Context-aware Security from the Core

Srikrupa Srivatsan, Sr. Manager, Product Marketing | 06/15/2017

1
1 || ©©2017
2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
 Agenda

• Evolving networks and increased cyber threats

• Closing the DNS gap
• Solutions to protect infrastructure and data
• Next steps

2
2 || ©©2017
2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
Evolving Network Environment and Paradigm Shifts...

Active Internet Connected Network Digital Internet

Users Devices Evolution Transformation of Things
3.4 Billion1 21 Billion2 Networks are Digital New trends like
Active internet users Connected devices being transformed transformation is IoT are increasing
worldwide in 2016, +25% by 2020, +30% over – Cloud, SDN, happening faster the attack surface
over last year last year others than you think

1. Internet Live Stats (http://www.internetlivestats.com/internet-users/)

2. http://www.cnbc.com/2016/02/01/an-internet-of-things-that-will-number-ten-billions.html
3. https://www.symantec.com/content/dam/symantec/docs/reports/istr-21-2016-en.pdf
3
3 || ©©2017
2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
...Are Leading to Increased Exposure to Cyber Threats

Organizations are facing an unprecedented

challenge of data breaches

4
4 || ©©2017
2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
 Products Galore: Solutions Missing

400+
VENDORS

5
5 || ©©2017
2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
Modern Networks
External Endpoints
DNS

DNS SIEM DNS

Threat
Intel

Data Center(s) SOC Office Locations

6
6 || ©©2017
2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
Potential Gaps in Modern Networks
External Endpoints
DNS

C&C/Data
Exfiltration?

DDoS?

Data
Exfiltration?
? C&C?

DNS SIEM DNS

? ?
Network context? Network context?
Threat
Intel

What’s on What’s on
my network? my network?

Data Center(s) SOC Office Locations

7
7 || ©©2017
2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
 DNS – The Critical Yet Vulnerable Asset

8
8 || ©©2017
2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
 The DNS Gap – A Multi Dimensional Threat Vector
Making Your
Infrastructure Work 78% 84% >$500 $1.5M
Against You DNS: most common Of reflection/amplification Per min cost of downtime Average cost per year to
application layer attacks1 attacks use DNS1 due to DDoS attack2 deal with DNS attacks2

The Leading
Culprit in Data
$4M 46% 45%
Average consolidated % of survey respondents that % of survey respondents that
Exfiltration cost of a data breach3 experienced DNS data exfiltration4 experienced DNS tunneling4

APT/Malware
Proliferation
91% 431M #1
Of malware uses DNS New unique pieces of malware in Malware C&C is #1 responsible
Rooted in DNS to carry out campaigns5 20156 vector for crimeware7

Ineffective Threat 70% 46% 45%

Intelligence of survey respondents that % of survey respondents unable to % of survey respondents lacked context
felt Threat Intel is not timely8 prioritize the threat by category8 for threat intel to make it actionable8

1. Arbor WISR2016 Report 7. Verizon 2016 Data Breach Investigations Report

2. Ponemon Institute Study – The Cost of Denial-of-Service Attacks. March 2015\ 8. Source: Ponemon Institute, 2015 Second Annual Study on Exchange Cyber Threat Intelligence
3. Source: Ponemon Institute, 2016 Cost of Data Breach Study
4. Source: SC Magazine, Dec 2014, “DNS attacks putting organizations at risk, survey finds”
5. Source: Cisco 2016 Annual Security Report
6. 9 || ©©2017
9
Symantec 2013
2016 Infoblox
Infoblox
Internet Inc.
Inc. All
Security All
Rights
Threat Rights Reserved.
Reserved.
Report
Three Aspects of Security

#1 #2 #3
Infrastructure Data Protection and Threat Containment
Protection Malware Mitigation and Operations
Better Application and Protect Users and Data Efficiency & Optimization
Service Availability of Security Operations

10 | | ©©2017
10 2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
Modern Networks: Agile & Secure
External Endpoints

DDoS

DNS DDoS

SIEM

Data
Exfiltration Threat C&C
Intel

IPs on the Network IPs on the Network

Data Center(s) SOC Office Locations

11 | | ©©2017
11 2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
 #1 Infrastructure Protection
Maintain Service and Application Availability

Visibility Vulnerability Protection DNS Attack Data Enrichment

of Network Devices Protection /Ecosystem
• Visibility into devices and • Detect network devices • Protect infrastructure against • Share events and alerts with
hosts on the network with vulnerabilities DNS DDoS, exploits, cache SIEM via APIs
poisoning, NXDOMAIN
• Visibility into attack points • Automate remedial action • Notify vulnerability scanners
and patterns • Detect DNS hijacking of new devices or virtual
workloads
• OS and configuration • DDoS resiliency with highly
vulnerabilities on network available architecture
devices

#1 Infrastructure #2 Data Protection and #3 Threat Containment

Protection Malware Mitigation and Operations

12 | | ©©2017
12 2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
 #2 Data Protection and Malware Mitigation
Avoid brand damage, financial and legal implications caused by data breaches, malware

Disruption of Cyber Kill Chain Data Exfiltration Prevention Visibility

• Block malware/APT activity at DNS • Prevent DNS based data exfiltration • Visibility into devices and hosts on
control plane that other systems can’t detect the network
• Enforce policy with curated up-to date • Detect and prevent zero day threats • Visibility into infected endpoints
threat intelligence using Big Data, machine learning
and streaming analytics • Network context for prioritization
• Protect users on or off premises
• Scalable enforcement on-premises • Contextual information on threat
• Prevent lateral movement of threats and in the cloud actor, threat campaign, associated
breaches in other organizations
• Accelerate remediation by sharing DNS
IoCs with ecosystem

#1 Infrastructure #2 Data Protection and #3 Threat Containment

Protection Malware Mitigation and Operations

13 | | ©©2017
13 2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
 #3 Threat Containment and Operations
Ease Security Operations, Get Better ROI from Your Security Investments

Threat Intelligence Security Rapid Triage/Resource

Optimization Orchestration Optimization
• Enforce policy using timely, consolidated • Automatically share DNS IoCs with • Investigate threats faster to free up
& high quality threat intelligence security ecosystem for more efficient security personnel
incident response
• Improve incident response with • Timely access to context for threat
consolidate threat intelligence from • Share network context and actionable indicators
multiple sources intelligence (IP address, DHCP
fingerprint, lease history etc.) to help
• Eliminate silos and accelerate remediation assess risk and prioritize alerts
by centralizing threat intelligence

#1 Infrastructure #2 Data Protection and #3 Threat Containment

Protection Malware Mitigation and Operations

14 | | ©©2017
14 2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
Multipronged Approach to Threat Detection

Reputation Signature Behavior

Detect & prevent Infrastructure protection Patented streaming
communications to for critical core services analytics technology
malware, C2, ransomware
Carrier-grade deep packet Detect & prevent data
Government-grade threat inspection exfiltration
intelligence
Instant identification of ”Machine learning”
Ecosystem popular tunneling tools

15 | | ©©2017
15 2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
Leverage Threat Intel Across Entire Security Infrastructure
Infoblox C&C IP List

SURBL Phishing & CSV File

Malware URLs JSON
TIDE STIX
Define Data Spambot IPs RBL Zone File
Marketplace
Policy, RPZ
Governance &
Translation C&C & Malware
Custom TI Host/Domain

Dossier
Investigate
Threats

RESULT: Single-source of TI management Faster triage Threat prioritization

16 | | ©©2017
16 2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
Security Orchestration & Data Sharing
Accelerating Incident Handling and Response Data to Prioritize Remediation

Device Audit Trail and

Fingerprinting
DHCP • Device info, MAC, lease history
SIEM Vulnerability
Management

Application and
Business Context
Threat IPAM • “Metadata” via Extended
Network
Intelligence Attributes: Owner, app, security
Platform Access level, location, ticket number
Control
• Context for accurate risk
assessment and event
prioritization

• Internal activity inside the

security perimeter

Advanced Next-gen • Includes BYOD and IoT devices

DNS
Threat Endpoint
Detection Security • Profile device & user activity

17 | | ©©2017
17 2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
 • Try Infoblox Products – Free of
Cost & Risk
• ActiveTrust Cloud eval

Next Steps • ActiveTrust (on-premises) eval

• Data Exfiltration demo
• Security(PCAP) assessment
Path to Engagement
• Engage with Infoblox to discuss
your security architectures

18 | | ©©2017
18 2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.
Q&A

19 | | ©©2017
19 2013 Infoblox
Infoblox Inc.
Inc. All All Reserved.
Rights Rights Reserved.