New Trends in End-Point Security

1. New Trends in End-Point Security Todd Beski Pre-Sales Consultant Todd.beski@securewave.com Phone: 586-477-2006 February 23rd 2006

2. It’s in the News Current Security Events

3. Today’s hot Topic: Patching • Microsoft's delay to patch fuels concernsMicrosoft's decision to cancel a security fix after finding problems with the patch has security experts questioning whether waiting for the fix to come next month might leave them open to attack. • Robert Lemos, SecurityFocus 2005-09-13 • Unofficial patch – WMF Exploit • For those of you wanting to try an unofficial patch with all the risks involved, please see here. (md5 15f0a36ea33f39c1bcf5a98e51d4f4f6), PGP signature (signed with ISC key) here. Initially it was only for Windows XP SP2.  Fellow handler Tom Liston worked with Ilfak Guilfanov to help confirm some information required to extend it to cover Windows XP SP1 and Windows 2000.Note: When MS comes out with a real patch, simply uninstall this from Add/Remove programs on the Control Panel. • - SANS Institute

4. Today’s Hot Topic: Zero Day Virus Protection • Virus Fighters Can't Keep UpFast-moving malware has the antivirus industry looking for a new strategy that focuses on proactive, automated tools. • Thomas Claburn • InformationWeek • Dec 19, 2005 12:00 AM • "The majority of products are unable even to guarantee 90% protection. And this is the main problem facing the antivirus industry today." • Eugene Kaspersky

5. Today’s Hot Topic: Zero Day Virus Protection • Kaspersky Lab receives 200 to 300 new malware samples a day. Sophos plc, a U.K. research lab, reports that the number of new threats rose by 48% this year. Panda Software warns that more than 10,000 new bots--automated worms or Trojans that infest PCs and turn them into zombies under a hacker's control--have appeared in 2005. "The game has definitely changed over the past few years, even in the past 12 months, about what is an acceptable speed of response to a new virus," says Richard Wang, manager of Sophos labs.

6. Today’s Hot Topic: SpyWare Protection • “If you use the Internet, there is over a 90% chance your computer is infected with SpyWare - • “25% of all of our Support related calls are SpyWare related” • – Dell Computer • Nearly 80% of IT managers claim their organizations have been infiltrated in the last 12 months by spyware. • – Information Week

7. In the News: Unauthorized Applications • Hackers Tap 40 Million Credit Cards • “MasterCard International said card numbers and expiration dates were harvested by a rogue program planted inside the computer network at CardSystems Inc., one of the firms that process merchant requests for credit card authorization. When a retailer swipes a customer's card, the information goes to companies such as CardSystems for approval before getting passed along to banks.”

8. The Device Control Problem Diversity of removable media form factors

9. What actions to take Develop a policy for the use of removable media • Gartner (July 2004) advises companies to forbid employees to use iPods and other USB/FireWire devices

10. White List vs. Black List Approach White List vs. Black List Approach

11. White List vs. Black List Approach • Different approaches same result • Attempt to detect and react to suspicious behaviors • The reactive model …. Doesn't Work • “Seek and Destroy” Malware • The Blacklist approach …. Doesn't Work • Block or stonewall communications ports • The Firewall, port-blocker, and epoxy methods • Use of GPO’s – can’t stop Malware • Cons of These Approach’s • Can only detect what it knows about • Constant updates required • Behavior models not exact

12. White List vs. Black List Approach • Sanctuary White List Approach • Stops Spyware Cold • No Scanning or Black List Signatures • Defends Data Against Theft By Securing Network Endpoints • Only Trusted Applications Are Authorized • Only Trusted Devices Are Authorized • Everything is “Guilty Until Proven Innocent” Bottom Line • If it is not defined it will not load to memory or function as a device & becomes DEAD or DEADWARE

13. SanctuaryUnlike… * Detects the spread of software not approved by policy

14. Policy Enforcement & Management Policy Enforcement & Management

16. Great Gadget Or Massive Security Risk? Intelligent Device Management 2,500 songs Or Your entire customer database to go? Intelligent Device Management Legitimate or Dangerous Devices

17. USB Memory Sticks ZIP Drives USB Printers Smart Card Readers PDAs Desktop Tape Drives • USB • LPT • FireWire • Bluetooth • WiFi • IrDA • PCMCIA • COM • IDE • S-ATA Scanner CD/DVD Player/ Bruners HardDrives Digital Camera Floppy Drives Wireless Lan Adapters Biotech Devices Modems Sanctuary Device Control Manage Devices and Access Control Protect All Ports TREO MP3

19. Fixes your Clock? Or CLEANSyour Clock? No Signatures, No Trojans, No Spyware. EVER. Helpful Update Or Your PASSWORD on a Silver Plate? No Signatures, No Trojans, No Spyware. EVER. Malware Threat

20. Instant Messaging Or Instant OUTBREAK? No Signatures, No Trojans, No Spyware. EVER. Sample of Unauthorized Software

21. Authorized • Operating Systems • Business Software user should have access to • Known • Viruses, Worms, Trojans • Hacker Intrusive Software • Unauthorized - Unwanted • Games, Shareware • Unlicensed Software • Software user should not have access to • Unauthorized - Unwanted • Games, Shareware • Unlicensed Software • Software user should not have access to • Unknown • Viruses, Worms, Trojans • Hacker Intrusive Software • Unknown • Viruses, Worms, Trojans • Hacker Intrusive Software • Unknown • Viruses, Worms, Trojans • Hacker Intrusive Software White List ApproachManage the known and allowed, deny all else… Applications Malware • Authorized • Operating Systems • Business Software user should have access to • Known • Viruses, Worms, Trojans • Hacker Intrusive Software • Unauthorized - Unwanted • Games, Shareware • Unlicensed Software • Software user should not have access to

22. AV AS PFW Endpoint Scenarios: Unknown Malware Threats Keylogger Spyware Worms Virus Bots Trojans UNKNOWN MALWARE Malware Vectors Digital Assets Traditional Security Solutions

23. AV AS PFW Endpoint Scenarios: Unauthorized Software Kazaa Yahoo IM E-Donkey World of App Trillian AOL IM Napster UNAUTHORIZED SOFTWARE Digital Assets Traditional Security Solutions

24. 3. ASSIGN RIGHTS TO EXECUTE 2. ORGANIZE FILES INTO GROUPS Admin Tools Control Panels Internet Explorer Signature files 1. COLLECT MS Office Accounting Soft. Etc. Application Control – The Sanctuary ApproachAssign and Go • Accounting • Sales People • Network Admin. • Support team • Users from Dept. A • External people, Etc Active Directory Local System Services Individual User User Groups Administrator Remote and local users can now only run authorized executable files they are Allowed to when accessing organization’s PCs, Servers, and/or Terminal Services environment 0. IDENTIFY EXE SOURCES Operating Systems USE SFD’s Standard Software Server Software Customer Specific Applications Specific Server Application Software

25. 0x4e4f36b5b2cf0c9ec85372ff8a7545 3x4e4f36b5b2cf0c9ec85372ff8a7545 1x4e4f36b5b2cf0c9ec85372ff8a7545 2x4e4f36b5b2cf0c9ec85372ff8a7545 3x4e4f36b5b2cf0c9ec85372ff8a7545 3x4e4f36b5b2cf0c9ec85372ff8a7545 OK 4x4e4f36b5b2cf0c9ec85372ff8a7545 File executes Authenticated Execution Users, Users Terminal Accounts or Services Kernel Driver List of centrally authorized files signatures File signature generation using SHA-1 hash Application Execution Request 3x4e4f36b5b2cf0c9ec85372ff8a7545 Comparison with list of authorized files signature Authorization Log

26. 3x4e4f36b5b2cf0c9ec85372ff8a7545 No Matching Signature NO File execution is denied Authenticated Execution Users, Users Terminal Accounts or Services Kernel Driver List of centrally authorized files signatures File signature generation using SHA-1 hash Application Execution Request 0x4e4f36b5b2cf0c9ec85372ff8a7545 3x4e4f36b5b2cf0c9ec85372ff8a7545 1x4e4f36b5b2cf0c9ec85372ff8a7545 Comparison with list of authorized files signature 2x4e4f36b5b2cf0c9ec85372ff8a7545 3x4e4f36b5b2cf0c9ec85372ff8a7545 Authorization 4x4e4f36b5b2cf0c9ec85372ff8a7545 Log

27. Summary • The model of being reactive is not working and forcing IT professional to be proactive to combat emerging threats. Security practices have focused on the endpoint due to the evolution of the security attacks.

28. Questions?

29. Thank you