Network and Endpoint Security v1.0 (2017)

Deliveringthebestinzservices,software,hardwareandtraining.Deliveringthebestinzservices,software,hardwareandtraining.

Deliveringthebestinzservices,skills,securityandsoftware.

NetworkandEndpointSecurityRuiMiguelFeio– SeniorTechnicalLead

Agenda• NetworkandEndpointSecurity– whatisit?• Problemsandrisks• Impactandcostofasecuritybreach• HowtoimplementNetworkandEndpointSecurity?• EndpointSecuritymanagement• Challenges• Realexampleofanineffectiveimplementation• OnlineworldandHackers• Networkandendpointsecurityonthemainframe

WhoamI?

RUIMIGUELFEIO

• SeniorTechnicalLeadatRSMPartners• BasedintheUKbuttravelsallovertheworld• 18yearsexperience workingwithmainframes• StartedwithIBMasanMVSSysProgrammer• Specialistinmainframesecurity• Experienceinotherplatforms

TechnologicalandSocialEvolution

• Societyisevermoredependentontechnologytofunction• There’saprevalenceforstoringdataindigitalformat• Globalisationisnotonlyasocial-economicevent,butdigitalaswell

(Internet)

ImageSource:paleoplan.com

Thedigitalnetwork

• Networksecurityreferstotechnologiesandprocessesthatareusedtokeepdigitalnetworksingood,secureworkingorder.

• Endpointsecurityreferstoanydevicethatconnectstothedigitalnetwork,fromserverstodesktops,mobiledevices,andanyotherdevicethatisnetwork-enabled.

• Assuch,NetworkandEndpointSecurityaimstoprotectandensurethenormalfunctioningofthedigitalnetworkanddevicesconnectedtoit.

NetworkandEndpointSecurity

• Wecanonlysecurewhatwe‘control’:– Companydigitalnetwork– Devicesconnectedtothecompany’s

digitalnetwork

• Isthisenough?No,weshouldalsoconsider:– People– Businesspartners– Serviceproviders– Physicalsecurity

Securingourinterests

• Misconfiguredhardware/software• Lackofknowledgeandresources• Defaultsettings• Humanfactor• Cybercriminals• Systemsnotup-to-date• Solutionsnotfitforpurpose• Lackofinterest• Outofsupportsoftware/hardware

Problemsleadtosecurityrisks

• OS/2wasacomputeroperatingsystem,initiallycreatedbyMicrosoftandIBM,thenlaterdevelopedbyIBMexclusively.

• ThefirstversionofOS/2wasreleasedinDecember1987andnewerversionswerereleaseduntilDecember2001.

• OS/2wentoutofsupportinDecember2006.• OS/2isstillusedtodaybyaUKBanktorunone

ofitscriticalapplication.• There’snoplantohaveitmovedintoadifferent

platform.

HaveyoueverheardofOS/2?

• Asecuritybreachcanhavedevastatingeffectstothecompany:– Reputation– Exposureofconfidentialdataand

information– Financial

• Itcanevencompromisetheexistenceofthecompany

ImpactofaSecurityBreach

Costofasecuritybreach

https://www-03.ibm.com/security/infographics/data-breach/

HowtoSecure?

YourLogoYourLogo

SECURITY

Processes

Analysis

Education

Review

Monitor

Alerting

Audit& Testing

Improve

EndpointSecurityManagement

http://cybersec.buzz/endpoint-security-sizzling-however/

TheChallenges

Mentalities

OnaPenTestatoneofthetop5USbanks:• Clientwasconvincedtheyhadatopoftheart

networksecuritysystem.• IdecidedtounplugEthernetcablefromoneof

theterminalsandconnectittomylaptop• Thiswentwithoutdetection• Iwasabletorunaportscanonthemainframe

withoutdetection• Thiswasjustthebeginning!!...

Whenyouthinkyougotitright...

OnaPenTestatoneofthetop5USbanks:• Clientwasconvincedtheyhadatopoftheart

networksecuritysystem.• IdecidedtounplugEthernetcablefromoneof

theterminalsandconnectittomylaptop• Thiswentwithoutdetection• Iwasabletorunaportscanonthemainframe

withoutdetection• Thiswasjustthebeginning!!...

Whenyouthinkyougotitright...

Vulnerabilities24highrisk

25mediumrisk2lowrisk

OffWithTheirHeads!!

• Isitenoughtoprotectthecompany’sdigitalnetworkanddevices?

• Haveyouconsiderinternalbreaches?

• Howabouttheonlineservicesyouuse?

• Isyoursitereallysecure?

• Iseveryonefollowingthesecurityprocedures?

Thebigquestions

• Mostonlineservices(Google,socialmedia,etc)collectdata:– Typeofdevice(OS,Webbrowser,device

type,etc)– Location

• Thisdatacanbeusedto:– Developuser/companyprofiles– Customisedads– Customisedwhatwesee(WYSIWYG)

TheOnline’World’

• CompaniesareaprimetargetforHackers• Socialmediaisasourceofinformation• Datacollectedonlinecanbeusedto

compromiseyoursystems• Hackershavetime,patience,andinmany

cases,resources• It’snotamatterofifyouwillbehacked,it’s

amatterofwhatwillyoudowhenyouare?

TheHackersarecomingforyou

Hackers’resources

Socialengineering

http://www.social-engineer.org/social-engineering/social-engineering-infographic/

Hackers’resources

NetworkandEndpointsecurityonthemainframe• SERVAUTHclass:

– STACK– PORT– NETACCESS

• PolicyAgent• AT-TLS• IPSEC• IPFiltering• IntrusionDetectionServices

• DefenceManagerDaemon• TrafficRegulationManagementDaemon• SyslogDaemon(SyslogD)• SNAenvironment• EnterpriseEdition(EE)connectionsmake

surewhotheyareconnectedtoandwhataccessthe3rd partieshas

• InternalTelnetconnections

NetworkandEndpointsecurityonthemainframe

• Implementalertingsystems(IBMzSecure,Vanguard,…)

• Monitoringsystems• Performonaregularbasis:

– Securityaudits– Penetrationtestings– Securityremediations– Recertification

• Reviewprocessesandprocedures• Educateandtrainyourresources

Mainframe– Whatelse?

• Reviewyoursecuritypoliciesacrosstheboard• Reviewyourtechnologicalestate• Provideregulartrainingandawareness• Keepyoursystemsup-to-date• Segregateanddonotallowdevicesthatdonotmeet

theminimumsecurityrequirements• Performregularsecurityaudits,andpentests• Payspecialattentiontodefaultsettings• Alwaysassumeyou’vealreadybeenhacked!

Beforewego,aquickreview

Questions?

RuiMiguelFeio,RSMPartnersruif@rsmpartners.commobile:+44(0)7570911459www.rsmpartners.com

Contact

www.linkedin.com/in/rfeio

Network and Endpoint Security v1.0 (2017)

Internet

The IoT Endpoint Model 11 - GSMA · GSM Association Non-confidential Official Document CLP.13 - IoT Security Guidelines Endpoint Ecosystem V1.0 Page 3 of 82. 6.2 Utilize a Trust Anchor

SentinelOne Endpoint Security

SentinelOne Endpoint Security - ProteQtor IT Security

ENDPOINT SECURITY PROBLEMS

The Current State and Future Path of Endpoint Security · The evolution of endpoint security 6 2002 • Endpoint Security = AV • Endpoint Security = AV, VPN client, NAC client,

IIoT Endpoint Security

Symantec™ Endpoint Protection 12.1 · · 2016-04-28Symantec™ Endpoint Protection 12.1.6 Data Sheet: Endpoint Security ... "Enterprise Endpoint Security Performance Benchmarks",

Ivanti Endpoint Manager, Endpoint Security for Endpoint

Fast and Effective Endpoint Security for Business 2012 · Kaspersky Endpoint Security McAfee Total Protection for Endpoint Microsoft System Center 2012 Endpoint Protection Symantec

ESET Endpoint Security 6 ESET Endpoint Antivirus 6static3.esetstatic.com/fileadmin/Images/INT/Docs/Other/Business... · ESET Endpoint Security 6, ESET Endpoint Antivirus 6 Specialized

Endpoint Security Evasion

SECURITY UNIFIED ENDPOINT FIREWALL

ZENworks Endpoint Security Policies Reference...ZENworks Endpoint Security Agent. The Endpoint Security Agent enforces security policies on a workstation device. Policy Purpose Security

Enhancing Endpoint Security

Infowatch endpoint security

IIC Endpoint Security Best Practices - iiconsortium.org · IIC Endpoint Security Best Practices Security Architectures IIC:WHT:IN17:V1.0:PB:20180312 - 4 - SECURITY ARCHITECTURES There

McAfee Endpoint Security 10€¦ · • McAfee support McAfee Endpoint Security 10.5 Product Guide 7. McAfee Endpoint Security 8 McAfee Endpoint Security 10.5 Product Guide. 1 Introduction

Kaspersky Endpoint Security 8 for Linux Linus/kes8.0_linuxwks... · 2016-12-07 · 8 INTRODUCTION Kaspersky Endpoint Security 8 for Linux (hereinafter Kaspersky Endpoint Security

Sophos Endpoint Security and Control help · PDF fileSophos Endpoint Security and Control help Product version: ... 9.2 Configuring the firewall ... Sophos Endpoint Security and Control

2018 Endpoint Security Priorities: A Return to Endpoint Protection … · 2019-06-22 · 2018 Endpoint Security Priorities: A Return to Endpoint Protection Platforms Many organizations