Proactively Discovering Malicious Activity On Your...

Proactively Discovering Malicious Activity On Your Network

Mark Guntrip Product Marketing, Symantec

1487 - Proactively Discovering Malicious Activity on Your Network

Mark Feeney Manager, IT Security, AMETEK

SYMANTEC VISION 2014

Agenda

1487 - Proactively Discovering Malicious Activity on Your Network 2

The Best Place to Detect Malicious Behavior 1

Different Viewpoints 2

AMETEK Real-World Case Study 3

The big question…

“Where is the best place to detect malicious behavior?”

SYMANTEC VISION 2014 1487 - Proactively Discovering Malicious Activity on Your Network 4

The big question…

0 5 10 15 20 25

Server

Network

Endpoint

Gateway

At what point do you believe advanced threats are stopped or identified?

What does this question mean to different people?

Where my core data

resides

What I think malicious activity is

Where I believe I might be

vulnerable

Within the bounds of my control

I’m blocking threats

before they get in

What does this question mean to different people?

Where my core data

resides

vulnerable

before they get in

Shortened URLs

Where my core data

resides

vulnerable

before they get in

Real Time Link Following

Active Content

Where my core data

resides

vulnerable

before they get in

Disarm Technology

• Problem: attacks using malicious, attached email documents

– Primarily used in spear phishing emails – Advanced Persistent Threat (APT)

– Contain malicious active content, or exploit payloads targeting parser vulnerabilities

• Solution: reconstruct attachment documents from scratch before presenting to the user

Content Download

Where my core data

resides

vulnerable

before they get in

Symantec Insight

6.3 billion files

300 million machines

2 million URLs

Insight makes decisions based on who downloads what from where…

When one machine downloads a file, all reputations must be re-calculated!

Not just how many times a file is downloaded.

That’s over 100 billion associations that must be refreshed every few hours!

Drive-by Download

vulnerable

before they get in

Where my core data

resides

Network Threat Protection

• Threat Protection Efficacy from Drive-by Downloads

• Prevent browser exploitation

• Blocks attacks where endpoint protection may not be in place such as BOYD support

• Detect internal malware proliferation

64% of Symantec malware blocks due to network threat detection

Devices Outside The Network

before they get in

vulnerable

Where my core data

resides

Cloud Security

Unmanaged Devices

before they get in

vulnerable

Where my core data

resides

Protect Technologies

• Gateway/cloud

– Email Security – on-premise and cloud – strip active content, follow links

– Web Security – on premise and cloud – detect botnet activity, protect remote devices when they are off-network

– Protect unmanaged devices

• Server/Endpoint

– Prevent malicious content from installing

– Detect malware post-infection

Shift in viewpoint

Protect Detect Respond Recover

Realization

Customer Needs Shift

Breach is Inevitable

From Protection Only To Protection +

Detection and Response

Understanding Where Important

Data Is

Stopping Incoming Attacks

Finding Incursions

Containing & Remediating

Problems

Restoring Operations

Identify

before they get in

Detecting and stopping malware activity

before they get in

Gateway

• Command &Control Communications

• Botnet activity

• Inactive botnets

before they get in

Web Client

systems

Inspects packets, IPs, URLs, files,

active content, applications, behavior

Symantec Web Gateway

Detecting and stopping malware activity

• Managed Security Services

before they get in

Desktops

Symantec MSS

• Network

• Server

• Endpoint

• Data

• Compliance

Restriction

• Organization

• Asset Value

• System

Function

•Threats

• Vulnerabilities

• Malcode

• File & Site

Reputation

Shift in viewpoint

Protect Detect Respond Recover

Realization

Customer Needs Shift

Breach is Inevitable

From Protection Only To Protection +

Detection and Response

Understanding Where Important

Data Is

Stopping Incoming Attacks

Finding Incursions

Containing & Remediating

Problems

Restoring Operations

Identify

How AMETEK Found, Watched & Beat a Malware Campaign

Mark Feeney Manager, IT Security - AMETEK

• $3.6B global manufacturer of electronic instruments and electro-mechanical devices

• AMETEK is a component of the S&P 500 Index. (AME)

• Over 120 Manufacturing and 80 sales and services locations

• 30 Countries

• 4 Data Centers. Boston MA , Horsham PA, Leicester UK, Singapore

• 14,000 employees worldwide

Timeline

• FBI, San Diego Sept 2013

• Just a little “noise” June 2013

• Aahh. There it is! Oct 2013

• FBI, Boston

• Ongoing process begins Nov 2013

Key Takeaways

• If the FBI wants to talk to you, talk to them

• Don’t be afraid to ask your vendors for help

• If you haven’t already, upgrade to SEP 12.1

• Reduce lateral movement

• Eliminate password reuse

• Look to gateway security measures to maximize visibility

• Devices outside your control are still critical

• Plan to Protect, Detect, Respond, Recover

For more information on Symantec future plans for malware and targeted attack detection: Gateway, Cloud and Targeted Attacks: Symantec’s Vision, Strategy and Roadmap 10.15 – 11.15AM AUGUSTUS BALLROOM 2

Thank you!

YOUR FEEDBACK IS VALUABLE TO US!

Please take a few minutes to fill out the short session survey available on the mobile app—the survey will be available shortly after the session ends. Watch for and complete the more extensive post-event survey that will arrive via email a few days after the conference.

To download the app, go to https://vision2014.quickmobile.com or search for Vision 2014 in the iTunes or Android stores.

Proactively Discovering Malicious Activity On Your...

Documents

Transcript of Proactively Discovering Malicious Activity On Your...

Proactively Maintaining the Database

Stefan Schmid - TUM · Adding Malicious Players… • What is the impact of malicious agents in this selfish system? • Let us add b malicious players to the grid! • Every malicious

€¦ · Internal Malicious Espionage I/T Sabotage Fraud / abuse IP Theft Non-malicious External Malicious Non-malicious CERT Threat Models • An authorized user of a system who

Twarfing: Malicious Tweets

Proactively Detecting Occupational Fraud Using … Detecting Occupational Fraud Using Computer Audit Reports ... Proactively Detecting Occupational Fraud Using ... Proactively Detecting

Discovering Malware with Time Series ShapeletsFigure 1. Entropy time series from malicious/malware files (left/red) and benign/safe files (right/green). Note the wide variation in

Increase Sales on Twitter (Proactively!)

Discovering Malicious Domains through Passive DNS Data ......The user has requested enhancement of the downloaded file. Discovering Malicious Domains through Passive DNS Data Graph

Malicious Code Brian E. Brzezicki. Malicious Code (from Chapter 13 and 11)

Proactively Managing Your Career - MinneWebCon

Diversifying Web Service Recommendation Results via ......the information overload problem. Web service recom-mendation is a process of proactively discovering and recommending suitable

Phishing and Malicious JavaScript - eecs.csuohio.edueecs.csuohio.edu/~sschung/CIS408/Ch05-malicious-javascript.pdfPhishing and Malicious JavaScript. Outline Phishing and online identity

Malicious Cryptography Techniques for Unreversable ... · Malicious Cryptography Techniques for Unreversable (malicious or not) binaries Eric Filiol filiol@esiea.fr ESIEA - Laval

Proactively Detecting Distributed Denial of Service ... · A denial-of-service (DoS) attack is a malicious attempt by a single person or a group of people to cripple an online service.

Malicious Cryptography

ASEC REPORT - AhnLab · ASEC REPORT 45 | MALICIOUS CODE TREND 4 Ranking Malicious Code Reports Percentage Ranking ↑↓ Malicious Code Reports Percentage Table 1-2 | Top 20 Malicious

Proactively Manage Your Design Budget

Malicious Software Malicious Software Han Zhang & Ruochen Sun.

Proactively managing global challenges

Discovering Evasive Code in Malicious Websites · Discovering Evasive Code in Malicious Websites with High-&Low-interaction Honeyclients. Yuta Takata, Ph.D. NTT-CERT