Upload
valentine-paul
View
224
Download
0
Tags:
Embed Size (px)
Citation preview
MANAGED SECURITY TESTINGPROACTIVELY MANAGING VULNERABILITIES
THE INTRO
WHAT’S THE PROBLEM?Managing vulnerabilities proactively is more important than ever
Data sources: Trustwave Global Security Report 2014;
Ponemon Institute 2014 Cost of Data Breach Study
The volume of compromises is increasing
54% more investigations conducted in 2013 (vs. 2012)
Breaches are costly $5.85 million on average in 2013 (US)
Attackers are diversifying their targets
33% increase in theft of non-payment card data
Attackers are more sophisticated
71% of victims don’t detect a breach on their own; self-detection takes 3 months
Apps in particular are highly vulnerable
96% of applications harbor at least one serious vulnerability
QUESTIONS OUR CUSTOMERS ASKAbout managing vulnerabilities and risk…
What’s on my network?
How do I know if I’m being targeted?
Where am I weak or vulnerable?
How can I get the most out of my program?
How do I prioritize? What can wait?
DAT
ABASE
S NETW
ORKS
APPLICATIONS
WHAT WE OFFERA programmatic approach to vulnerability management
DISCOVER POTENTIAL
WEAKNESSES ACROSS ALL
ASSETS
ASSESS BUSINESS RISK
ON MISSION CRITICAL ASSETS PENETRATIO
NTESTING
MANAGED SCANNING
SELF-SERVICE SCANNING
ATTACKER INTERNETCOMPANY WEBSITEBuilt on Adobe Cold Fusion
DIRECTORY TRAVERSAL1
View Arbitrary FilesFinds Admin Password
for Cold Fusion
ESCALATE & GRABSTORED CREDENTIALS2
Yields DomainAdmin Credentials
LEVERAGE STOLENCREDENTIALS FORVPN ACCESS3
Access to Internal Network
As Domain Admin
CORPORATE SSL VPNDATABASE
DATAEXFILTRATION4
Directory Traversal (CVE-2013-0629)CVSS score=4.3 (medium)Many businesses might ignore due to its relatively low score
THE POWER OF TESTING
OUR SCANNING & TESTING PORTFOLIOFlexible options based on your needs
Self-Service Scanning• Cloud-based
• Schedule and manage scans on demand
• Work from a full list of results generated by our tools
Managed Scanning• Scans managed by
Trustwave experts• Validated results and
reports• Augment your team
and minimize false positives
Penetration Testing4 Tiers of Testing based on your requirements• Basic: Attacks most commonly
exploitable vulnerabilities• Opportunistic: Includes attack
chaining; limited to a list of targets.
• Targeted: Targets systems w/ critical data, unrestricted scope
• Advanced: Full attack simulation: custom exploits and social engineering
4
1 2
WHY CHOOSE TRUSTWAVE?One vendor. One platform. All your assets.
Broadest Coverage– Networks– Applications– Databases
Most Flexibility– Cloud, managed, licensed options– Centralized dashboard view of
status – “Flex Spending Account” model
Maximum Control– Choose from full suite of services– Add technologies to address gaps– Proactive breach detection and IR
Budget Friendly– Maximize budget with a single
vendor– Easy to adjust allocations– Simplifies planning and
management
3
THE BIG PICTURE
THE BIG PICTUREScanning and testing are the beginning, not the end.
DISCOVER & SCORE• All assets• Proactive discovery• Automated/scalable
TEST & VALIDATE• Some assets• Deeper analysis• Identify unknown gaps
MITIGATE & PROTECT• Where necessary• Fix flaws• Fill gaps Security
Solutions
Penetration Testing
Scanning(Cloud and Managed)
DAT
ABASE
S NETW
ORKS
APPLICATIONS
ATTACKER INTERNETCOMPANY WEBSITEBuilt on Adobe Cold Fusion
DIRECTORY TRAVERSAL1
View Arbitrary FilesFinds Admin Password
for Cold Fusion
ESCALATE & GRABSTORED CREDENTIALS2
Yields DomainAdmin Credentials
LEVERAGE STOLENCREDENTIALS FORVPN ACCESS3
Access to Internal Network
As Domain Admin
CORPORATE SSL VPNDATABASE
DATAEXFILTRATION4
REAL-WORLD EXAMPLEWeb
Application Firewall can
provide persistent
protection, and is informed by scan results
IDS/IPS can detect and
stop escalation
2-Factor AUTH adds
stronger access control
at the VPN
DB Security can eliminate unauthorized
access & monitoring or blocking of
inappropriate requests
DLP can stop critical or
unauthorized data from
leaving your environment
THANK YOU
QUESTIONS PLEASE