Current Threat Changes

UTM & APT Services

Dimension Visibility

Abadata Computer Corporation

989-883 3411
[email protected]
Changes in Current Threats
Cyber Kill Chain
 Is Your Business A Target?

• Advanced hacking targets business not just Nation States

• Targeted attacks keep hackers under radar
• Bigger personal information depository offer higher ROI
• Indirect targets Personal Devices offer easier breach to
corporate networks
 Is Anti-Virus Really Dead?
Traditional antivirus software is best used to combat opportunistic (untargeted) attacks,
offering effective and efficient protection following the creation of a signature.
Hosts Compromised

Signature
Opportunistic

available
THRESHOLD OF DETECTION
Attacks

Goal for the cyber miscreant

is to maximize slope.

Time
“Advanced”

Signature
Phishing

THRESHOLD OF DETECTION available?

Goal for the cyber miscreant

is to minimize slope.

8/21/2015 6
2014 Retail Hacks

2015 Retail Hacks

 Trends We KNOW!

Attackers more sophisticated Attacks more targeted

Security’s a boardroom
Mobile attacks increase
conversation

Ransomware is hot “You will get breached”

Encryption use grows

Every day is a new Challenge!

117,339 New
Attacks Every Day!

20,000 Original
Virus Signatures
exist in the Wild!
 Can YOU be a HACKER?
www.malc0de.com

Virus .EXE
DOMAIN

Virus
Detection
Can you use this virus?
Can you use this virus?
 0-DAY MALWARE

8/21/2015 13
 Business Example

8/21/2015 14
 Business Example

8/21/2015 15
 Business Example

8/21/2015 16
 Business Example

8/21/2015 17
 What to do?

8/21/2015 18
WatchGuard UTM Services
Advanced Treats Require Defense -in- Depth
Advanced threats, by definition, leverage
multiple vectors of attack.
No single defense will protect you completely
from computer attacks

Firewall
Intrusion Prevention System
The more layers of security you have,
AntiVirus
the higher chance an additional
AntiSpam protection might catch an advanced
Reputation Services threat that other layers might miss.
APT Protection
 UTM / APT Services

Policy-based Management Console

URL Filtering

App Control

Prevention
Prevention

Reputation
AntiSPAM
AntiVirus

Data Loss

Defense
Intrusion

Enabled
Blocker

VPN
APT

WatchGuard XTM Platform

…
WatchGuard Proxy-based Engine
WatchGuard
Industry Standard Platforms
VMware Hyper-V
The Reason to run Web Blocker on YOUR Firewall

Do you like making

your life harder?
Merge all services into ONE Appliance!
Application
Control

URL
Filtering

Anti
SPAM

Gateway
AntiVirus

Intrusion
Prevention
Service

Firewall

Data Loss
Prevention
 WatchGuard Appliances
… with leading performance that meets the needs of businesses of all sizes
Core Business Product Line
WatchGuard Security Solutions combine firewall, VPN, and security services to protect networks from data loss, spam, viruses,
malware, and intrusions. XTM 2520: Large
enterprises and corporate
data centers*
XTM 800 & 1500 Series:
Software Scalability:
Large distributed enterprises
Single version of
WatchGuard Fireware®
Firebox M400 & M500:
OS runs on all solutions, Mid-sized businesses and distributed enterprises
including virtual
Firebox M440:
Multi port option

XTM 5 Series:
Mid-sized businesses and XTMv
distributed enterprises Four virtual software license versions
with full UTM features
Firebox M200 & M300:
Small to Medium business and
distributed enterprises
XTM 2 & 3 Series:
Small offices, branch
offices and wireless hotspots Wireless Access Points
AP100/200 & AP102
Businesses can harness the
Firebox® T10: power of mobile devices
Small office/home office and without putting network
small retail environments Indoor assets at risk. Outdoor
*XTM 2520: World’s fastest, greenest 1 rack unit UTM Firewall
WatchGuard APT Service

Three APT Attributes:

1. Advanced
2. Persistent
3. Targeted
 A-Advanced
P-Persistent
T-Threats
Why use APT Blocker?

Mutated Virus
ORIGINAL VIRUS
(new but the same)
• APT helps protect against 0-Day Malware
• 0-Day Malware does not get stopped by signature based virus software
• New hacking techniques are getting virus past other virus solutions
• Sandboxing can help identify 0-Day Malware
• Patient 0- New unknown viruses will still get through 1 time while file is being scanned
• You Should run Dimension for visibility
• You must run AV to use APT
 APT Blocker Fill the Security Gap!

*Identifies and submits suspicious files to

cloud-based, next-generation, full system
emulation sandbox
*Provides real-time threat visibility; protection
in minutes not hours
*Analyzes comprehensive set of files
(Executables, Office documents, PDFs &
Android APKs)
*Detects Zero Day Malware
*Scalable; inspects millions of objects at any
given time
*Not fooled by evasion
 Network Visibility with Dimension

• Dimension is a Onsite or Hosted logging service

• Dimension requires a virtual network to run VMWare or HyperV
• Provides easy network visibly
• Provides Executive reporting
• Provides Compliance Reporting

8/21/2015 28
Target Black POS Malware Breach

* 40 Million Credit Cards Stolen

* Breached through HVAC Management Computer
* No Network Isolation
* During Black Friday Credit card transitions were stolen in plain text from
point of sales system
* 3ed Party log monitoring company found breach the day before black Friday.
 Traditional Log Servers
Can you find the virus?

8/21/2015 30
 Dimension Executive Dashboard

8/21/2015
31
 Dimension Executive Dashboard

8/21/2015
32
 Dimension Threat Map

8/21/2015 33
 Dimension Firewatch (TREE VIEW)

8/21/2015 34
 Dimension Policy Map

8/21/2015 35
 Dimension Domain User Report

PDF Report

8/21/2015 36
 APT Document Available for Download

8/21/2015 37
 Thank You….
CHANNEL CHIEFS
February 2014
CHANNEL CHIEFS
February 2014
CHANNEL CHIEFS
CHANNEL CHIEFS
February 2014 February 2014
HONORING THE MOST INFLUENTIAL
HONORING THE MOST INFLUENTIAL
CHANNEL CHANNEL EXECUTIVES
EXECUTIVES
HONORING THE MOST INFLUENTIAL
HONORING THE MOST INFLUENTIAL
CHANNEL
CRN Channel EXECUTIVES
CHANNEL
ChiefsChannel
CRN EXECUTIVES
represent the channelrepresent
Chiefs elite, those the channel elite, those
executives who consistently promote and execute best-
in-class executives
channel partner who
programs consistently
elite,that promote and execute best-
CRN Channel Chiefs CRNrepresent
Channel the channel
Chiefs represent thecreate
those andelite,
channel those
accelerate
executives who consistently
executives in-class
revenue.
promote
who andchannel
execute
consistently partner
best-
promote programs
and execute best- that create and
in-class channel partner
in-classprograms that
accelerate
channel create
partner and that create and
revenue.
programs
accelerate revenue. Solution
accelerate Providers
revenue. rely on this
definitive guide to the
Solution Providers
“Who’s relySolution
 Who”
Solution on othis
f Providers Providers
 the  Channel.
rely on this rely on this
definitive guide to the guide
definitive definitive
to the guide to the
“Who’s  Who”
f  o  the  Channel.
“Who’s  Who”
f “Who’s
CRN o Channel
 the Who”
f Channel.
 o  the
Chiefs  Channel.
Advertorial
Highlight  your  company’s  leadership  in  channel  management, e  your  t chnology’s  solution  for  th
marketplace,
o CRN Channel
 and  your  cm pany’s Chiefs
CRN exceptionalChannel Advertorial
 value  to  partners.
Chiefs   
Advertorial
We’ll  takee  care  of  the  h avy  lifting.
Highlight  your  company’s
Advertorials
Highlight  leadership
 your
are  company’s
written in  channel  management,
e style
 leadership
in a journalistic
CRN Channel Chiefs Ad
 in  channel your management,
to convey  teyour
chnology’s  solution  for  the    solution
 your  t chnology’s
key marketing messages. The
marketplace,
o  andChannel
 your  c m C
marketplace,
o pany’s
hiefs    exceptional    
v alue
 flexible    to  partners.
 you  can   
 highlight
 and  your  cm pany’s  exceptional  value  to  partners.   
t emplate i s s o  one  
o r  more  of
o  your  cm pany’s  
We’ll  takee  care  ohonorees.
fWe’ll
 the  h take
avy  lifting.
Highlight
 Aellow
 care  us o to  write
tf  the  your
 h i avy  company’s
 for  you  leadership
 or  we’ll  work  with  your
 lifting.  
i n  channel  managemen
e
u  sp plied  copy  – the choice is yours