advanced cyber illness treatmant - it klinika...advanced threat protec0on block, isolate and remove...

AdvancedCyberIllnessTreatmant

Davor PeratSenior Technology Consultant

Agenda

2

1

2

3

4

5

6

7

AdvancedThreatProtec0onPreventadvancedpersistentthreats

AdvancedThreatProtec0onIden0fysuspiciousfiles

AdvancedThreatProtec0onSearchforIndicatorsofCompromise

AdvancedThreatProtec0onBlock,isolateandremovetheadvancedpersistentthreats

AdvancedThreatProtec0onMinimizeenvironmentalchanges

SymantecProductIntegra0onandSupport

Addi0onalResourcesandSummary

3

Let’sgetstarted!

WhatareAdvancedThreats?

Targeted

Targetsspecificorganiza0onsand/orna0onsforbusinessor

poli0calmo0ves

Stealthy

Usespreviouslyunknownzero-day

aJacks,rootkits,andevasivetechnologies

Persistent

Sophis0catedcommandandcontrolsystemsthatcon0nuouslymonitorandextractdatafromthespecifictarget

4Copyright©2014SymantecCorpora0on

HowTheyWork:AdvancedThreats


Whatthelikelihoodisofbeingatarget

18%

31% 30% 34%

32% 19%31% 25%

50% 50% 39% 41%

2011 2012 2013 2014

1-250 251-2500 2501+Sizeoforganisa0on:


Whattheresultsareofbeingatarget

66% Breaches

undetected for 30 days

or more

243 Is the average number of days before detection

4 Months is the

average time to remedy once detection has

occurred

Technically


Whattheresultsareofbeingatarget(conJnued)

Commercially

Resource Opex Capex

Legal Fees Time

Money

Theft Intellectual Property

Money Customer Data Employee Data

Reputation Brand Reputation

can be affected if a breach is reported in

the press


EvenwiththebestprevenJontechnologies,canyoustopadvancedpersistentthreats?

9

PREVENT

StoppingIncomingAJacks

WhileprevenJonissJllveryimportant….

…youneedtopreparetobebreached.

PREPARE

UnderstandingWhereImportantDataIs&WhoCanAccessIt

DETECT

FindingIncursions

RESPOND

Containing&Remedia0ngProblems

RECOVER

RestoringOpera0ons

Copyright©2014SymantecCorpora0on

Ifyouarebreached,howfastcanyoudetect,respondandrecover?

10

PREPARE

UnderstandingWhereImportantDataIs&WhoCanAccessIt

PREVENT

StoppingIncomingAJacks

DETECT

FindingIncursions

RESPOND

Containing&Remedia0ngProblems

RECOVER

RestoringOpera0ons


Copyright©2014SymantecCorpora0on11

IdenJfysuspiciousfilesATPSolu0on:

SymantecAdvancedThreatProtecJon:Modules

•  Endpointvisibility(thefootholdinmosttargetedaJacks)

•  Endpointcontext,suspiciousevents,&remedia0on

•  RequiresSEP–nonewagent–anddeployedasavirtualorphysicalappliance

•  Networkvisibilityintoalldevices&allprotocols

•  Automatedsandboxing,webexploits,command&control

•  DeployedoffaTAPorinlineasvirtualorphysicalappliance

•  Emailvisibility(s0llthenumberoneincursionvector)

•  Emailtrends,targetedaJackiden0fica0on,sandboxing

•  Cloud-basedeasyaddontoEmailSecurity.cloud


SymantecAdvancedThreatProtecJon:Cynic

13

ATP:ENDPOINT

ATP:NETWORK

ATP:EMAIL

Virtualsandbox

Cynic

Detec0onengines Physicalsandbox


Cynic-FileTypes• Windowsbinaries:EXE,DLL,SYS(drivers),OCX(Ac0veXcontrols),SCR(ScreenSavers)

•  Officedocs:Word,Excel,PowerPoint

•  Javaapplets

•  Compressedfiles(rar,zip,7z)

•  AdobeAcrobat

14

SkepJc:pseudoequaJonforheurisJcanalysis


+ Ques'onablesource+ SuspectA3achment+ Suspiciouscodeina3achment(+ Evidenceofobfusca'on)(+Unexpectedencryp'on)______

Heuris'callydetectedmalcode

*Notallsuspiciouselementsrequiredforconvic0on

SONAR•  Dynamicanalysis

•  Doesnotmakedetec0onsonapplica0ontype,butonhowaprocessbehaves.

•  Ifitbehavesmaliciously,regardlessofitstype,itwilltriggeradetec0on


VirtualExecuJon•  VMexecu0onwithmimickedenduserbehavior

•  RangeofOSandapps•  VMexecu0onrangeofOSandapplica0ons

•  VMcommunica0onanalysis

VirtualMachines

OSAPPS

OSAPPS

OSAPPS

OSAPPS

Apps

VirtualMachines

OSAPPS

OSAPPS

OSAPPS

OSAPPS

VirtualMachines

OSAPPS

OSAPPS

OSAPPS

OSAPPS


PhysicalExecuJon

• Physicalhardware• Baremetalexecu0on

–  NoVirtualiza0on



SearchforIndicatorsofCompromise

ATPSolu0on:


ConsoleHome


OverviewInforma0on


Clickablelinksforfurtherinves0ga0on

24

Furtherac0ons

EnJtyPointPages

25

FileEnJtypageRelatedIncidentsRelatedEventsSeenonEndpointsFilesdownloadedOriginsFilesnamedassociatedwithHashCynicResults

DomainEnJtyPageRelatedIncidentsFilesdownloadedEndpointsthatcommunicatedIP’sAssociatedwithDomain

EndpointEnJtyPageRelatedIncidentsRelatedEventsMaliciousFilesMaliciousConnec0ons


IncidentManager


IncidentTracking


Searches

TypesofSearches

•  Inline(Datastore)–  Searcheslocaldatastoreforar0facts–  Secondstoreturnresults–  Ar0factsaregeneratedfromendpointandnetworksensorevents–  Examples(file,hash,domainname,hostname,username,IP)–  PEFiletypes(exe,dll,com,scr,msi,drv,sys,ocx,cpl)

•  EndpointInterroga0on–  Searchesendpointforar0facts–  Resultscanbedelayedbasedonfactors–  Examples(file,hash,registry)–  Allfiletypes(PE,NonPE)

.


Searches

Filesusing–  Filename–  FileHash(SHA256,MD5)

Endpointsusing–  Hostname–  IPAddress(v4)–  Logonuser

Externaldomainsusing–  Domainname–  DomainURL–  DomainIPaddress

•  Wecheckiftheprovidedvalueispresentanywhereintheabovefieldsi.e.filename,MD5,sha2,hostnameetc.i.e.containsmatch.


SymantecAdvancedThreatProtecJon:Synapse

32

ATP:ENDPOINT

ATP:NETWORK

ATP:EMAIL

Correla0onandPriori0za0on Remedia0onRepor0ngand

Inves0ga0on

Synapse



Block,isolateandremovetheadvancedpersistentthreats

ATPSolu0on:

Firstlineofdefense:ATP:Email

Anythingwithoutaverdictwillbe

scannedbyCynicforacustomer

configureddura0on(≤20mins)

Maliciousmailisquaran0nedand

loggedassoonasadetec0onmethod

flagsit


ConnecJonleveldetecJon Signatures

SkepJcHeurisJcsandLinkFollowing

Cynic

ATP:Network&Endpoint

SEPM

Sweep,Hunt,Collect,Fix



ATPAppliance

Cynic


SEPM




ATPAppliance

Cynic

QUARANTINE


SEPM




ATPAppliance

Cynic

QUARANTINE

Blacklist

Domainwww.google.com.gov.ca

URL

gov.ca/dmvhJp://stanford.edu/newshJp://gość.pl/a

IP/IPSubnet

fe80::250:56ff:fe99:390310.10.10.10/2410.10.10.10/255.255.255.0

SHA256Hash

e3b0c44298fc1c149asf4c8996s92427ae41e4649b934ca495991b7852b854MD5hash

fe58cec593d7cdf2e0e9d13dfe1020b838

Blacklist/WhitelistValidEntries



Minimizeenvironmentalchanges

ATPSolu0on:

WAN

LAN

EmailSecurity.cloud

WAN

LANInsight

ATP:Endpoint+Manager

EmailSecurity.cloud

WAN

LANInsight

Logs&Remedia0on

ATP:Endpoint+Manager

EmailSecurity.cloud

WAN

LANInsight

Logs&Remedia0on

Networktraffic

ATP:Endpoint+ManagerATP:Network

EmailSecurity.cloud

WAN

LANInsight

Logs&Remedia0on

Networktraffic

Synapse


EmailSecurity.cloud

WAN

LANInsight

Logs&Remedia0on

Networktraffic

SynapseCynic


EmailSecurity.cloud

WAN

LANInsight

Logs&Remedia0on

Networktraffic

SynapseCynic


ATP:EmailEmailSecurity.cloud

WAN

LANInsight

Logs&Remedia0on

Networktraffic

SynapseCynic


ATP:EmailEmailSecurity.cloud

ATP:Emailcorrela0on

SymantecAdvancedThreatProtecJon

48

ATP:ENDPOINT

ATP:NETWORK

ATP:EMAIL

Correla0onandPriori0za0on

Virtualsandbox

Remedia0on

Cynic

Repor0ngandInves0ga0on

Detec0onengines Physicalsandbox

Synapse


49

SymantecServicesHelpingyouwithallofyourproductneeds


SupportServices

ConsulJngServices

EducaJonServices

Premier(ValueBased

Services)RemoteProductSpecialist(RPS)

BusinessCriJcalServices

HelpmeDESIGNit,INSTALLit,ENHANCEit

HelpmeLEARNaboutit&USEit

HelpmeUNLOCKVALUE&

OPTIMIZEitHelpmeFIXit

50

SymantecTechnicalServicesSupportsYou

EducaJonServices

Abroadrangeoftrainingsolu0onstohelpyougetthemostoutof

Symantecproducts.


•  Achieveexpectedvalueforyourproducts.•  LearnhowSymantecproductscansolveyourbusiness

problemstodayandtomorrow.•  Gainbestprac0ceinsighttokeepyourinvestments

runningsmoothlylong-term.

•  Formoreinforma0onvisittraining.symantec.com

51

SymantecEducaJonServicesOffersEffecJveProductTraining

ServicesforATP–morehelp,moresuccess!Whattosellandwhotocontact


Service Whatitis Availablewhen?

GlobalContacts WebsiteEducaJonCourseOffering

ATPIncidentResponseCourseavailableas

InstructorLedTrainingorviaVirtualAcademy

[email protected];[email protected];[email protected]

Educa0onServiceswebsite

BCSPremier

forATP

Symantec’spremiumSupportServicesoffering,

designedtosimplifysupport,maximizereturn

andprotectITinfrastructure.

AtProductGA

ContactBCSteammembersfromtheinternalSAVOpageorPartnerNet

BCSContactPage

BCSProacJveServicesfor

ATP

Reviewofcustomer’sATPconfigura0onandini0al

repor0ngfromATPconsoleAtProductGA

ContactBCSteammembersfromtheinternalSAVOpageorPartnerNet

BCSContactPage

ConsulJngServicesfor

ATP

On-siteImplementa0onServices,Solu0on

Assessment&Op0miza0on&

ResidencyServices

AtProductGA

[email protected][email protected]

[email protected]

Consul0ngwebsite

AddiJonalResourcesandSummary

53

RESOURCES

IfyouwouldliketoknowmoreaboutAdvancedThreatProtec0onpleasevisit:hJps://www.symantec.com/advanced-threat-protec0on/

SUMMARYDuringthispresenta0onwehavediscussedhowAdvancedThreatProtec0onenablesacustomertopreventadvancedpersistentthreats,iden0fysuspiciousfilesandsearchforIndicatorsofCompromise.WealsolearnedhowATPcanblock,isolateandremovetheadvancedpersistentthreatswhileminimizingenvironmentalchangesbyleveragingacompany’sexis0ngSymantecsecurityinvestment.

advanced cyber illness treatmant - it klinika...advanced threat protec0on block, isolate and remove...

Documents