Proteção de Terminais. Bruno Zani Senior Systems Engineer

Transcrição

1 Proteção de Terminais Bruno Zani Senior Systems Engineer

2 Ameaças são criadas a cada dia

3 Em números alarmantes 14,000,000 12,000,000 Novos Exemplos de Malware Crescimento de 22% do último trimestre de 2012 para o primeiro de ,000,000 8,000,000 6,000,000 50% mais malwares descobertos em 2012 do que em ,000,000 2,000,000 0 Q Q Q Q Q Q Q Q Q Q Q Q Q Fonte: McAfee Labs Q Threat Report

4 E em novos vetores 40,000 Detecção em dispositivos móveis 35,000 30,000 25,000 20,000 Novos malwares para dispositivos móveis cresceram 44X em ,000 10,000 5, Mas em qual plataforma? 4

5 Android Malware

6 E em novos vetores (de novo) Novos Exemplos de Malware para Mac Q Q Q Q Q Q Q Q Q Q Q Q Q

7 Malwares Invisíveis?! Rootkit Family Binaries % %rootkit% 2,119, % Koutodoor 452, % TDSS 389, % Farfli 167, % *MBR* 162, % Caxnet 106, % Prosti 80, % DNS Changer 74, % Cutwail 32, % LDPinch 18, % 7 October 1, 2013

8 Proteção de terminais

9 The Evolving Endpoint Desktop Servers (Physical and Virtual) Tablets Smartphones Laptop Databases ATM s Removable Media Storage Storage Medical Devices WORKSPACE DATACENTER MOBILE AND FIXED FUNCTION

10 Arquitetura Tradicional de Segurança de Terminais Antimalware Agent Mobile Devices HIPS Agent DLP Agent Encryption White- Listing Systems Management Agent Toda Solução tem uma Console Toda Console tem um servidor Todo Servidor precisa de SO e BD Todo OS e BD precisa de manutenção Quando isso acaba?

11 McAfee MOVE McAfee Management for Optimized Virtual Environments (MOVE) AntiVirus for virtual desktops and servers is uniquely designed to relieve the overhead of traditional endpoint security, yet provide the protection and performance essential for success. MOVE offers 3 flavors: Complete Endpoint Security/Server Protection VMWare ESX, Citrix Xen, Microsoft Hyper-V On-Demand Scan Offload No AV Scanning VMs while they are turned off Support for Windows Vista (32/64), Windows XP SP3 (32), Windows 7(32/64), Windows 2003 R2 SP2 (32), Windows 2008 SP2 (32/64), Windows 2008 R2 SP1, Windows 8. MOVE Scheduler MOVE AV Multi-Platform MOVE AV Agent-Less Features: Offload malware scanning Prevent antivirus storms Multi-vendor or agentless deployment options Minimize setup and updates Block zero-day, unknown threats Add intrusion and web protection 11

12 McAfee Application Control for Desktop McAfee Application Control software provides complete protection from unwanted applications and code blocking threats without requiring signature updates. Complete Endpoint Security Block known and unknown threats Use whitelisting to only allow approved applications to run Integrates with McAfee epo console for centralized IT management Easily protect unsupported legacy systems, such as Microsoft Windows NT and 2000 Protect against zero-day and APTs without signature updates Strengthen security and lower ownership costs with dynamic whitelisting Automatically accept new software added through your authorized processes Provide flexibility to desktop users by optionally allowing them to approve new applications 12

13 McAfee Enterprise Mobility Management McAfee Enterprise Mobility Management enables security and management for mobile devices, data, and applications Complete Endpoint Security Supported Device Platforms: Apple ios 4.3, 5.0, 6 Windows Phone 7.x Android 2.2 and higher 13 Support for company- and employee-owned devices MDM (Mobile Device Management) manage policy, provisioning, and security OTA (over-the-air) Security restrict access, features, functionality, risky devices, , contacts, calendar, and more epo Security Management use epo to track and manage the device lifecycle with streamlined processes, automation, dashboards, and granular policy options Mobile monitoring, alerting, analytics, and reporting Full and select remote data wipe; remote lock Secure container and anti-malware for Android Enterprise class scalability of over 25k devices per server or over 100k with load balancing Simplify using epo for mobile and traditional endpoint security management EMM suite includes McAfee EMM, McAfee Secure Container for Android, McAfee VirusScan Mobile for Android, and McAfee epo

14 McAfee Endpoint Protection for Mac McAfee Endpoint Protection for Mac secures Apple endpoints with complete, advanced protection, including anti-virus, anti-spyware, firewall, and application protection. Complete Endpoint Security Adaptive Mode Helps to learn network traffic and fine tuning the existing firewall policies Regular mode Ensures your firewall policies are enforced strictly DNS Blocking Blocks access to unwanted sites Location awareness Ensures correct policies are enforced based on the location from where you are connecting to the network. On-access scanning - always-on protection to stop threats before they execute Scan archives & compressed files, Apple Mail messages & network volumes System firewall stops network-based attacks from infecting the Mac Application protection provides the ability to deny applications that are not approved to run Managed by epo

15 Risk Advisor Complete Management McAfee Risk Advisor product enables organizations to gain relevant and actionable data when needing to correlate new emerging threats Reduces patching frequency Takes the guesswork out of where to focus security efforts Proactively correlates threat, vulnerability and countermeasure information to illuminate exact assets are at risk and require immediate attention Prioritizes security remediation Powered by McAfee Labs Delivers a countermeasure adjusted risk scores Supports existing McAfee product portfolio Alleviates patch panic by focusing on systems truly at risk 15

16 RECOMENDAÇÃO DE CONTRA-MEDIDAS MCAFEE McAfee Risk Advisor Stuxnet GTI Feed de ameaças Aurora AV HIPS IPS BAIXO Recomendação de contramedidas HIGH Risco dos sistemas Vulnerabilidades Configuração Nível de patch Aplicações PATCHES Classificação de risco dos ativos

17 Esse é o futuro para correlação de ameaças MINUTOS HORAS DIAS SEMANAS

18 Respondendo a pergunta Eu estou em Risco? A tabela abaixo mostra a efetividade de integração de ferramentas como Vulnerability Manager, HIPS e IPS de rede, bem como dados de vulnerabilidades vindos também do Policy Auditor Sem integração com aplicações de defesa Com integração habilitada Precisão e Eficiência Precisão: Baseado no número de ativos que possuem uma ferramenta de defesa para serem tratados como Not Vulnerable Eficiência de proteção: Crescimento de 35% no nível de máquinas Not Vulnerable

19 Caso de uso 1: Resumo do Patch Tuesday MS

20 Perguntas?!