Cloud security adoption sophos
•Descargar como PPTX, PDF•
0 recomendaciones•404 vistas
Leonardo Granda presentó sobre la protección de la nube desde la nube, discutiendo la adopción de seguridad en la nube, la innovación y la seguridad como servicio. Abordó los desafíos de seguridad que enfrentan los bancos en América Latina, los beneficios de la nube como ahorro de costos y escalabilidad, y las soluciones de seguridad en la nube de Sophos como Intercept X y la plataforma Sophos Central.
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a Cloud security adoption sophos
Similar a Cloud security adoption sophos (20)
Más de CSA Argentina
Más de CSA Argentina (20)
Último
Último (20)
Cloud security adoption sophos
- 1. Leonardo Granda, CISSP, CCSK Sr Sales Engineer Manager, LATAM Protegiendo tu Nube desde la Nube (Shared Responsibilities for Cloud Computing)
- 2. Agenda 2 •Estado de Seguridad de la Banca en LATAM •Adopción de Seguridad en la Nube •Innovación •Seguridad como Servicio
- 3. Que esta pasando en LATAM 2018? 3 https://www.epicentrochile.com/2018/05/24/alertan-sobre- posible-hackeo-a-nivel-nacional-a-banco-de-chile/ https://regeneracion.mx/hackers-habrian-robado-400-mdp-de- banorte-y-banco-del-bajio/
- 4. Office File Exploits Crypto Currency Mining Remote Access Trojans Los exploits más recientes de documentos de Office no generan advertencias. Bots y sitios web utilizados en operaciones mineras de cripto- monedas. Acceso a cuentas bancarias Que esta pasando 2018?
- 5. 5 Adopción de Seguridad en la Nube 5
- 6. 6
- 7. ¿Por que las empresas consideran la nube? Pasan de gastos de capital a gastos variables Dejan de gastar dinero en el mantenimiento de centros de datos Benéfico para las economías en escala Se deja de adivinar la capacidad Aumento de velocidad y agilidad Puede ser global en minutos
- 8. Seguridad en la Nube: Amanecer de una Nueva Era 8 • Nube: sobrevalorada a corto plazo, subestimada a largo plazo • Cambia todo: modelos de negocio, capital de riesgo, I + D, ... • Conduciendo una nueva realidad macroeconómica.
- 9. 99 Percepción Realidad La Nube tiene que ver con un menor costo total de propiedad (TCO) Los beneficios de la nube son numerosos: innovación, colaboración, creación de servicios, ahorro de costos, etc. Ejecutar aplicaciones de misión crítica en la nube no es seguro Sophos proporciona una forma de trabajar de manera segura en la nube. Pierdes el control de tus datos en la nube. La nube requiere que los consumidores aborden la gestión de contratos de manera diferente, sin embargo, no hay razón para ser dueño de sus datos Nube = Virtualización La Virtualización es un habilitador de la no la nube en sí misma Todo funciona mejor en la nube. Los procesos de negocio son clave para maximizar el beneficio de la nube. Rompiendo Mitos
- 10. Adopción de Seguridad en la Nube– Sophos Vision 10 • Sophos Central (Cloud) brinda protección y administración completamente efectivas contra diferentes tipos de ataques y amenazas sin la necesidad de instalar servidores, bases de datos o conectividad VPN entre todos los puntos. • Protección de la infraestructura en la nube del cliente y su Datacenter en sitio. • La información que se envía a nuestra Nube es solo Telemetría para brindar un mejor servicio. NUNCA subimos información confidencial del cliente. • Comunicación cifrada de extremo a extremo
- 11. 11 • Platforma Unificada • Platforma Robusta • No mantienimiento de HW • Actualizaciones Automaticas • Acceso desde cualquier lado • Backup, Recovery y Proceso de Incidentes • Concentracion de datos para usuarios moviles Resumen
- 12. 12 Innovación 12
- 13. Deep Learning 13 Sophos Sandstorm 10% Increase in malware stopped each week 100,000 New suspicious files submitted each week 99.2% Zero-Day Threat Detection #1 in March 2018 Endpoint Test 41,000 Customers protected 3,700,00 Endpoints protected 3500 New malware and PUA files detected each week Modelo de Deep Learning Actualizado Cada Mes
- 14. Sandstorm Deep Threat Prevention u mejor protección contra las amenazas de día cero. Frequent & Aggressive Run-Time Analysis Sandbox Evasion Techniques, API & File System Behavior Intercept X Exploit Detection & CyrptoGuard IPS detections coming soon Continuously adaptive learning model Deep Memory Analysis Initial & Post Execution Memory Inspection & Analysis Deep Behavioural Analysis Deep Network Analysis Deep Learning Analysis La prevención de Sandstorm va mas alla del endpoint o firewall Full port and protocol analysis Analysis of all dropped executables
- 15. 15
- 16. 16 SOPHOS INTERCEPT X CON EDR: AMENAZAS CONOCIDAS RANSOMWARE EJECUTABLES NO CONOCIDOS EXPLOITS & FILE-LESS FOUNDATION CRYPTOGUARD MACHINE LEARNING ANTI- EXPLOITTECHNIQUES
- 17. Replicar capacidades asociadas con analistas difíciles de encontrar.
- 18. Entender un ataque con investigaciones guiadas
- 19. Pregunta rápida: ¿Cuál es la siguiente cadena de análisis forense? WANNACRY
- 21. Seguridad como Servicio 21 Cloud Computing Security For Cloud Security From Cloud Security aaS
- 22. Sophos Manage Service Provider 22 Aumentar la Rentabilidad Incrementar Productividad Mejorar la Eficiencia Operativa
- 23. Sophos Manage Service Provider 23 Un Consola de Administración Un Programa Flexible Un Proveedor
- 24. 24 Un Proveedor Endpoint Protection Server Protection Secure Encryption Mobile Protection Secure Wireless Network Secure Email Gateway Phish Threat Endpoint Protection Network Protection Messaging Sophos Central
- 25. Una Consola 25
- 26. Una Consola 26 Licencias en uso Trial en progreso Licencias expiradas Licencias sobre el limite Licencias cerca a expirar
- 27. Un Programa Flexible 27 Elige licenciamiento anual o mensualizado
- 28. Synchronized Security Platform and Strategy Sophos Central Cloud Intelligence Sophos Labs Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions | 24x7x365, multi-continent operation | URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations Endpoint/Next-Gen Endpoint Mobile Server Encryption UTM/Next-Gen Firewall Wireless Email Web In Cloud On Prem 28
- 29. Security Heartbeat™Security Heartbeat™ Servers XG Firewall Sophos Central Security Heartbeat™ enlaza EP con el FW para monitorear su salud y compartir la presencia de amenazas Identificación Instantanea Security Heartbeat instantáneamente comparte telemetría sobre el usuario, sistema y procesos comprometidos Respuesta Automática Automáticamente aísla, o limita el acceso de red a sistemas comprometidos hasta que son totalmente limpiados Internet XG Firewall Endpoints Sophos es el unico proveedor que tiene este tipo de respuesta Security Heartbeat – Respuesta Automatica ante Incidentes Plataforma y Estrategia de Seguridad Sincronizada
- 30. Security Heartbeat™Security Heartbeat™ Servers XG Firewall Sophos Central Security Heartbeat™ enlaza EP con el FW para monitorear su salud y compartir la presencia de amenazas. Protección de Movimiento lateral El FW informa a los demás EP para que ignoren tráfico de un dispositivo comprometido. Respuesta Automática Automáticamente aísla, o limita el acceso de red a sistemas comprometidos hasta que son totalmente limpiados Internet XG Firewall Endpoints Aislamiento Total – Incluso en el mismo segmento de Red Security Heartbeat – Respuesta Automatica ante Incidentes Plataforma y Estrategia de Seguridad Sincronizada
- 31. Reconocimientos Overall Winner Endpoint and Network Security. Highest for product innovation, support, partnership, and managed and cloud service. #1 in Endpoint Protection “Leader” 2018 Endpoint Protection Platform Magic Quadrant Leader in all ten reports since it was first published. One of only 3 leaders “Leader” The Forrester Wave: Endpoint Security Suites Off the charts strategy rating #1 in malware detection
- 32. 32 Gracias!! 32
Notas del editor
- La adopción de nuevas tecnologías, como Internet de las cosas, Big Data e inteligencia cognitiva, y la adopción de servicios administrados en la nube han sido los principales factores que impulsaron el mercado de Infraestructura como servicio (IaaS) en América Latina. Estudios de Forbes y Frost & Sullivan consideran que el sector generó $ 1.8 mil millones en 2017 y se espera que alcance $ 7.4 mil millones para 2022, a una tasa compuesta anual de 31.9%. En 2017, Brasil representó el 50.7% del negocio total, seguido por México con 22.9%, Chile con 7.9% y Colombia con 6.5%. Para aprovechar las oportunidades de crecimiento, los jugadores deben ofrecer servicios en la nube de extremo a extremo e integrar capacidades para apoyar industrias conectadas. El sector financiero invierte más en soluciones tecnológicas. En 2018, el Banco Central Argentino y de Brasil definió la política de ciberseguridad y estableció requisitos para el alquiler de servicios de procesamiento y almacenamiento de datos y la computación en la nube, incluidos los requisitos contractuales mínimos. Con base en esta regulación, los bancos usarán proveedores de nubes públicas a gran escala. Que la banca este empezando lentamente a adoptar la nube es algo muy positivo, es un proceso entero de digitalización. Seguramente previendo que esto conlleve al famoso adaptarse o morir…y en un futuro, hagamos nuestras compras por Amazon y el servicio financiero este embebido como parte de la compra, no será necesariamente un lugar, un edificio o un servicio que tengas que seleccionar por separado como pasa con servicios del estilo de Mercado Pago.
- Now if we look at 2017 to date, we can see it’s a very similar story: 57% again being due to hacking or malware. Now one of our top engineers looked at this data and wondered what percentage of the “hacking or malware” category was attributed to ransomware. Ransomware is a bit of a gray area given that while it encrypts your files, it doesn’t generally exfiltrate them. So is ransomware considered a data breach or not? Well our researcher combed through every single record and found that only 4.5% of that 57% were ransomware attacks. <advance> So by far, the vast majority of data being lost in data-breach events is the result of someone deliberately going in to steal your data from the system.
- Consider some of the recent threat trends… new office file exploits are appearing as an initial infection vector, utilizing macros in Word that now no longer offer any kind of warning to users, making it very difficult to avoid at the user level – even for very savvy aware users. As you’ve probably read about in the media, crypto currency mining has really taken off… mining code is now being embedded into compromised web pages and other malware to utilize a victims CPU cycles… this brings the complaint about my computer running slow to a whole new level. And then we’ve seen a whole new breed of remote access trojens that are being used for stealing data from Outlook and lurking on peoples machines to scrape bank account credentials. Many organizations are not even aware they have these threats.
- Trade capital expense for variable expense Instead of having to invest heavily in data centers and servers before you know how you’re going to use them, you can only pay when you consume computing resources, and only pay for how much you consume. Benefit from massive economies of scale By using cloud computing, you can achieve a lower variable cost than you can get on your own. Because usage from hundreds of thousands of customers are aggregated in the cloud, providers such as Amazon Web Services can achieve higher economies of scale which translates into lower pay as you go prices. Stop guessing capacity Eliminate guessing on your infrastructure capacity needs. When you make a capacity decision prior to deploying an application, you often either end up sitting on expensive idle resources or dealing with limited capacity. With cloud computing, these problems go away. You can access as much or as little as you need, and scale up and down as required with only a few minutes notice. Increase speed and agility In a cloud computing environment, new IT resources are only ever a click away, which means you reduce the time it takes to make those resources available to your developers from weeks to just minutes. This results in a dramatic increase in agility for the organization, since the cost and time it takes to experiment and develop is significantly lower. Stop spending money on running and maintaining data centers Focus on projects that differentiate your business, not the infrastructure. Cloud computing lets you focus on your own customers, rather than on the heavy lifting of racking, stacking and powering servers. Go global in minutes Easily deploy your application in multiple regions around the world with just a few clicks. This means you can provide a lower latency and better experience for your customers simply and at minimal cost.
- La adopción de nuevas tecnologías, como Internet de las cosas, Big Data e inteligencia cognitiva, y la adopción de servicios administrados en la nube han sido los principales factores que impulsaron el mercado de Infraestructura como servicio (IaaS) en América Latina. Estudios de Forbes y Frost & Sullivan consideran que el sector generó $ 1.8 mil millones en 2017 y se espera que alcance $ 7.4 mil millones para 2022, a una tasa compuesta anual de 31.9%. En 2017, Brasil representó el 50.7% del negocio total, seguido por México con 22.9%, Chile con 7.9% y Colombia con 6.5%. Para aprovechar las oportunidades de crecimiento, los jugadores deben ofrecer servicios en la nube de extremo a extremo e integrar capacidades para apoyar industrias conectadas. El sector financiero invierte más en soluciones tecnológicas. En 2018, el Banco Central Argentino y de Brasil definió la política de ciberseguridad y estableció requisitos para el alquiler de servicios de procesamiento y almacenamiento de datos y la computación en la nube, incluidos los requisitos contractuales mínimos. Con base en esta regulación, los bancos usarán proveedores de nubes públicas a gran escala. Que la banca este empezando lentamente a adoptar la nube es algo muy positivo, es un proceso entero de digitalización. Seguramente previendo que esto conlleve al famoso adaptarse o morir…y en un futuro, hagamos nuestras compras por Amazon y el servicio financiero este embebido como parte de la compra, no será necesariamente un lugar, un edificio o un servicio que tengas que seleccionar por separado como pasa con servicios del estilo de Mercado Pago.
- Teniendo en cuenta los puntos anteriorer desde Sophos buscamos ayudar a nuestros clientes en la adopcion del Cloud y proporcionales seguridad en su eleccion por nuestra solucion Cloud Seguridad: Nuestro estándar de seguridad brinda una comunicación cifrada punto a punto. Monitoreo continuo a posibles ataques y amenazas, asegurando no solo activo de la compañía sino que dicho servicio sea seguro por si mismo Disponibilidad: Los soluciones de seguridad pueden dividirse en 2 las que protegen a la Nube y las que protegen el datacenter del Cliente. En ambos casos la perdida de conectividad a Internet solo supone una falta de conectividad a la gestion, mas no afecta la capacidad de protección. Locacion: La información que se almacena en la Nube Privada de Sophos solo es de telemetría. Esta informacion alimenta a sistemas de inteligencia para monitorear la estabilidad en la operatividad de la compañía, no es información core del negocio que pueda directamente exponer la ventaja competitiva, innovaciones o known how de una organización, por lo tanto no toma mayor relevancia donde se aloje la misma, pero al estar hablando de productos de ciberseguridad tenemos la certeza de que Sophos se esfuerza por mantener su disponibilidad, integridad y confidencialidad. ·
- Cómo se comparte la información: HTTPS con certificados fijados Información sobre la plataforma: Nombre de la computadora, nombre de dominio, dirección IP, cuenta de usuario que ha iniciado sesión, etc. E información sobre una amenaza o evento en particular: nombre de la amenaza, URL de amenaza, datos RCA, rutas de archivos, nombres de procesos, etc.
- We’ve integrated deep learning for predictive security into Intercept X, Sophos Sandstorm sandboxing in XG and SophosLabs…
- The latest protection enhancements to XG Firewall come via Sophos Sandstorm which provides our best protection from zero day threats at the gateway by doing very aggressive deep memory analysis, deep behavioural analysis including the detection of sandbox evasion techniques and the best technology from Intercept X for exploit detection and cryptoguard protection. It also does extremely thorough and deep network analysis across all ports and protocols and then performs a deep learning analysis on all the dropped executables, and it never stops adapting and learning. <adv> Sophos Sandstorm is technology no customer can afford to be without… it goes beyond what endpoint and firewall are capable of by being more aggressive and resource intensive than any firewall or endpoint technology can do. It’s finding more unknown threats than any other solution out there and it’s super affordable for even the smallest business.
- The future of endpoint security is here. Let me show it to you. - KNOWN THREATS: We’ve seen a shift in endpoint security from traditional approaches to “next-gen” approaches. Traditional approaches have been very good as stopping known threats using a combination of signatures and heuristics. Unfortunatly, this requires us to know the threat before stopping it. - 400K: These approaches have trouble keeping up with threats. For example SophosLabs analyses over 400K new malware samples every single day - RANSOMWARE: The gap in defenses has allowed new threats to arise, most notably ransomware. Ransomware has become the most popular attack method in 2017, because it’s so easy to monetize. - $2500: The average ransomware victim pays out $2500 per attack (Ponemon). 7% of the time they pay over $10K (Ponemon). This doesn’t even calculate the loss from downtime which can be as much as $100K an hour (Rand). Recently we’ve seen ransomware victim Reckitt Benckiser and Maersk shipping claim losses of $100 million and $300 million from ransomware https://www.tripwire.com/state-of-security/security-data-protection/europol-ransomware-warning/#new_tab - UNKNOWN .EXE: While traditional approaches do well for known attacks, they struggle to detect unknown threats. This includes malware that does not contain a signature – never-seen-before malware. Attackers know this, and are constantly creating new malware variants, including polymorphic malware this is constantly changing, making it harder to detect. - 75%/25%: Of the 400K samples analyzed by SophosLabs, approximately 75% of the samples are unique to that specific organization, meaning they are unknown. This is one of the primary reasons “next-gen” approaches have arisen, because they are built specifically to address this problem - EXPLOITS: Adversaries have other ways of causing damage beyond standard malware. They have mastered the art of developing malware that doesn’t execute (run) at all. Additionally, they have an arsenal of exploits and techniques at their disposal which they can use to either distribute malware, or use to make their attack more successful. This includes lateral movement techniques, tools to remain persistent in the victim’s environment, and methods to exfiltrate the data they have stolen - ¼ weaponized: In fact, 26% (Verizon Data Breach Investigations Report 2017) of malware attacks used Weaponized Office files, where attackers used macros in Office files like Word docs as part of their attack, a methodology that spiked in popularity late in 2016 into 2017. - TRADITIONAL: To stop these threats historically we’ve used a combination of signatures and heuristics. This is what traditional endpoint security is based on. The problem with this approach is that it requires a first victim in order to have the attack move from “unknown” to “known”. Since the threat landscape changes so rapidly there tends to be more “first victims” than is acceptable. This is where Next-Gen techniques come in. - CRYPTOGUARD: Let’s use Ransomware as an example. Our Intercept X product has a feature called CryptoGuard. When we see any malicious encryption happening we stop it in its tracks (CLICK). Then we roll-back any changes made by the ransomware ensuring you have full access to your files. - MACHINE LEARNING: However, there are other types of malware besides ransomware. As we mentioned there is a huge problem stopping not only known, but unknown malware. To do this we employ deep learning, an advanced form of machine learning. Using the industry’s #1 malware detection engine we’re able to detect malware before it ever runs on the endpoint. We can take a file, extract millions of features, run it through our model, and render a decision in less than 20 milliseconds. In this case ransomware (and other malware) would be stopped before it ever executes. - ANTI-EXPLOIT: We also employ anti-exploit technology to frustrate attackers by preventing their favorite tools and techniques. Rather than examining millions of malware samples, we focus on approximately 25 exploits attackers rely on to spread malware, steal credentials, and escape detection. For example in the wannacry and Petya attacks, attackers use exploits like EternalBlue to spread the malware, and DoublePulsar to install the malware. Our anti-exploit technology stopped these techniques, thus stopping the attack before the ransomware was ever an issue. - PLUS: Each of these next-gen techniques are incredibly powerful on its own. However it’s the POWER OF THE PLUS that really sets Sophos apart. Sophos is the MOST COMPRHENSIVE ENDPOINT ROTECITON – thanks to our unique combination of Anti-Ransomware, Machine Learning, and Anti-Exploit techniques – as well as traditional approaches – to stop the widest range of endpoint threats of today….and tomorrow.
- o Investigate: * Search across estate * Determine where else threat lives * Ask how it got there (generate RCA) * See which machines and data were impacted * Instantaneous get threat intelligence driven by machine learning and SophosLabs * Puts into context why it was good/bad
- Recommend that we remove the CGI Sophos from the third picture and just embed the Sophos logo or the text “Sophos HQ, Abingdon, UK” onto the picture.
- Recommend that we remove the CGI Sophos from the third picture and just embed the Sophos logo or the text “Sophos HQ, Abingdon, UK” onto the picture.
- Recommend that we remove the CGI Sophos from the third picture and just embed the Sophos logo or the text “Sophos HQ, Abingdon, UK” onto the picture.
- Sophos Central is a cloud-based centralised management platform. It provides a unified console for managing your Sophos Products using a single interface with an intuitive dashboard. As a cloud-based platform, you get the benefits of being able to manage endpoints that are anywhere, and not having to install and maintain internal infrastructure to manage the security of your estate. The other side of this, is being able to deliver the required connectivity to Sophos where restrictions may limit Internet access. In this course we will be focusing on the Endpoint Protection and Server Protection in Sophos Central.
- Recommend that we remove the CGI Sophos from the third picture and just embed the Sophos logo or the text “Sophos HQ, Abingdon, UK” onto the picture.
- Recommend that we remove the CGI Sophos from the third picture and just embed the Sophos logo or the text “Sophos HQ, Abingdon, UK” onto the picture.
- Recommend that we remove the CGI Sophos from the third picture and just embed the Sophos logo or the text “Sophos HQ, Abingdon, UK” onto the picture.
- Let’s have a look at Security Heartbeat in action to see how XG Firewall contains advanced threats… Security Heartbeat™ links your Endpoints with the firewall to monitor health and immediately share the presence of threats. <adv> 1. When a system becomes compromised, XG Firewall and Sophos Central are immediately notified thanks to Security Heartbeat which is continuously sharing telemetry about the systems health and as we saw earlier can instantly identify the user, systems and process involved when a threat strikes. <adv> 2. XG Firewall is unique in it’s ability to use the health of the system in firewall rules and automatically isolate or limit network access when a compromise is detected. And Synchronized Security can also automatically revoke encryption keys temporarily to prevent threats from opening or changing files on the system until it’s cleaned up. This all happens instantly in the blink of an eye… and automatically. <Adv> 3. Then, just as quickly and easily, cnce everything is cleaned up, health will automatically return to green, connectivity will be restored and encryption keys enabled. XG Firewall is the only firewall that uses system health as a condition in firewall rules.
- And coming later this year, we’ve got enhanced lateral movement protection that will enable the firewall to advise all other endpoints to ignore any traffic coming from the compromised device. <AdV> Effectively isolating it – even on the same LAN segment completely eliminating any chance for lateral movement across the network.
- Sophos is one of only 3 leaders in the 2018 Gartner Magic Quadrant for EPP. We’ve been a leader for 10 years running USA – CRN Tech Innovators Award (We beat out CrowdStrike and Cylance) http://www.crn.com/rankings-and-lists/ti2017.htm Sophos News : https://news.sophos.com/en-us/2017/11/16/intercept-x-is-a-tech-innovator/ UK – Security Computing – Security Excellence Awards (the below reference) When we made the shortlist : https://www.computing.co.uk/ctg/news/2474453/the-computing-security-excellence-awards-shortlist-revealed The Winner Circle (which doesn’t call out Intercept X (at least not here)) - http://events.computing.co.uk/securityexcellence/static/winners-2017