• Home

  • Documents

  • How to be prepared for the next generation of malware · Next-generation malware defense 3....
23
How to be prepared for the next generation of malware Martin Zich, CISSP HPE Pointnext 24th Sep, MS Ignite 2018

How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

  • Upload
    others

  • View
    11

  • Download
    0

Embed Size (px)

Citation preview

Page 1: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

How to be prepared for the next generation of malwareMartin Zich, CISSPHPE Pointnext

24th Sep, MS Ignite 2018

Page 2: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

MalwareA threat which is here to stay

Ransomware

Cryptoware/coin miners – cryptojacking

Adware

Banking trojan

Other malware to steal credentials, PII, and much more.

2

Page 3: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

What we keep finding at our clients

Page 4: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Many disconnected detection controls.

Alerts missing a context.

Inability to detect/react to unknown and take immediate action.

Missing or wrongly trained machine learning.

Lots of unwatched and unpatched current and legacy systems.

Lots of correct „paperwork“ which differs from what is deployed.

Lots of victims of social engineering.

Findings from the „field“ - highlights

User education and training showing dubious

outcomes.

Completely paralyzed environments.Lack of visibility.

Page 5: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Malware

5

We found completely paralyzed companies

The were looking for doubtful symptoms like:

Cryptojacking:

CPU/power consumption rise Overheating Periodical unknown traffic etc.

Ransomware:

Usually there was no need to watch for symptoms ... it was too late...

We found many victims of social engineering

Page 6: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Defense-in-depth.Security in multiple layers.

6

Administrative Technical Physical

HW

Platforms

Applications

Page 7: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

7

1. Secure hardware base.

Page 8: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Next-generation malware defenseSecure hardware base

Silicon root of trust with HPE Gen10 – Secure start base

8

Page 9: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Next-generation malware defenseSecure hardware base for Azure Stack

HPE ProLiant Gen10 for Azure Stack Silicon root of trust

9HPE ProLiant Gen10

Page 10: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Next-generation malware defense

2. Locked-down OS platform

Defending against known „by design“ Secure configuration (hardening) – CIS benchmarks, STIGs, etc.

10

Page 11: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Next-generation malware defense

2. Locked-down OS platform

Defending against known „by design“ Secure configuration (hardening) – CIS benchmarks, STIGs, etc.

11

Microsoft Credential Guard

Windows Defender Application Control (WDAC)

Microsoft Device Guard

Microsoft Edge AppGuard

Windows S

Example by:

Page 12: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Next-generation malware defense

3. Blocking the known and blocking the most frequent threat vectors

At best, right away = without any need for a long analysis Defending against specific threat vectors instead of specific threats Previously unknown threats included (zero-day)

12

Page 13: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Next-generation malware defense

3. Blocking the known and blocking the most frequent threat vectors

At best, right away = without any need for a long analysis Defending against specific threat vectors instead of specific threats Previously unknown threats included (zero-day)

13

Microsoft Exploit Guard

Attack Surface Reduction – Office rules, Script rules, Email rule

Controlled Folder Access

Network protection

Exploit Protection

Example by:

Page 14: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Next-generation malware defense

4. Defending legacy and embedded

Turning on backported features Secure configuration – hardening Applications whitelisting Network/physical isolation – e.g. separated VLAN for legacy, air-gaped embedded

14

Page 15: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Next-generation malware defense

4. Defending legacy and embedded

Turning on backported features Secure configuration – hardening Applications whitelisting Network/physical isolation – e.g. separated VLAN for legacy, air-gaped embedded

15

Microsoft env., for example:

W8 Restricted Admin mode, backported to Windows 7 (extended support till January 14, 2020).

Group policies for SLA on e.g.SAM-R (net user, net group, etc.)

Disabling low-level encryption types (RC4 with NTLM, SSLv1,2, etc.)

Disabling SMBv1

Page 16: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Next-generation malware defense

5. Detection and stopping the unknown

Detect and block all of the unknown threat vectors (zero-day) Train well the „machine learning“ Maintaining visibility and taking actions over the whole environment

16

Page 17: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Next-generation malware defense

5. Detection and stopping the unknown

Detect and block all of the unknown threat vectors (zero-day) Train well the „machine learning“ Maintaining visibility and taking actions over the whole environment

17

MS Intelligent Security Graph + various associated solutions Example by:

Page 18: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

18

Page 19: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Intelligent Security Graph

19

Microsoft feeds it‘s security solutions with information stored and processed in ISG

Windows Defedender AV – local ML portion + from-cloud delivered protection

Windows Defender Advanced Threat Protection

Office 365 Advanced Threat Protection

Azure Advanced Threat Protection

API – getting your own context information, security profiles, taking active actions through the API

Page 20: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Intelligent Security Graph – Windows Defender AV

20

Page 21: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Intelligent Security Graph – API

21

Page 22: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Intelligent Security Graph – API

22

Page 23: How to be prepared for the next generation of malware · Next-generation malware defense 3. Blocking the known and blocking the most frequent threat vectors At best, right away =

Thank [email protected]

mailto:[email protected]

Automatic Generation of String Signatures for Malware ... · PDF fileAutomatic Generation of String Signatures for Malware Detection ... to test a candidate ... Another loosely related

Automatic Generation of String Signatures for Malware ... · PDF fileAutomatic Generation of String Signatures for Malware Detection ... to test a candidate ... Another loosely related

Documents
Automatic Generation of Remediation Procedures for Malware Infections

Automatic Generation of Remediation Procedures for Malware Infections

Documents
Malwarebytes Anti-Malware Unmanaged Client Administrator Guide · Anti-Malware Unmanaged Client Administrator Guide 2 Introduction Malwarebytes Anti-Malware is a next-generation anti-malware

Malwarebytes Anti-Malware Unmanaged Client Administrator Guide · Anti-Malware Unmanaged Client Administrator Guide 2 Introduction Malwarebytes Anti-Malware is a next-generation anti-malware

Documents
Blocking Malware and Prohibited Files - · PDF fileCHAPTER 37-1 FireSIGHT System User Guide 37 Blocking Malware and Prohibited Files Malicious software, or malware, can enter your

Blocking Malware and Prohibited Files - · PDF fileCHAPTER 37-1 FireSIGHT System User Guide 37 Blocking Malware and Prohibited Files Malicious software, or malware, can enter your

Documents
Email Malware Protection System - FireEye, Inc. · Email Malware Protection System Next-Generation Email Security to Stop Advanced Targeted Attacks The FireEye Email Malware Protection

Email Malware Protection System - FireEye, Inc. · Email Malware Protection System Next-Generation Email Security to Stop Advanced Targeted Attacks The FireEye Email Malware Protection

Documents
Behavioral Clustering of HTTP-based Malware and … · and Signature Generation using Malicious Network Traces ... Honeypot GET /in.php?affid ... Detecting Web-based Malware FW Web-Proxy

Behavioral Clustering of HTTP-based Malware and … · and Signature Generation using Malicious Network Traces ... Honeypot GET /in.php?affid ... Detecting Web-based Malware FW Web-Proxy

Documents
Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Documents
Behavioral Clustering of HTTP-based Malware and …Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network Traces Roberto Perdisci(1,2), Wenke

Behavioral Clustering of HTTP-based Malware and …Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network Traces Roberto Perdisci(1,2), Wenke

Documents
Malware Labs : Unknown Malware Advanced Detection · Next generation anti-virus, malware tracking, threat hunting, behavioral analysis, endpoint detection, sandboxing, machine learning,

Malware Labs : Unknown Malware Advanced Detection · Next generation anti-virus, malware tracking, threat hunting, behavioral analysis, endpoint detection, sandboxing, machine learning,

Documents
No Hardware. No Software. No Malware. · antivirus, antispyware, and antiphishing Webroot Web Security Service scans all HTTP and FTP over HTTP requests in the cloud, blocking malware

No Hardware. No Software. No Malware. · antivirus, antispyware, and antiphishing Webroot Web Security Service scans all HTTP and FTP over HTTP requests in the cloud, blocking malware

Documents
Anti Virus - forestcompals.org.auforestcompals.org.au/wp-content/uploads/2018/03/Anti-Virus-Musts.… · Avast Free Antivirus provides excellent malware blocking functionality

Anti Virus - forestcompals.org.auforestcompals.org.au/wp-content/uploads/2018/03/Anti-Virus-Musts.… · Avast Free Antivirus provides excellent malware blocking functionality

Documents
Next Generation IPS and Advance Malware Protection - · PDF fileNext Generation IPS and Advance Malware Protection ... Enterasys Networks Huawei (Extreme ... 8270, and 8290 to one

Next Generation IPS and Advance Malware Protection - · PDF fileNext Generation IPS and Advance Malware Protection ... Enterasys Networks Huawei (Extreme ... 8270, and 8290 to one

Documents
Allot Products & Solutions - ConnectIT...Allot integrates anti-malware, parental controls, URL filtering, mail security, ads blocking, and application control into a scalable, multi-tenant

Allot Products & Solutions - ConnectIT...Allot integrates anti-malware, parental controls, URL filtering, mail security, ads blocking, and application control into a scalable, multi-tenant

Documents
THE ESSENTIAL GUIDE TO Blocking Malware Without a SOC

THE ESSENTIAL GUIDE TO Blocking Malware Without a SOC

Documents
Automatic Malware Signature Generation

Automatic Malware Signature Generation

Documents
Blocking Malware and Prohibited Files - cisco.com · to Cisco’s malware awareness network (called the Collective Security Intelligence Cloud) for dynamic analysis of the file’s

Blocking Malware and Prohibited Files - cisco.com · to Cisco’s malware awareness network (called the Collective Security Intelligence Cloud) for dynamic analysis of the file’s

Documents
AMVG: Adaptive Malware Variant Generation Framework ......perturbation applications similarly as in [6]. C. Genetic algorithm for malware variant generations GA has been used widely

AMVG: Adaptive Malware Variant Generation Framework ......perturbation applications similarly as in [6]. C. Genetic algorithm for malware variant generations GA has been used widely

Documents
BLOCKING AND BRACING Blocking & Bracing 1 Blocking and Bracing

BLOCKING AND BRACING Blocking & Bracing 1 Blocking and Bracing

Documents
ISACA - Evolution of Malware and the Next Generation ... · • Malware professionalization • Use of marketing techniques in spam campaigns • Country/Time based malware variant

ISACA - Evolution of Malware and the Next Generation ... · • Malware professionalization • Use of marketing techniques in spam campaigns • Country/Time based malware variant

Documents
Geo-IP Blocking A Sometimes Effective MalWare Deterrent · Geo-IP Blocking: A sometimes effective Mal-ware deterrent DEFCON 13 Presentation July 30, 2005

Geo-IP Blocking A Sometimes Effective MalWare Deterrent · Geo-IP Blocking: A sometimes effective Mal-ware deterrent DEFCON 13 Presentation July 30, 2005

Documents
Cyber Threat Intelligence Sharing and Blocking · • C&C Communication, Network communications • Forum, Posts • Malware Analysis, etc •These Traces remain on the web • They

Cyber Threat Intelligence Sharing and Blocking · • C&C Communication, Network communications • Forum, Posts • Malware Analysis, etc •These Traces remain on the web • They

Documents
04 - Code Analysis & Windows Malware Analysis & Static Analysis … · 2020-06-13 · Code Analysis Analyzing Malicious Windows Programs Static Analysis Blocking Methods 04 - Code

04 - Code Analysis & Windows Malware Analysis & Static Analysis … · 2020-06-13 · Code Analysis Analyzing Malicious Windows Programs Static Analysis Blocking Methods 04 - Code

Documents
IN UNMANAGED & SMART SWITCHES - netgear.com · • DHCP Snooping Build a secured, converged network with all types of traffic by preventing external attacks and blocking malware,

IN UNMANAGED & SMART SWITCHES - netgear.com · • DHCP Snooping Build a secured, converged network with all types of traffic by preventing external attacks and blocking malware,

Documents
Characteristic of Malware Site and its Blocking Countermeasure

Characteristic of Malware Site and its Blocking Countermeasure

Internet
Document Part No.: SLEM28556/181213...Lockdown, Script Lockdown, Integrity Monitoring, USB Malware Protection, Storage Device Blocking, and Predefined Trusted Updater. • Windows

Document Part No.: SLEM28556/181213...Lockdown, Script Lockdown, Integrity Monitoring, USB Malware Protection, Storage Device Blocking, and Predefined Trusted Updater. • Windows

Documents
PillarBox: Combating next-generation malware with fast forward

PillarBox: Combating next-generation malware with fast forward

Documents
The Future of Automated Malware Generation

The Future of Automated Malware Generation

Spiritual
BLOCKING AND BRACING Blocking & Bracing. BLOCKING AND BRACING Blocking & Bracing 2 Blocking and Bracing

BLOCKING AND BRACING Blocking & Bracing. BLOCKING AND BRACING Blocking & Bracing 2 Blocking and Bracing

Documents
Lastline: Next Generation Malware Detection and Defense

Lastline: Next Generation Malware Detection and Defense

Technology
Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

Documents