Threat Response – Incident Response
Hans Irlacher Manager Presales Engineering CEMEA
[email protected]
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
1
Proofpoint Portfolio Erkennen
Blockieren
Protection: Proofpoint Protection Server, Best in Class Email Protection Reagieren
TAP: Erkennt zielgerichtete, polymorphe und “Zero-Day” Attacken
Threat Response: Umfassendes Incident Handling und schnelle Reaktion Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
2
Geschäftliche und Rechtliche Konsequenzen
CSO Online, Dec. 15, 2014
InfoSecurity, Jan. 16, 2015
The Cost of Malware Containment, Ponemon Institute, January 2015 Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
3
Die Wichtigkeit einer schnellen Reaktion
46%
70%
Ponemon Institute & Verizon Data Breach Report: http://blog.turner-associates.com/cyber-security-data-breaches-checklist/ Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
4
Das “Neue” Erkennungsproblem Advanced Malware Detection Source
Destination
Severity
192.168.10.13
8.8.8.8
High
SIEM Source
Destination
Type
10.10.10.213
192.168.10.114
Anomaly
IPS Source
Destination
Severity
10.10.10.123
192.168.10.114
High
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
Was jetzt? Security Operations
1. Welcher Alarm ist der wichtigste? 2. Wie erhalte ich mehr Informationen im Kontext? 3. Wie bestätige ich eine Infektion? (ohne “False Positive”) 4. Wie kann ich mich schnell schützen und eingrenzen? 5. Wie kann ich die eigene Effektivität messen? 5
Incident Response Herausforderung Mit nur wenigen Daten sind Alarme nicht zu handhaben
Wer wurde attackiert?
Welche Art von Attacke ist es?
Bedrohung eindämmen & Reimage
Bedrohungs Verifikation Bedrohungs Nachforschung
Daten zusammenfassen
Security Alerts
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
Losses
Security Operations
Woher kommt die Attacke? Time
6
Der “Gewöhnliche” Incident Response Prozess Infizierung
Erkennung
DHCP server
Domain Controller High value targets? AD Server Phonebook/directory High value targets?
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
Behebung
Intelligence/Rep
Meeting Scheduler
Geo IP service High value/severe Whois threats? Virus Total
Forensic collection/ analysis Infection? Confirm
High value/severe threats?
Email console(s) AD console(s)
Quarantine/Contain? FW/Proxy console(s)
Security alert source
Ticketing system
Incident management
Change control
Confirm Infection?
Contain?
7
Incident Response sollte einfach sein High Value Target? Endpoint infiziert?
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
Zentrales Dashboard
Quarantäne & Beheben Informationen Zusammenführen
8
Proofpoint Threat Response Virtual Appliance
Verstehen Automatisiert
Verifizieren Durchgängig
Custom Events und mehr…
Beheben Unmittelbar
und mehr... Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
9
Threat Response Use Case Add:
• • • • •
Username Infection history Group Local information Local IP
• • • • •
Malicious file check IP/Domain Reputation Geo-location CNC server check Incident assignment
• • • • •
Put user in “Penalty box” Update Firewalls/Proxies Quarantine email Create audit trail Manage IP lifecycle
Update Threat Response
Security Alert
IP reputation Geolocation WhoIS Virus Total
AD
IOC Verification
Additional Threat Context User Context
Threat Verified Network connections: Registry Changes: File changes: Mutexes:
Yes Yes Yes Yes
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
Email: AD User: Group: User phone : System IP: Attacker IP: Location:
[email protected] Josephsmith Finance 650-555-1234 56.188.13.218 10.10.10.253 Fargo, ND
Sender IP: Known Malware?: New Domain? Domain Reputation? CNC List? Country?
Known bad actor Trojan.Zbot.X Yes Neutral Y N. Korea
10
Threat Response mit TAP Attachment Defense (AD)
2
Proofpoint TAP
TAP AD
Alert
1
1
2
Nachricht wird dem Nutzer direkt zugestellt. Zeitgleich wird eine Kopie innerhalb der Sandbox analysiert
Threat Response
TAP Alerts werden an PTR gesendet. PTR verbindet sich direkt mit Exchange (O365) und überträgt die Nachricht automatisch in die Quarantäne Exchange/ O365 Quarantine
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
11
SIEM + Threat Response Logs
Alerts
Events
SIEM Threat Response
Security Analysts Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
• Incident Context • Forensic data collection • Infection Verification • Past infection checking • Threat Scoring • Incident/User/IP history • Incident assignment • User Isolation • Network Containment • Email Quarantine 12
Threat Response schließt die Lücke Erkennung
Nachforschung Verifizieren Priorisieren Reagieren
TAP
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
13
Kundenvorteile Threat Response beschleunigt den Prozess:
Verstehen & Priorisierung von Bedrohungen Infizierungen bestätigen (Vergleich forensischer Infos) Reagieren auf Bedrohungen (FW/Proxy/AD Integration) Geschäftliche Vorteile: Senkt die Zeit der Nachforschung um > 50%
Um bis zu 20-fache Beschleunigung der Reaktion Reduziert die Belastung und das Risiko bei zeitgleich weniger Arbeit Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
14
Protection Platform Powered by Big Data EMAIL PROTECTION ADVANCED THREAT PROTECTION/RESPONSE
INFORMATION PROTECTION
PROOFPOINT PLATFORM SOCIAL MEDIA PROTECTION
# BIG DATA ANALYTICS ARCHIVING + COMPLIANCE Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
15
DEMO
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
17
Understand: Who, What, Where What is the Threat
Who is the target
Where is attack coming from
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
18
Target information: • User • Phone • Department • Special groups • Location • … more
Incident history
Drill down available, one click away Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
19
Verify: Confirm Infection via Forensics
Infection confidence
Summary of Forensics found vs. reported
Forensic Matches Forensic Matches Forensic Matches
Past infection check
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
20
Contain: Quarantine and Contain Identities and Hosts
Attacker and CNC data drill down
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
At-a-glance Geo-location
21
Automatic IP Blocking lifecycle
Push-button or automatic protection
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
22
Push-button or automatic quarantine after email is delivered
Contain: Email quarantine automated or manual Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
23
Incidents by Department
Customizable Reports
With Built-in & Custom
Reports and Views
Copyright © 2015 Proofpoint, Inc. All Rights Reserved.
24
