How to be prepared for the next generation of malware · Next-generation malware defense 3....

How to be prepared for the next generation of malwareMartin Zich, CISSPHPE Pointnext

24th Sep, MS Ignite 2018

MalwareA threat which is here to stay

Ransomware

Cryptoware/coin miners – cryptojacking

Adware

Banking trojan

Other malware to steal credentials, PII, and much more.

What we keep finding at our clients

Many disconnected detection controls.

Alerts missing a context.

Inability to detect/react to unknown and take immediate action.

Missing or wrongly trained machine learning.

Lots of unwatched and unpatched current and legacy systems.

Lots of correct „paperwork“ which differs from what is deployed.

Lots of victims of social engineering.

Findings from the „field“ - highlights

User education and training showing dubious

outcomes.

Completely paralyzed environments.Lack of visibility.

Malware

We found completely paralyzed companies

The were looking for doubtful symptoms like:

Cryptojacking:

CPU/power consumption rise Overheating Periodical unknown traffic etc.

Ransomware:

Usually there was no need to watch for symptoms ... it was too late...

We found many victims of social engineering

Defense-in-depth.Security in multiple layers.

Administrative Technical Physical

Platforms

Applications

1. Secure hardware base.

Next-generation malware defenseSecure hardware base

Silicon root of trust with HPE Gen10 – Secure start base

Next-generation malware defenseSecure hardware base for Azure Stack

HPE ProLiant Gen10 for Azure Stack Silicon root of trust

9HPE ProLiant Gen10

Next-generation malware defense

2. Locked-down OS platform

Defending against known „by design“ Secure configuration (hardening) – CIS benchmarks, STIGs, etc.

2. Locked-down OS platform

Defending against known „by design“ Secure configuration (hardening) – CIS benchmarks, STIGs, etc.

Microsoft Credential Guard

Windows Defender Application Control (WDAC)

Microsoft Device Guard

Microsoft Edge AppGuard

Windows S

Example by:

3. Blocking the known and blocking the most frequent threat vectors

At best, right away = without any need for a long analysis Defending against specific threat vectors instead of specific threats Previously unknown threats included (zero-day)

3. Blocking the known and blocking the most frequent threat vectors

At best, right away = without any need for a long analysis Defending against specific threat vectors instead of specific threats Previously unknown threats included (zero-day)

Microsoft Exploit Guard

Attack Surface Reduction – Office rules, Script rules, Email rule

Controlled Folder Access

Network protection

Exploit Protection

Example by:

4. Defending legacy and embedded

Turning on backported features Secure configuration – hardening Applications whitelisting Network/physical isolation – e.g. separated VLAN for legacy, air-gaped embedded

4. Defending legacy and embedded

Turning on backported features Secure configuration – hardening Applications whitelisting Network/physical isolation – e.g. separated VLAN for legacy, air-gaped embedded

Microsoft env., for example:

W8 Restricted Admin mode, backported to Windows 7 (extended support till January 14, 2020).

Group policies for SLA on e.g.SAM-R (net user, net group, etc.)

Disabling low-level encryption types (RC4 with NTLM, SSLv1,2, etc.)

Disabling SMBv1

5. Detection and stopping the unknown

Detect and block all of the unknown threat vectors (zero-day) Train well the „machine learning“ Maintaining visibility and taking actions over the whole environment

5. Detection and stopping the unknown

Detect and block all of the unknown threat vectors (zero-day) Train well the „machine learning“ Maintaining visibility and taking actions over the whole environment

MS Intelligent Security Graph + various associated solutions Example by:

Intelligent Security Graph

Microsoft feeds it‘s security solutions with information stored and processed in ISG

Windows Defedender AV – local ML portion + from-cloud delivered protection

Windows Defender Advanced Threat Protection

Office 365 Advanced Threat Protection

Azure Advanced Threat Protection

API – getting your own context information, security profiles, taking active actions through the API

Intelligent Security Graph – Windows Defender AV

Intelligent Security Graph – API

Thank Youmartin.zich@hpe.com

How to be prepared for the next generation of malware · Next-generation malware defense 3....

Documents

04 - Code Analysis & Windows Malware Analysis & Static Analysis … · 2020-06-13 · Code Analysis Analyzing Malicious Windows Programs Static Analysis Blocking Methods 04 - Code

Blocking Malware and Prohibited Files - · PDF fileCHAPTER 37-1 FireSIGHT System User Guide 37 Blocking Malware and Prohibited Files Malicious software, or malware, can enter your

Blocking - Habitat Denver of Blocking we install: • Ladder blocking • Deadwood (drywall nailers) • Fire blocking • Kitchen cabinet blocking • Bathroom vanity & cabinet blocking

Blocking Malware and Prohibited Files 24-1 ASA FirePOWER Module User Guide 24 Blocking Malware and Prohibited Files Malicious software, or malware, can enter your organization’s

Document Part No.: SLEM28556/181213...Lockdown, Script Lockdown, Integrity Monitoring, USB Malware Protection, Storage Device Blocking, and Predefined Trusted Updater. • Windows

Anti Virus - forestcompals.org.auforestcompals.org.au/wp-content/uploads/2018/03/Anti-Virus-Musts.… · Avast Free Antivirus provides excellent malware blocking functionality

Blocking internet threats: the avast! script enginedownload307.avast.com/files/marketing/materials/whitepaper_script... · script-based malware. Consequently, all modern antivirus

Blocking Malware and Prohibited Files - cisco.com · to Cisco’s malware awareness network (called the Collective Security Intelligence Cloud) for dynamic analysis of the file’s

Next-Generation Endpoint Protection - Pronto Marketing€¦ · Next-Generation Endpoint Protection Enduser Protection. Sophos confidential 2. Sophos confidential 3 400,000 new malware

Malware Labs : Unknown Malware Advanced Detection · Next generation anti-virus, malware tracking, threat hunting, behavioral analysis, endpoint detection, sandboxing, machine learning,

Email Malware Protection System - FireEye, Inc. · Email Malware Protection System Next-Generation Email Security to Stop Advanced Targeted Attacks The FireEye Email Malware Protection

Automatic Benchmark Generation Framework for …downloads.hindawi.com/journals/scn/2018/4947695.pdfframework for malware benchmark generation is crucial. e diversity of malware samples

Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

Web Malware Protection System - FireEye Products & Solutions | …Web Malware Protection System Next-Generation Web Security to Combat Advanced Targeted Attacks The FireEye Web Malware

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Automatic Generation of String Signatures for Malware ... · PDF fileAutomatic Generation of String Signatures for Malware Detection ... to test a candidate ... Another loosely related

Geo-IP Blocking A Sometimes Effective MalWare Deterrent · Geo-IP Blocking: A sometimes effective Mal-ware deterrent DEFCON 13 Presentation July 30, 2005

Automatic Generation of String Signatures for Malware ... · Automatic Generation of String Signatures for Malware Detection Scott Schneider, Kent Griffin – SRL Xin Hu – University

[hs] Heimdal PRO Guide for Affiliates and Resellers …...4 Protect your computer from 2nd generation malware Ransomware, exploit kits, financial Trojans and data-stealing malware

Next Generation IPS and Advance Malware Protection - · PDF fileNext Generation IPS and Advance Malware Protection ... Enterasys Networks Huawei (Extreme ... 8270, and 8290 to one