symantec website security threat report 2016 website security threa… · discover symantec website...
TRANSCRIPT
Symantec Website Security Threat Report 2016
Lee-Lin Thye
Senior Product Marketing Manager
Introducing Symantec, the Global Website Security Leader
Copyright © 2016 Symantec Corporation2
*Source:Customer analysis using Fortune 500 Pub. 2015, Forbes Global 2000 Pub. 2015, Internet Retailer Top 500 guide 2015 Edition, Internet Retailer Europe Top 500 Guide 2015 Edition, Internet Retailer Latin America Top 500 Edition 2015
Discover Symantec Website Security Threat Report
• Annual report on internet threat data around the world
• Source: Symantec™ Global Intelligence Network– 63.8 million attack sensors
– records thousands of events per second
– threat activity compiled from over 157 countries and territories through a combination of Symantec products and services:• Symantec DeepSight™ Intelligence• Symantec™ Managed Security Services• Norton™ consumer products• Symantec™ Website Security• And other 3rd party data sources
• World’s most comprehensive vulnerability database– 66,400 recorded vulnerabilities
– 21,300 vendors
– 62,300 products
Spam, Phishing, and Malware
• Sources for Data Capture include:
– Symantec Probe Network
• More than 5 million decoy accounts
– Symantec.cloud
– Symantec Website Security
• Secures more than 1,000,000 web servers worldwide with 100 percent availability
• Secures more than 83 percent of global ecommerce revenue
• Validates revocation status of more than 6 billion Online Certificate Status Protocol (OCSP) look-ups per day
• Norton Secured Seal is displayed almost one billion times per day on websites in 170 countries
Security Breaches Numbers
Source: Symantec Internet Threat Response volume 21, 2016
Copyright 2016 Symantec Corporation5
Tracking Down the Numbers
Data Breach: How and What
Spam
More than 50% inbound business email traffic was spam
Phishing
Web Attacks
Malicious Activity by Web Attack Origins
Vulnerabilities on Websites
78%Scanned Websites with
Vulnerabilities
15%Critical Vulnerabilities
Top 10 Vulnerabilities Found Unpatched
Best Practice Guidelines
• Get in line with industry standards– Implement always-on SSL/TLS
– Migrate to SHA-2
– Consider adopting Elliptic Curve Cryptography
• Use SSL/TLS Correctly– Keep protocol libraries up to date
– Don’t let your certificates expire
– Display easily recognizable trust marks (e.g. Norton Secured Seal)
• Manage your SSL/TLS keys properly– Limit access to keys
– Compartmentalize access
– Deploy automated certificate and key management systems
– Report key breaches to CA immediately
• Adopt Comprehensive Website Security– Scan regularly
– Consider the whole ecosystem including defense against injection and DDoS attacks
Discover website vulnerabilities and
malware. Protect against DDoS,
Layer 7 attacks and more
DETECTION, MITIGATION AND REPORTING
Stay Always-on
SSL/TLS CERTIFICATE OPTIONS & CODE SIGNING
KEY SECURITY
Automate certificate lifecycle
management, and get support 24/7
MANAGEMENT TOOLS & SUPPORT
Optimize performance with high-
performing algorithms
CRYPTOGRAPHIC ALOGRITHM & PERFORMANCE
ENCHANCERSIncrease user confidence with
visual indicators and assurance
CONVERSION OPTIMIZATION ENABLERS
Eliminate risks of stolen and
misused keys. Transfer sensitive
data securely.
AUTOMATED SCANS & VISIBILITY
Ensure compliance with industry
standards and best practices
Maintain Compliance
Strengthen Defenses
Optimize Performance
Build Confidence (and business)
Powerful solutions to deliver a single source of protection
Protect Data & Keys
Symantec™ Complete Website Security:
Discover website vulnerabilities and
malware. Protect against DDoS,
Layer 7 attacks and more
Malware Scanning, Vulnerability Assessment, Imperva Incapsula WAF, Imperva Incapsula DDoS Protection
Stay Always-on
Secure App Service, Private Certificate Authority, ECC
SSL/TLS Certificates
Automate certificate lifecycle
management, and get support 24/7
Certificate Intelligence Center Automation, Support
Optimize performance with high-
performing algorithms
ECC SSL/TLS Certificates, Imperva Incapsula CDN
Increase user confidence with
visual indicators and assurance
Norton Secured Seal, EV SSL/TLS Certificate, Seal in Search
Eliminate risks of stolen and
misused keys. Transfer sensitive
data securely.
Certificate Intelligence Center Discovery
Ensure compliance with industry
standards and best practices
Maintain Compliance
Strengthen Defenses
Optimize Performance
Build Confidence (and business)
Powerful solutions to deliver a single source of protection
Protect Data & Keys
Symantec™ Complete Website Security:
Summary
• Threat landscape continues to be more menacing than ever
– Mega breach on the rise
– Total identities stolen increasing
• Avoid Compromising Trusted Relationships with Users and Partners
– Implement Best Practices
– Deploy Complete Website Security
• Scan websites for malware
• Assess websites for vulnerability
• Defend against attacks e.g. DDoS
• Secure against malware infection and man-in-the-middle attacks
• Assure users that you have a secure website with trust marks and green browser address bar
Resources
• Symantec Website Security Website:
– https://www.symantec.com/website-security/
• Symantec Website Security Threat Report
– https://websitesecurity.symantec.com/campaigns/16963-campaign/current/landing/assets/wstr-pt1-us.pdf
Copyright 2016 Symantec Corporation17
Thank you!
Copyright © 2016 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.
This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice.
Lee-Lin Thye
18