Malware Defense-in-Depth 2.0

16
Malware Defense-in-Depth 2.0 A practical approach to secure your enterprise against viruses, worms and rootkits Aa’ed Alqarta

TAGS:

description

 

Transcript of Malware Defense-in-Depth 2.0

Page 1: Malware Defense-in-Depth 2.0

Malware Defense-in-Depth 2.0

A practical  approach to secure your enterprise against viruses,

 worms and rootkits

Aa’ed Alqarta

Page 2: Malware Defense-in-Depth 2.0

The ProblemSecurity defenses can’t keep up

with latest threatsMalware is penetrating the

network and infecting computersAntivirus software is not a silver

bullet for all threatsWe are losing the war against

malware

Page 3: Malware Defense-in-Depth 2.0
Page 4: Malware Defense-in-Depth 2.0

4

What is a Malware?According to NIST, “Malware (NIST, 2005) refers to a

program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system (OS) or of otherwise annoying or disrupting the victim.”

NIST: National Institute of Standards and Technology

Page 5: Malware Defense-in-Depth 2.0

Types of MalwaresVirusesWormsBackdoorsSpywaresBots “Botnets”RootkitsRansomware

Page 6: Malware Defense-in-Depth 2.0

Top Malware Targets

Page 7: Malware Defense-in-Depth 2.0

Attack AnatomyAttackers discover vulnerabilities and

write exploits for them (e.x JS)They infect web sites to attack visitorsA visitor browse the site and

immediately get infected A virus will be installed in the

background and infect the client software

Infected computers will attack internal clean machines (Workstations/Servers)

Page 8: Malware Defense-in-Depth 2.0

Web URL FilteringEnable AV scanning for malicious

files/URLsBlock access to malicious

categories (Porn/Hacking/Downloads/Video/P2P/Torrent/Blogs/Infected Hosts/IM)

Block downloads of executables (exe/dll/com)

Inspect SSL traffic for malicious traffic

Page 9: Malware Defense-in-Depth 2.0

Application Control (Whitelisting)Allow business approved applications

only◦Office, Accounting, Finance, …etc

Protect critical system files from modifications

Block any unapproved applications (including malwares)

The ability to block zero-day malware if AV is not detecting it

Monitoring of all applications usage in the net

Page 10: Malware Defense-in-Depth 2.0

Device Control

Block the usage of removable drives (Flash / IPod / H.D / Camera)

If you should allow Flash drives in the network:

- Use “Secure” Flash disks (Encryption, AV, Password

- Disable “Autorun” and block exe/Autorun.inf

Page 11: Malware Defense-in-Depth 2.0

Network Access ControlOnly allows compliance computers

in the network◦AV is running and updated◦FW is running◦Latest Service Pack◦Domain User

Quarantine infected computers in a separate “Remediation Environment” ◦WSUS, AV Server, Proxy

Page 12: Malware Defense-in-Depth 2.0

FW Best PracticesNo “Any Any” rulesOut-bound SMTP for Exchange

servers onlyHTTP/HTTPS/FTP are a good start

for end userBlock Infected computersEnabled outbound denied logging

Page 13: Malware Defense-in-Depth 2.0

Case Study: Conficker/DownadupWindows Server service vulnerability

(MS08-067)W32.Downadup A, B, C, EPropagates through network file

shares, flash disksDisables User Accounts in ADBlocks access to security sites and MS

updatesStops security tools and softwares

“self-protection”

Page 14: Malware Defense-in-Depth 2.0
Page 15: Malware Defense-in-Depth 2.0

SummaryUse a good antivirus which has a

high detection ratePatch OS + 3rd party applicationsUse Application Whitelisting +

Device ControlBlock access to malicious, media,

downloads, and blogs Network segmentationsWeb content filtering policy

Page 16: Malware Defense-in-Depth 2.0

Thank You

E-mail me: [email protected] http://extremesecurity.blogspot.com

http://extremesecurity.blogspot.com/
http://extremesecurity.blogspot.com/

NTXISSACSC4 - Layered Security / Defense in Depth

NTXISSACSC4 - Layered Security / Defense in Depth

Exploiting Similarity Between Variants to Defeat Malware · Impact of Variation on Malware Defense Adds layer of complication defense was bad enough before variant flood now malware

Exploiting Similarity Between Variants to Defeat Malware · Impact of Variation on Malware Defense Adds layer of complication defense was bad enough before variant flood now malware

Defense in Depth – Your Security Castle

Defense in Depth – Your Security Castle

Cyber security - Defense in depth

Cyber security - Defense in depth

Critical Infrastructures Security: Improving Defense Against Novel Malware … · 2020. 3. 19. · Critical Infrastructures Security: Improving Defense Against Novel Malware and Advanced

Critical Infrastructures Security: Improving Defense Against Novel Malware … · 2020. 3. 19. · Critical Infrastructures Security: Improving Defense Against Novel Malware and Advanced

NR Defense-In-Depth Brief

NR Defense-In-Depth Brief

Defense in Depth - MEECmeec-edu.org/files/2015/10/SLAIT-Defense-in-Depth_MEEC_April-21-… · 2016-04-21  · Defense in Depth Defense in Depth • Coordinated use of multiple security

Defense in Depth - MEECmeec-edu.org/files/2015/10/SLAIT-Defense-in-Depth_MEEC_April-21-… · 2016-04-21  · Defense in Depth Defense in Depth • Coordinated use of multiple security

Defense in Depth Strategies

Defense in Depth Strategies

Defense in Depth - University of Cincinnatigauss.ececs.uc.edu/Courses/c6055/pdf/defense-in-depth.pdf · Military – defense in depth: The siting of mutually supporting defense positions

Defense in Depth - University of Cincinnatigauss.ececs.uc.edu/Courses/c6055/pdf/defense-in-depth.pdf · Military – defense in depth: The siting of mutually supporting defense positions

Real Time Malware Defense System in LINUX

Real Time Malware Defense System in LINUX

Offensive malware usage and defense

Offensive malware usage and defense

Table of Contents...organizational defense-in-depth strategy by isolating malware, ransomware and other threats where they can’t harm corporate network or user devices. It transparently

Table of Contents...organizational defense-in-depth strategy by isolating malware, ransomware and other threats where they can’t harm corporate network or user devices. It transparently

Defense in Depth is Dead, Long Live Depth in Defense · Defense in Depth is Dead, Long Live Depth in Defense. VP, Strategy. Tenable Network Security. @maldermania. #RSAC Eliminate

Defense in Depth is Dead, Long Live Depth in Defense · Defense in Depth is Dead, Long Live Depth in Defense. VP, Strategy. Tenable Network Security. @maldermania. #RSAC Eliminate

Firewall - Network Defense in Depth Firewalls

Firewall - Network Defense in Depth Firewalls

Mobile Malware Evolution, Detection and Defense - UBC Blogs

Mobile Malware Evolution, Detection and Defense - UBC Blogs

Bio g defense in depth presentation

Bio g defense in depth presentation

Lastline: Next Generation Malware Detection and Defense

Lastline: Next Generation Malware Detection and Defense

Controlling Modern Malware - Palo Alto Networks · Controlling Modern Malware Introducing WildFire: the Next-Generation of Malware Defense ... send them to WildFire for analysis.

Controlling Modern Malware - Palo Alto Networks · Controlling Modern Malware Introducing WildFire: the Next-Generation of Malware Defense ... send them to WildFire for analysis.

Ransomware: Defense in Depth with VMware

Ransomware: Defense in Depth with VMware

Next Generation Advanced Malware Detection and Defense

Next Generation Advanced Malware Detection and Defense