It's Time to Rethink Your Endpoint Strategy
Download as PPTX, PDFâ˘0 likesâ˘797 views
The document discusses the need to rethink traditional endpoint security strategies. It notes that the threat landscape has evolved, with intellectual property and sophisticated attacks becoming bigger risks. Traditional antivirus and threat-centric approaches are no longer sufficient. The document recommends implementing a trust-centric, defense-in-depth strategy with integrated technologies to reduce complexity. It emphasizes taking a holistic people, policy and technology approach to endpoint security.
It's Time to Rethink Your Endpoint Strategy
- 1. RETHINKINGYour Endpoint Security StrategyPaul Henry | Security and Forensics Analyst
- 2. The Threat Landscape has EvolvedâŚ
- 3. Shift in Information that is TargetedMarket for stolen data is saturatedThen - Stolen personally identifiable information sold on the black market for up to $15 per recordNow - Credit card data has dropped to about 20 cents per recordNew, more valuable target is now intellectual property (IP)Revenue-generating informationMuch larger impact and value â organization versus individuals3
- 4. Data Breaches Impact Your Bottom Line4
- 5. No Longer a Microsoft WorldThen-Priority on patching servers and Windows O/S
- 6. Now-PC and 3rd party apps are the biggest source of enterprise risk5
- 7. Continued Increase of Cyber CrimeRise in malicious attacksRoot cause of 31% of the data breaches studied (up from 24% YoY)*Cyber attacks impact business97% of respondents consider cyber attacks as the most severe threat to their ability to carry out their missionsHarder to detect and more difficult to contain and remediateFinancially motivated cyber criminals* Ponemon Institute, Annual Cost of Data Breach 20116
- 8. Rising Cyber Terrorism⌠Impact of WikiLeaks7
- 9. The Reality of Advanced Persistent ThreatsMore Sophisticated Threats Leveraging Multiple Attack VectorsZero-day and third party application vulnerabilities
- 10. Physical access through data ports
- 11. Web-based attacks through the browserThe Rise of APTs⌠Highly targeted, constantly evolving, custom-developed malware
- 12. Sony
- 13. Stuxnet
- 14. RSA8
- 16. Trusted Insiders Open the Door to RiskNegligence remains the most common threat - and an increasingly expensive oneNegligence is root cause of 41% of the data breaches studied â the #1 cause*
- 17. Social media opens the door to even more risk of social engineering
- 18. The applications we use for productivity open networks and information to risk
- 19. Removable devices provide easy access, data mobility and⌠risk if not managed* Ponemon Institute, Annual Cost of Data Breach 201110
- 20. Security Status Quo is No Longer Effective
- 21. The New Endpoint RealitySecurity Best Practices Still Not Universally FollowedPatch and configuration management
- 23. User rights managementIneffectiveness of Anti-VirusIncreasing malware sophistication
- 24. Only19% of new malware is detected on first day
- 25. 50% of IT professionals point to malware as the leading cause of rising endpoint TCO12
- 26. Traditional Endpoint Security StrategyTraditional âThreat Centricâ Endpoint SecurityIs No Longer Relevant âBasic security protection is not good enough.â Rowan Trollope SVPBlacklistingAs The Core Endpoint ProtectionVolume of MalwareâYou canât just rely on antivirus software â and weâre an antivirus company.â George Kurtz Worldwide CTOZero DayMalwareAs a Service3rd Party Application Risk13
- 27. Challenges of Endpoint ManagementIT OperationsIT SecurityLack of integration across technologies is the#1 IT security risk*ChallengesChallengesLack of common management console
- 29. Increasing and costly back-end Integration
- 30. Lack of visibility and collaboration with IT security
- 31. Need for better accuracy
- 32. User access rights (Local Admin)
- 34. Silos and insufficient collaboration between IT and business operations* *Worldwide State of The Endpoint Report 200914
- 35. Whatâs the Impact to Your Business?
- 36. Complex IT Environment is Costly to ManageMultiple Consoles3-6 different consoles on averageAgent BloatIncreasing malware sophisticationLack of Control54% of IT security pros cite managing security complexity as #1 challenge
- 37. Decreasing visibility â disparate data
- 38. Ad-hoc monitoring of security postureIncreasing TCO of Point TechnologiesIntegration and maintenanceLumension Global State of The Worldwide Endpoint 200916
- 39. Lack of Enterprise-Wide VisibilityManagement and visibility in silos hurts effectiveness and efficiencyWhat endpoints are online/offline?
- 40. What apps are being used?
- 41. What devices are being used?
- 42. What user actions are concerning?
- 43. How is data being used?17
- 44. Increased Complexity & Risk. Increasing CostMalware SignaturesIncreasing MalwareFractured VisibilityComplex TechnologyEndpoint TCOCurrent Endpoint Security Effectiveness2007: 250K MonthlyMalware Signatures Identified2011: 2M Monthly Malware Signatures Identified18
- 46. Shift to a New Endpoint Security Approach
- 47. Key StrategiesâŚto improve endpoint security and reduce complexityRethink Endpoint Security from the Outside InShift from âThreat-Centricâ to âTrust-Centricâ ApproachImplement Defense-in-Depth StrategyReduce Complexity through Integration and StandardizationPeople, Policy and Technology Must All Play a Role in Your Strategy21
- 48. Strategy 1: Rethink Endpoint SecurityData has effectively moved away from the data- center to a borderless endpoint Cloud-based ComputingRemote Offices & SubsidiariesMobile EndpointsWANInternetStart to view your IT security requirements from the outside-in and not the inside-outCorporate HQData Center22
- 49. Strategy 2: Shift to Trust-Centric SecurityTHREATCENTRICTRUSTCENTRIC
- 50. Strategy 3: Implement Defense-in-Depth24Traditional Endpoint SecurityDefense-in-DepthAntiVirusDevice ControlDevice ControlApplication ControlApplication ControlBlacklistingAs The CorePatch & ConfigurationMgmt.Volume of MalwareZero Day3rd Party Application RiskMalwareAs a Service
- 51. Strategy 4: Reduce Endpoint ComplexityEffective but not EfficientEffective AND EfficientMany ConsolesIT ControlMade SimpleAgile platform architecture
- 52. Reduced integration and maintenance costs
- 54. Holistic endpoint visibilitySingleConsole Agile architectureDisparate ArchitectureSingle Promotable AgentManyAgents25
- 55. All three are dependent on each other for effective and operational endpoint security.Strategy 5: People, Policy and Technology26policytechnologypeople
- 56. Summary
- 57. Shift to New Endpoint Management Approach28Threat centric Point products Multiple consolesMultiple agentsAd hoc processesReactive signaturesAd hoc auditingComplianceTrust centric
- 59. Single console
- 60. Single agent
- 64. IT Risk managementLumension: Leading the IT Security ShiftMarket LeaderAgile Platform ArchitectureBest-of-Breed FunctionalityGlobal FootprintStrong Customer and Partner EcosystemDeloitte 500 & Inc. Magazine 500 Fast Growth Leader29
- 65. Q&AFor more information come visit us at Booth #19 during these show hours:Tuesday, June 2111:45 a.m. â 1:45 p.m.Wednesday, June 22 12:00 p.m. â 1:30 p.m.
- 66. Global Headquarters8660 East Hartford DriveSuite 300Scottsdale, AZ [email protected]
Editor's Notes
- #5: $7.2 million per breach$214 per record
- #6: Vulnerabilities affecting a typical end-user PC from 2007-2009 almost doubled from 220 to 420 and its expected to double again in 2010 (Secunia Half Year Report 2010)A PC with 50 programs installed had 3.5 times more vulnerabilities in the 24 third party programs installed than in the 26 Microsoft programs installed. It is expected that this ratio will increase to 4.4 in 2010. (Secunia Half Year Report 2010)Discover: Gain complete visibility of all IT assets, both managed and unmanaged.Assess: Perform a deep analysis and thorough OS, application and security configuration vulnerability assessments.Prioritize: Focus on your most critical security risks first.Remediate: Automatically deploy patches to an entire network per defined policy to support all OSâs and applications.Report: Provide operational and management reports that consolidate discovery, assessment and remediation information on a single management console.
- #13: Stuxnet changed the risk landscapeMulti vector attack routesPhysical entry via USB port4 zero day vulnerabilities exploitedFrom espionage to sabotage50% of IT professionals cite endpoint complexity as #1 risk factor3-5 Consoles used in the day to day management of IT Operations and Security workflows, and 3-6 agents per endpointMalware has increased by 500% and major AV firms are falling behind on documenting known signatures.11M malware signatures identified monthlyNearly 90% of vulnerabilities could be exploited remotely 2.19 new vulnerabilities are released per day. 3Average cost of a data breach $6.75M. 470% of all serious data incidents sparked by an insider. 5
- #14: Core security defense is still blacklistingPatch is someone elseâs issue (IT ops)
- #15: 49% of endpoint TCO is associated with security and operational management** Complex system managementDecreased endpoint performance and lack of scalability-Agent BloatCostly integration, and maintenance Limited visibility and collaboration
- #19: The First 6 months of 2010 was the most active malware creation in history: Over 10Million samplesMore than 1.5M malware samples are identified each month.57,000 new malware websites are created every weekObfuscationVirus Trojan-USB MediaDedicated WebsiteSemi Legitimate Web PagesTargeted-Intellectual PropertyOn average AV vendors detect less than 19% of malware attacks*
- #22: Key strategies to improve endpoint security and reduce complexity in the new threat environment.1. Rethink Endpoint Security â to address from the outside in as opposed to inside out. What does this mean? Instead of focusing solely on the datacenter, endpoints, mobile devices, third party apps and users have become the vulnerability points to get at sensitive information.2. Shift from threat based approach to one based on trust. Balances the old axiom of more security equals less productivity to âwho do I need to empower and at what level of trust?â3. Depth in defense â no holy grail. No single one technology can address risk.4. Reduce complexity through integration and standardization â thatâs the value of the LEMSS platform.5. People, policy and technology all must play into your security strategy. Policy without technology is useless. People without process is chaos. Technology that doesnât support people is not operational/functional.
- #24: On top of defense-in-depth, time to shift from threat-centric approach to one based on trustâŚ.
- #25: Defense in Depth StrategyAddress the core IT Risk with Patch & Configuration ManagementStop unwanted / untrusted change with Application ControlProtect against insider risk Device ControlDeploy a broad defensive perimeter with AntiVirusReduce endpoint complexity with an Endpoint Management and Security Suite
- #30: I have given you sense of the shifts taking place in the endpoint environmenthow we need to change our approach to endpoint management and security what Lumension vision is and the steps we are already taking