Panda Security2008
-
Upload
tswong -
Category
Technology
-
view
26 -
download
1
description
Transcript of Panda Security2008
1
Panda Security
Building a safer digital world
Name: TS Wong
Position: Country Manager
Date: October 2007
Agenda
– Who is Panda Security?– Our Customers– Malware Landscape– Commercial Comparisons– Why Panda Security?– Innovations*
• Collective Intelligence• TruPrevent (HIPS)• NanoScan
– Gartner 2007– Case Studies: PDRM– Case Studies: Syabas
– Our Solutions• MalwareRadar• TrustLayer Mail• Security Appliances
– GateDefender Performa
– GateDefender Integra
• PandaSecurity for Mobile Operators
• PandaSecurity for Enterprise• PandaSecurity for Internet
Transactions
2
3
Who is Panda Security?Protection Technology Leader. 4th antivirus vendor worldwide.
Who we are
• Founded in 1990
• Leading European company in security, and the fourth worldwide company in the sector [Gartner]
• Solid financial situation with the participation of important private equity firms:
– 55% growth in 2004– Offices in more than 50 countries– Product available in 23 languages
• Investing in R&D more than 25% of the annual revenue
• Leader in protection technologies against unknown threats [Gartner]
Who we are
• Presence in 54 countries with 1,500 people
• 2.5 Million customers worldwide• 140,000 corporate costumers
Busiest Antivirus Vendor
6
► Introduction of products• TruPrevent (HIPS)• GateDefender Performa• GateDefender Integra• Desktop for Linux• MalwareRadar• NanoScan• TrustLayer• PreScan
1990STARTED BILBOA SPAIN
2008LEADERSHIP IN MALWARE PROTECTION TECHNOLOGY
2004GATE DEFENDER & WEBADMIN
2005TRUPREVENT
2006WORLD NO. 4 INTEGRA
2007NanoScanMalwareRadarTrustLayerMegaDetection<rebranding>
► Protection technologies incorporated into our products includes:• Integrated Spyware• Rootkit Detection• Centralized Quarantine• SDK• IIS Integration for Updates
► PandaLabs 2007• DDoS of samples• Revamped• Automated by 100s of
server• MegaDetection!
7
Our CustomersProviding protection to government agencies and corporations.
Some of our customers
• Government• PDRM• Mindef• Jabatan Pertanian• SIRIM• Lembaga Kemajuan Pertanian Muda • LKIM• MTIB• JAKIM• Malaysia Tourism Promotion Board• SUK Negeri Sembilan• SUK Selangor• Tekun• NISER• JHEOA• Kastam• KKLW• MPSJ• JAIWP• PTGWP• Suruhanjaya Perkhidmatan Pelajaran• JASA• JPA
• Corporate• EuroMobil
• Touch N’ Go
• Alam Flora
• MPH
• MUI Group
• Prostaco Group
• Classita
• Privasia
• OSIM
• Elken
• NasionCom
• Sin Chew Jit Poh
• Syabas
• Hyundai
• Ingress
• NAZA
• Metro Parking
• Genting
• ISS Consulting
• Banking• Bank Pembangunan & Infrastruktur
• EXIM Bank
8
Some of our customers
• Penang (northern region)• Malayawata• Classita• IQ Group• Brusia Engineering• Boon Siew• The City Bayview Hotel• CMT• Advanced Ceramics Technology• UltraSonic• MADA• Kulim Hi-Tech Park• NAZA• Toyo Memory• Chemical Industries• Rubberex
• Healthcare• Hospital Besar Melaka• Hospital Pantai Mutiara• Queen Elizabeth Hospital
• Education• Universiti Perguruan Sultan Idris• Universiti Putra Malaysia• INSTUN• TARC• Terengganu Advanced Technical
Institute• Institut Teknologi Tinggi Kulim• Politeknik Ipoh• KISMEC• GMI• Akademi Sains Malaysia
9
10
Some of our customers
11
Commercial ComparisonsFrequencies, consistencies and qualities.
Oct 2005 – PC World
• Only one able to eliminate 100% running processes of spyware.
• Better than specific anti-spyware solutions such as – McAfee AntiSpyware 2006
– Trend Micro Anti-Spyware 3.0
• Panda Platinum Internet Security eliminated 100% of BHOs (browser helper objects) and unwanted toolbars, components frequently used to hijack browsers.
12
May 2006 – PC World
• Of the Internet Security suites analyzed, Panda detected the most unknown viruses and completed the full scan of the computer the fastest.
13
USA - May 2006
Heuristic detection 91% 74% 65% 41%
Detection of malware within file archives 100% 96% 78% 87%
Detection of malware embedded in Microsoft Office OLE objects
100% 100% 86% 90%
Scan speed (minutes) 6.65 10.47 17.34 13.31
* Comparative review published in PC World USA May 2006 with 2006 versions of security suites. This slide will be updated with the 2007 versions, as soon as an updated comparative review is published.
7.
May 2007 – PC Magazine
14
Panda Anti-Rootkit REVIEW DATE: 04.20.07
Panda Anti-Rootkit digs deeper than any other anti-rootkit tool I've seen, telling you exactly what it found. For safety it won't delete files digitally signed by Microsoft—smart! And it wiped out every one of my test rootkits.
Detects rootkit activity in file system, Registry, processes, drivers, and Alternate Data Streams. Offers very detailed reports. Eliminates known and unknown rootkits.
Basic results list is cramped in a non-resizable window.
GCN Lab Review - 2007
15
Panda Internet Security 2008
Vicious panda: The Panda software viciously tracks down viruses and cookies.
Functionality: A+ Ease of use: A Speed: A- Value: B+
Pros: Gives users a lot of info, deletes anything remotely suspicious. Cons: Does a few things without asking.
When Panda software wanted to submit a beta of its 2008 antivirus software, we were a little skeptical; we put betas through the same rigorous testing as released software. But Panda representatives insisted. Panda Internet Security 2008 more than lived up to our expectations.
Installing the software was simple and easy, taking 4 minutes, 52 seconds, plus a reboot. It was the only program to find all 10 of the cookies we put on the test system, and it did it before it was even installed. During the install process, the program runs an anti-spyware scan. During this scan, it found all 10 cookies and automatically deleted them. The bad part about this was that seven of the cookies were not malicious, and we were given no choice as to their fate. The software just killed them without prompting and then finished the install.
Once installed, the Panda software was no less vicious in tracking down and eliminating all the viruses we had put on the system, in addition to others we tried to implant through various means. One nice feature is that the software constantly scans all active connections into or out of a system for anything suspicious. One screen shows you each and every port that is open on a system, what programs are using them and where the programs are located. This makes it impossible for any program that tries to get to the outside world to do so without detection. A separate screen monitors wireless access to a system, so you are protected from that angle, too.
About GCN Government Computer News is the leading publication in the $90 billion government technology market. The magazine, published 34 times per year,
serves more than 100,000 readers in federal government, state, county and municipal governments in the U.S. Now
in its 24th year of publication, Government Computer News is well respected for its insightful coverage of
breaking news and in-depth analysis of how technology is changing and challenging the public sector. Founded in 1982, it is published by PostNewsweek Tech Media, a
division of the Washington Post Company.
16
Malware LandscapeOutbreak in almost every organization.
Malware 2.0
• Targeted Attacks– Many variants– Distribute few copies
• Quality Control– Submit to online scanning– Customized tools
• Rootkits – Low level entry point– Growing momentum
• Runtime Packers– Changes executable to
different form but does exactly the same thing.
• Botnets– Cyber criminals– Remote control via
IRC/HTTP/P2P
• Stage Infection Vectors– Two-staged attackes– Exploits– Downloaders
• Exponential increase to DDoS against AV Labs
17
Statistics
• DDoS against AV vendor– Malware identified in 2006 > all
identified since 1990
– Neither we at PandaLabs nor anyone can cope
• August 2007: we are adding > 4,000 detections per day
18
Nu
mb
er
of
sam
ple
sA
vera
ge
da
ily d
ete
ctio
n a
dd
ed
B
y P
an
da
La
bs
Antivirus Vendor Not Ready
• Situation changed, problems changed, customers need to change.
19Source: Gartner, Market Trends: Security Markets,Worldwide, 2005-2010
Summary
• Odds stacked against AV vendors and users.
• AV vendors must provide a definitive solution.
20
Background
• All vendors has only a subset of each other.
• Viruses increases faster than signature.
• Law of nature for reactive solution.
21
Vendor A:Signature
New Viruses or Unknown
Vendor B:Signature
orKnown Viruses
22
Why Panda Security?Unified Technologies delivers Unified Protection.
Unified Technologies
• One developer for all technologies layer• Protection Technologies• Kernel • Transport• Malware Labs
23
Unified Malware Protection
• We cover all types of malware• Known + Unknown Threats Protection• Any type of malware:
• Virus• Spyware• Adware• Phishing• ActiveX• Javascript• Applet• Zero Day Threats
24
NewSecuritySolutions
Proactive Technologies
25
PandaLabs
• Collective Intelligence– Automated analysis of samples
– Automated development of signature
– To consistently deliver fast response time
• Critical Success Factors– Good heuristics
– Proactive detections to collect suspicious samples.
26
27
Collective IntelligenceRevamping and Automating PandaLabs
Objective of Collective Intelligence
• Confront the “Malware 2.0” problem• Detect 10 times more with 10 times less effort• Maximize detection capacity• Minimize costs (CPU/RAM resource and bandwidth)• Focus on convenience and universality of solution.
28
Definition
• What is the Collective Intelligence?– Threat management system “from the cloud”.
– Based on the aggregated knowledge of the community.
– Based on process automation and on the correlation of information, at our infrastructure.
29
30
<Program ID:XXXXX Status:unknown. Behavioral traces:log1,…
Date/time of appearance: HHMMDDMMYY …
<Program ID:XXXXX Status:unknown. Behavioral traces: log2,… Date/time of appearance: HHMMDDMMYY
…
<Program ID:XXXXX Status:Malware W32/XY. Behavioral traces:log1,…
Date/time of appearance: HHMMDDMMYY …
<Program ID:XXXXX
Status:Malware W32/XY. Behavioral traces:log2,… Date/time of appearance:
HHMMDDMMYY …
• Intelligence in the cloud• Global visibility• Continuous correlation
• Automatic classification• Malware, Goodware• Transparent to the user
How do we do it?
Collection• Process signatures• Inbound filters• Prioritization• Unique samples• No. of times seen• Receipt
Processing• Identifiers with multi-
scanner• Check for goodware• Decompression• Emulation• Heuristic• Sandboxing• Behavioral analysis
Classification• By genetic family• By analysis of
similarity• By neural networks• By positive
identification• By negative
identification• Manual analysis
Remedy• Immediate response • Exclusions• 'Express‘ sigs • Automatic
generation of the sig file
• Generation of the sig file (PandaLabs)
31
Panda TruPreventHost-based Intrusion Prevention System
Architecture
32
DETECTION OF MALWARE USING BEHAVIORAL ANALYSIS
Scanning and disinfection of malware detected
Detection of network viruses and attacks
DETECTION OF MALICIOUS NETWORK PACKETS
PROTECTION AGAINST BUFFER OVERFLOWS
DEFINITION OF SECURITY POLICIES
SOFTWARE UPGRADES
SIGNATURE AND PATTERN UPDATESASSOCIATED SERVICES
TECHNOLOGIES
Event correlation
Behavioral analysis of processes
Deep packet inspection
What is TruPrevent
• TruPrevent technologies automatically detect and block unknown threats, zero-day attackes and intrusions.
• Key objectives:– Without user intervention
– Avoid propogation of new threats via network
– Most advanced HIPS:• Deep packet inspection firewall
• Behavorial Analysis
• Genetic Heuristic Analysis
• User Application Rules
• OS Kernel Rules
33
Rules for Rules for OS KernelOS Kernel
Rules forRules forUsers and Users and
ApplicationsApplications
BehavioralBehavioralAnalysisAnalysis
Genetic Heuristic Genetic Heuristic ScanScan
Malware Malware IdentifiersIdentifiers
Advanced Advanced FirewallFirewall
IntrusionIntrusionPreventionPrevention
NetworkSecureNetworkSecure
34
• The same engine and identifier for different types of malware
– Viruses, worms, Trojans, spyware, adware, hacking tools, etc.
• Decompresses most packers.• Emulation of code for detecting polymorphic viruses.• Detection of rootkits v1.0 (v1.1 low-level HDD access).• SmartClean for restoring the system to the status it
had before infection (hosts, registry, modules loaded, …).
Malware signature engineMalware signature engine
Panda Technologies
35
• Bidirectional firewall.• TDI filter: controls which applications
have access (Internet Explorer, IM, P2P, …).
• NDIS filter: controls ports and addresses.
• Secure restart of the PC.• Centralized management of desktop
firewalls
Distributed firewallDistributed firewall
Panda Technologies
36
• Computer “health” management.
• Detects security products and the update
status.
• Auto-checks– Authorizes or denies communication depending on the
status of the workstation
• Endpoint Security Enforcement Protocol – Control over PC access based on security policies.
• Integrates with Network Access Control (NAC).
NetworkSecureNetworkSecure
Panda Technologies
37
Intrusion preventionIntrusion prevention• Identifiers of network attacks.
• Scans the content and behavior of
TCP/IP packets (buffer overflows).
• Detects Syn Flood, port scanning,
spoofing, denial of services (DoS).
• Active response (blocks attacking IP).
Panda Technologies
38
• Correlation of genetic similarity without false positives to determine "malware family” :
– Location– Format– Form– Properties– Content– etc.
• “The Magic”: calculates, correlates and diagnosis.
• GHE available for file systems, http, smtp, httpmail, pop3, nntp, mapi and IM
Genetic Heuristic Engine:Genetic Heuristic Engine:
Panda Technologies
39
• Security policies for systems (OS policies).• Outsourced security managed by Panda:
– Rules for rapid patching of vulnerabilities– Preventive rules for malware detection– Rules for blocking suspicious OS actions– Specific rules for servers (databases, web, file
servers)
• Can be activated and applied to different users.
OS kernel rulesOS kernel rules
Panda Technologies
40
Rules for users and applicationsRules for users and applications• Security policies for users and applications.• Controlled by the system administrator:
– Control over access to files– Control over access to user accounts– Control over access to the Registry– Control over access to COM components– Control over access to services– Control over network access
• System rules• Rules for applications• IDS rules
Panda Technologies
41
Buffer Overflow ProtectionBuffer Overflow Protection• Monitors execution of processes and guarding
data areas at all times.
• Capable of generating a signature identifier and send to network virus detection level to block subsequent attacks at firewall level.
Panda Technologies
42
• We classify a process on the basis of all its interactions with the user and the system over time, and not simply looking at the file
– Form, format, content, location, etc. of the file.– Changes and system behavior– Modules and resources loaded– Ports accessed
• More than 5 million sensors distributed around the globe.
• High level of detectionHigh level of detection• Low false positive ratioLow false positive ratio• Transparent to the userTransparent to the user
Behavioral analysisBehavioral analysis
Panda Technologies
Screenshots
43
Sample Rules
• Rule 1001: This rule prevents loading and viewing, by Internet Explorer and the Explorer.exe file, of the Browser Helper Object (BHO) associated with spyware and which are normally used once installed.
• Rule 1002: In order to protect against certain malware, command interpreters and user applications that require user intervention cannot be executed by specific programs: mail clients, instant messengers, Office programs, text editors, multimedia applications, system applications, etc.
• Rule 1003: This rule prevents the installation, by any application, of the Browser Helper Object (BHO) associated with spyware and which are normally used once installed.
• Rule 1004: If the file C:\explorer.exe exists, it is run instead of the file of the same name stored in the Windows directory. To prevent malware from modifying it, this rule blocks any attempt to create, modify or run a file called explorer.exe stored in C:\.
44
45
Gartner 2007Host-Based Intrusion Prevention Systems (HIPS) Update: Why Antivirus and Personal Firewall Technologies Aren't Enough
46
47
TruPrevent
48
“The best example of a vendor that has taken the visionary step of delivering a single client with a full complement of host-based intrusion prevention technologies is Panda Software, with its ClientShield product, which is priced as a single solution and provides protection across eight of the nine protection styles outlined in our HIPS research”
http://www.gartner.com/teleconferences/attributes/attr_165281_115.pdf
KRE KREBehavioral
analysis
NetworkSecure
Panda AV GHE
Distributed firewall IDS/IPS
IPS
49
49
50
Panda Security SolutionsOur solution suite to provide protection for every organizations
Panda’s Solutions
52
Malware Radar
It is an automated audit service of the whole network– Specialized in detecting and disinfecting malware and
other security problems not detected by resident security systems
- Complements and reinforces traditional protection systems that are insufficient to combat the new malware dynamic
Key features- On-demand- It can be run locally or remotely- It does not require local installation or uninstallation of
current security software
53
TrustLayer Mail is a managed security service designed to guarantee email security providing 100% virus-free mail backed by a service level agreement. Helps organizations optimize investment in network infrastructure.
TrustLayer Mail
GNOC
VPN secure communication
Monitoring tools: status, warnings, alarm, load
Remote HW management
Daily and ad-hoc update of filtering rules
Protection against attacks (DoS...)
GNOC
VPN secure communication
Monitoring tools: status, warnings, alarm, load
Remote HW management
Daily and ad-hoc update of filtering rules
Protection against attacks (DoS...)
PandaLabs
Automatic sending and encryption of files detected as suspicious
Analysis and action on quarantined messages
Commitment to resolve the situation in under 24 hours
Average resolution time of four hours
PandaLabs
Automatic sending and encryption of files detected as suspicious
Analysis and action on quarantined messages
Commitment to resolve the situation in under 24 hours
Average resolution time of four hours
TrustLayer Mail – Key Features
54
Security appliances - Performa
GateDefender: Protecting the perimeter
55
• Anti-malware• Anti-spam• Content Filter• Web Filter• Blocking of P2P and IM
Security appliances - Integra
GateDefender: Protecting the perimeter
• Anti-malware• Anti-spam• Content Filter• Web Filter• Firewall• VPN• IPS
PandaSecurity for Mobile Operators
57
Unified protection for all:
Devices: Symbian, Windows Mobile, J2ME…
Services: Multimedia messaging, Wap browsing, Mobile E-mail, HTTP Push…
Protocols: MM1-MM7, WAP, I-Mode, HTTP, SMTP,
Protection against any kind of threats:
Mobile malware: Disco.mid, RedBrowser, RomRide
Threats for PCs with GPRS and UMTS cards, ….
Virus (polimórphic, etc.), phishing, trojans, hacking-tools...
• Anti-malware• Anti-spam• Content Filtering• Web Filtering
58
Centralized management solution for corporate environments. Maximum protection against malware with the highest simplicity
Corporate Solutions
Advanced protection• Layered security• Integration of advanced anti-malware technologies
Easy management• The centralized management console AdminSecure allows you to:
- install, uninstall and update all protections - control the protections activity - monitor the risks and act in real time
Solutions for financial market
Solutions for the financial market
– Giving financial organizations the guarantee that their users will be making online transactions free from malware
– The client organization will have a control panel that lets them decide what action to take in each case
• Targeted Attacks Alert Service– A service provided by PandaLabs to monitor and alert of
any new malware affecting a specific financial entity
59
60
Case StudiesOur solution suite to provide protection for every organizations
Polis Diraja Malaysia
• > 10,000 PCs• Challenges
– Replaced Trend Micro.
– No anti-spyware module.
– High outbreak and infection incidents
• Details– Completed installation in Bukit Aman.
– No outbreak incidents.
– Next deployment Sabah/Sarawak, etc.
• Problems– Some PCs with resource issues.
61
Syabas
• > 1,500 PCs• Challenges
– Multiple AV
– Mutliple locations
– Frequent outbreak
– Network congestion due to network viruses
• Details– 15 locations throughout Selangor.
• Problems– Virus (Brontok and Korgo) infected a few PCs without
TruPrevent.
62
Sin Chew Jit Poh
• 1,000 PCs• Previous antivirus: Symantec• Challenges:
– Outbreak of network viruses
• Details– Purchased Nov 2005 bef expiry of existing AV
– 1,000 licenses of EnterpriSecure
– 2 x units of GateDefender• Network Antivirus
• Anti-Spam
• Web Filtering
63
64
Panda Security SolutionsOur solution suite to provide protection for every organizations
Summary
• Fourth worldwide company in the sector
• Leaders on protection and technology
• First in Services from the Cloud and Collective Intelligence
• Our solutions cover all layers– From the endpoint– To the cloud
• Certifications and Recognitions from the industry
thank you!