McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)

1. McAfee Active Response Endpoint Detection & Response Iftikhar Ali Iqbal, CISSP, CCSP, CISM https://www.linkedin.com/in/iftikhariqbal/ Valid till Aug 2019

2. 2 AGENDA Target Partners & RTM 1 2 3 Company Overview Portfolio Strategy Endpoint Security Platform 4 McAfee Active Response

3. OVERVIEW Company and Portfolio

4. 4 MCAFEE: OVERVIEW • Founded in 1987 • Headquartered in California, United States • Provides Software and Services • Focus is on Consumer and Enterprise Security • 125,000+ Corporate Customers • 120 Countries • 217+ Innovation Alliance Partners • 800+ Security Patents • On April 4, 2017 – McAfee begun operating as a new standalone company (spun back out of Intel). • Solution Offering: • Cloud Security • Device Security • Network Security • Pervasive Data Protection • Intelligent Security Operations

5. 5 Portfolio Strategy An Integrated And Open Security System Threat Defense Lifecycle Together, Is Far More Powerful Than Sum Of The Parts SECURITY OPERATIONS DEVICE CLOUD MANAGEMENT THREAT INTELLIGENCE ANALYTICS AUTOMATION / ORCHESTRATION INFRASTRUCTURE MCAFEE: STRATEGY

6. 6 SECURITY OPERATIONS DEVICE CLOUD MANAGEMENT THREAT INTELLIGENCE ANALYTICS AUTOMATION / ORCHESTRATION INFRASTRUCTURE • Endpoint Protection • Endpoint Detection and Response • Enforcement Controls • File Integrity Monitoring • Advanced Threat Protection • Encryption • Data Loss Prevention • Cloud Workload Protection • Cloud Access Security Broker • Web Gateway Service • Intrusion Prevention System • Advanced Threat Protection • Server Protection • Advanced Threat Protection • Database Security • Mail Server Security • Storage Security • Secure Web Gateway • Intrusion Prevention System Local Threat Intelligence Global Threat Intelligence Skyhigh Threat Intelligence Security Information and Event Management User and Entity Behavior Analytics Incident Response and Remediation MCAFEE: TACTICAL OVERVIEW

7. ENDPOINT SECURITY PLATFORM Single-IntegratedEndpoint Protection

8. 8 Detecting and preventing advanced threats Adding new defenses in the future increases management problems Preventing deep investigations to aid in recovery Causing manual processes and delaying responses ComplexityAccuracy Visibility Sustainability ENDPOINT SECURITY: CHALLANGES

9. 9 True centralized management Extensible endpoint security framework Actionable threat forensics in understandable language Advanced capabilities like machine learning analysis of sophisticated threats Integrated platform that unites defenses to work together ENDPOINT SECURITY: THE MCAFEE RESOLUTION

10. 10 KNOWN THREATS UNKNOWN THREATS Threat Prevention Firewall Web Control Adaptive Threat Protection Threat Intelligence Exchange Active Response McAfee Endpoint Platform - Anti-malware - Host-based IPS - Exploit Prevention - Host-based Firewall - Web/Browser Control - Machine Learning - Application Containment - Reputation-based - Threat Sharing - EDR Single Agent (McAfee Agent) Single Management (McAfee ePolicy Orchestrator) Deployment Reporting & QueriesPolicy Configurations Dashboards Automated Responses ENDPOINT SECURITY: PLATFORM

11. ACTIVE RESPONSE Endpoint Detection and Response

12. 12 ACTIVE RESPONSE: EDR ‘The EDR market is defined as solutions that record and store endpoint-system-level behaviors and events, such as user, file, process, registry, memory and network events. Multiple detection techniques are then used to continually search the stored data to detect security events that require human intervention to respond rapidly.’ ‘By 2021, endpoint protection platforms (EPPs) will provide automated, orchestrated incident investigation and breach response. Separate, stand-alone endpoint detection and response (EDR) solutions will focus on managed security service provider (MSSP) and large enterprise security operations center (SOC) environments..’ Market Guide for Endpoint Detection and Response Solutions, 9 November 2017, Peter Firstbrook Magic Quadrant for Endpoint Protection Platforms, 24 January 2018, Ian McShane, Avivah Litan, Eric Ouellet, Prateek Bhajanka

13. 13 Immediate Action Automated Responses Continuous Monitoring ACTIVE RESPONSE: OVERIEW

14. 14  Find and visualize data from your endpoints  Search for files, network flows, registry and process mapping  Hunt and kill threats  Hunt for file hashes, endpoints connected to specific IP and kill processes, remove files, etc  Continuously monitor a critical event  Initiate an action before hand for future threats  Leverage Data Exchange Layer (DXL) to communicate with other products  Reduce risk and response time COLLECTORS REACTONS TRIGGERS INTEGRATION ACTIVE RESPONSE: FEATURES

15. 15 ePolicy Orchestrator Data Exchange Layer Advanced Threat Defense (Malware Analysis) McAfee Agent Endpoints Physical Servers Virtual Servers McAfee Agent Threat Intelligence Exchange Active Response Endpoint Security Adaptive Threat Protection Active Response Endpoint Security Adaptive Threat Protection Active Response McAfee Linux OS McAfee Cloud Services ACTIVE RESPONSE: ARCHITECTURE

16. 16 ePolicy Orchestrator McAfee Agent Endpoints Physical Servers Virtual Servers McAfee Agent Threat Intelligence Exchange Active Response Endpoint Security Adaptive Threat Protection Active Response Endpoint Security Adaptive Threat Protection Active Response McAfee Cloud Services ACTIVE RESPONSE: HOW IT WORKS 12 3 4 4 1 McAfee Active Response sends data to the cloud 2 McAfee ePO receives data from the cloud 3 Perform in-depth investigation in McAfee ePO 4 TIE updates the reputation of the threat

17. 17 ACTIVE RESPONSE: LICENSING AND PACKAGING Complete Endpoint Protection (CEB) (CEB) Complete Endpoint Threat Protection Protection (CTP) Endpoint Threat Defense & Response Response (EDR) Endpoint Security Adaptive Threat Protection Device Control Application Control Encryption Threat Intelligence Exchange Active Response ePolicy Orchestrator

18. 18 ACTIVE RESPONSE: SUMMARY A single-pane for investigation, prioritization, genealogy, reputation, historical behavior, and response over potential threats. Workflows Single view to see, investigate, and take action on threats Visibility A view into suspicious behaviors across all Endpoints Investigate Analyze timelines and live searches to find threats Action One click stops threats & updates protection on all Endpoints Simplify View operational status of all Endpoint threat defense services

19. 19 Thank You

McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)

McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente(20)

Similar a McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)

Similar a McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)(20)

Más de Iftikhar Ali Iqbal

Más de Iftikhar Ali Iqbal(14)

Último

Último(20)

McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)