavior and communications invisible to standard defenses

Assess potential vulnerabilities and proactively protect endpoints, servers and applications

PROTECT

DETECT

RESPOND

Page 11: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

PROTECT

DETECT

RESPOND

Page 12: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

PROTECTAnti-Malware and Content Filtering

Intrusion Prevention

App Control

Integrity Monitoring

Encryption and Data Loss Prevention

Page 13: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

DETECT

PROTECT

RESPONDRESPOND PROTECT

Page 14: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

DETECT

“The traditional defense-in-depth components are still necessary, but are no longer sufficient in protecting against advanced targeted attacks and advanced malware.”

Network Content Inspection

Custom Sandbox Analysis

Behavioral Analysis

Machine Learning

Lateral Movement Detection

Page 15: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

DETECT

PROTECT

Connected Threat Defense: Better, Faster Protection

RESPOND

DETECT

PROTECT

Page 16: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

RESPOND 1. Malware infects an endpoint

2. Deep Discovery detects malware

3. Real-time signature pushed to endpoints (logging or blocking)

4. Endpoint Sensor can investigate whether threat had spread

RAPID RESPONSE

Page 17: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

RESPOND

CENTRALIZED THREAT SHARING AND VISIBILITY

ENDPOINT PROTECTION

CUSTOM SANDBOX

OfficeScan URL, File, IPEndpoint Sensor IOC, SHA, IP, DomainOfficeScan ActionEndpoint Sensor

Page 18: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

RESPOND

CENTRALIZED THREAT SHARING AND VISIBILITY

ENDPOINT PROTECTION

MAILSECURITY

CUSTOM SANDBOX

ScanMail for Exchange SHA-1InterScan Mail Security

SHA, IP, DomainScanMail for Exchange Risk Level InterScan Mail Security

Risk Level

Page 19: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

RESPOND

CENTRALIZED THREAT SHARING AND VISIBILITY

ENDPOINT PROTECTION

MAILSECURITY

WEBGATEWAY

CUSTOM SANDBOX

InterScan Web Security

URL, File, IPInterScan Web Security

Action

Page 20: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

RESPOND

CENTRALIZED THREAT SHARING AND VISIBILITY

ENDPOINT PROTECTION

MAILSECURITY

WEBGATEWAY

CUSTOM SANDBOX

HYBRID CLOUDSECURITY

Deep Security URL, FileDeep Security Action

Page 21: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

RESPOND

CENTRALIZED THREAT SHARING AND VISIBILITY

ENDPOINT PROTECTION

MAILSECURITY

WEBGATEWAY

CUSTOM SANDBOX

HYBRID CLOUDSECURITY

TippingPoint IPS URL, File, IP, Domain

INTRUSION PREVENTION

Page 22: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

RESPOND

CENTRALIZED THREAT SHARING AND VISIBILITY

ENDPOINT PROTECTION

MAILSECURITY

WEBGATEWAY

CUSTOM SANDBOX

HYBRID CLOUDSECURITY

Control Manager URL, File, IP,Domain, SHA

INTRUSION PREVENTION

Page 23: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

RESPOND

CENTRALIZED THREAT SHARING AND VISIBILITY

ENDPOINT PROTECTION

MAILSECURITY

WEBGATEWAY

CUSTOM SANDBOX

HYBRID CLOUDSECURITY

INTRUSION PREVENTION

Page 24: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster Protection

RESPONDThreat Information can be shared with third party applications such as SIEMs, Firewalls, IPS and other applications via Web API

THIRD PARTY SHARING

CUSTOM SANDBOX

NETWORKDETECTION

NEXT GENFIREWALL

SIEM NETWORK IPSIBM Qradar

HP ArcsightSplunkAlienVault

IBMCheck PointPalo Alto NetworksBlue Coat

API

WEB API

Page 25: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

DETECT

PROTECT

Connected Threat Defense: Better, Faster Protection

RESPOND

DETECT

RESPOND PROTECT

Page 26: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Connected Threat Defense: Better, Faster ProtectionUser-based visibility,

investigation and management

Page 27: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

Strong Central VisibilitySingle dashboard with visibility across

layers of protection

Page 28: HUSSAM ABU-RIDA Threat Defens… · Connected Threat Defense: Better, Faster Protection. RESPOND. Threat Information can be shared with third party applications such as SIEMs, Firewalls,

w w w . m e n a i s c . c o m

CONNECTED THREAT DEFENSE

Questions?

HUSSAM ABU-RIDATECHNICAL LEADTREND MICRO


E II DEFENS PLIR NTRUCTON UND TRUINING I/I · PDF fileuda44 834 0oie e ii defens plir ntructon und truining i/i ... performing organization name and address i0. program element. project.

E II DEFENS PLIR NTRUCTON UND TRUINING I/I · PDF fileuda44 834 0oie e ii defens plir ntructon und truining i/i ... performing organization name and address i0. program element. project.

Anne Siems - A Careful Observation of Daylight II

Anne Siems - A Careful Observation of Daylight II

Defens as Alternativa s

Defens as Alternativa s

Biotechnological and Spectroscopical Evaluation of ... · FACOLTÀ DI SCIENZE AGRARIE E ALIMENTARI Department of Food, Environmental and Nutritional Sciences (DeFENS) Graduate School

Biotechnological and Spectroscopical Evaluation of ... · FACOLTÀ DI SCIENZE AGRARIE E ALIMENTARI Department of Food, Environmental and Nutritional Sciences (DeFENS) Graduate School

Re Vista Defens or 8

Re Vista Defens or 8

Defens mechanism

Defens mechanism

Nres-1 for Tom Defens

Nres-1 for Tom Defens

SIEMS Monthly Briefing 2011-07 Eng

SIEMS Monthly Briefing 2011-07 Eng

e sbiblioteca2.uclm.es/biblioteca/CECLM/ARTREVISTAS/cuenca/defens… · ,i.-~ '.,-":';': '7 ,,' • '.....,.~ ":.'.~ " "..;; U il "• .;. ~, "1- j "" ~ ~ • __o t, .. I J.}I _ .....

e sbiblioteca2.uclm.es/biblioteca/CECLM/ARTREVISTAS/cuenca/defens… · ,i.-~ '.,-":';': '7 ,,' • '.....,.~ ":.'.~ " "..;; U il "• .;. ~, "1- j "" ~ ~ • __o t, .. I J.}I _ .....

CORONAVIRUS: OPINION AND REACTION...Germany Japan Russia Very high threat High threat Moderate threat Low threat Very low threat Don't know (Your country) What level of threat do you

CORONAVIRUS: OPINION AND REACTION...Germany Japan Russia Very high threat High threat Moderate threat Low threat Very low threat Don't know (Your country) What level of threat do you

Yi Huang Steve Siems Michael Manton

Yi Huang Steve Siems Michael Manton

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

Siems Product

Siems Product

Counter Threat Unit™ Threat Intelligence

Counter Threat Unit™ Threat Intelligence

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

ISSUE Shawn Buryskayska - semnbuyersguide.com · Shawn BurShawn Buryskayska REAL ESTAA TE - ROCHESTER MNTE - ROCHESTER MN ... 7224 Siems Lane NE • $569,900 Stately …

ISSUE Shawn Buryskayska - semnbuyersguide.com · Shawn BurShawn Buryskayska REAL ESTAA TE - ROCHESTER MNTE - ROCHESTER MN ... 7224 Siems Lane NE • $569,900 Stately …

INSIDER THREAT - Optiv · Insider Threat Defined While insider threat has been defined in many different ways, Optiv defines insider threat as: “An insider threat is an employee,

INSIDER THREAT - Optiv · Insider Threat Defined While insider threat has been defined in many different ways, Optiv defines insider threat as: “An insider threat is an employee,

Boundary Layer Clouds & Sea Spray Steve Siems, Yi (Vivian) Huang, Luke Hande, Mike Manton & Thom Chubb.

Boundary Layer Clouds & Sea Spray Steve Siems, Yi (Vivian) Huang, Luke Hande, Mike Manton & Thom Chubb.

Cybercore Threat Analysis I - Fact Sheets Threat... · 2020. 12. 3. · THREAT ANALYSIS Similarly, control systems threat analysts must maintain a strategic perspective of the threat

Cybercore Threat Analysis I - Fact Sheets Threat... · 2020. 12. 3. · THREAT ANALYSIS Similarly, control systems threat analysts must maintain a strategic perspective of the threat

Exposition Defens 00 as So

Exposition Defens 00 as So