95% of all attacks on the enterprise network are the result of successful spearphishing -allen...

16
95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

Upload: brenda-maxwell

Post on 26-Dec-2015

216 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

95% of all attacks on the enterprise network are the result of successful

spearphishing-Allen Paller

Director of Research, SANS Institute

1NetworkWorld

Page 2: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

Nearly 1 in 5 users will click on a link within a phishing

emailVerizon Data Breach

Investigation Report, 2014

2

Page 3: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

88% of HR and Finance clicked on at

least one phishing email

3McAfee Phishing Quiz, 2014

Page 4: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

Phishing Deceives the Masses

McAfee Phishing Quiz, 2014

On average:

250,00 new phishingURLs are identified each quarter

57,000 business users Only 6% worldwide correctly classified all emails as

Legitimate Phishingor

4

Page 5: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

Targeted Phishing Attacks Continue to Prevail

5

Sophistication and Delivery of Malware Increase Unabated

Delayed malware dropOne time URLs Recon for

Targeted Attacks

Page 6: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

Anatomy of an Attack

6

How It Happens

Recon Data Theft

ExploitDeliver

O365 Exchange Online 11

10

KaBoom

1

SECONDS AFTER

DELIVERY

Recipient

Attack5

Page 7: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

What Customers Are Asking

7

Security for Office 365 Exchange Online

Uptime?

Threats delivered via embedded

URLs?

How can I gain visibility into phishing attacks my

users fell for?

Data Exfiltration?

How susceptible are my users?

Do I need

additional security?

Page 8: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

Advanced Security for O365 Exchange Online

Targeted Attack Protection• Phishing protection• Detects real-time URL malware threats with ClickProtect• Customizable warning pages• Built-in DLP technology

Faster and Reliable Protection• Breadth of cloud intelligence sources• Threat response times• Email continuity

Flexibility• Advanced security for Exchange Online, Hybrid

Exchange, onsite Exchange• Deploy any way you want, when you want• Hybrid deployment options with single management

and reporting console

Email Protectionwith

Page 9: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

Data Exfiltration Prevention

9

Preventing the last step of a targeted attack

Source: Data Breach Today

Compliance Templates

Document Fingerprinting

Regular Expressions

Scans 300+ file types

Built-in DLP provides:

Dec 1H’14 2H’14

150M

Peop

le A

ffect

ed

110M104M

4.6M12M

800K1.5M

145M

20.7M

4.5M 5M

868K

76M

310K 338K

Page 10: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

Granular DLP and Encryption Controls for Hosted Mailboxes

10

Helps Achieve Compliance and Prevent Exfiltration

• Fully compatible integration

• Includes:• Extensive, robust templates• More granularity per template• File fingerprinting • Policy-driven encryption

Allow filtering email from

Microsoft Office 365

Google Apps for Work

Page 11: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

• 60 days of rolling storage

• Web-based access to email during outage

• Post-outage email activity release and synchronization

11

Email Continuity Ensures Hosted Mailbox UptimeAutomatic service engagement when outage is detected

39% are concerned they will not be able to access cloud applications

Frost & Sullivan, The Hidden Truth Behind Shadow IT

Page 12: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

ClickProtect

12

Scan-time and Click-time URL Protection• Combats spear phishing and

links to malware

• Educates users

• Fully customizable

Scan Time• URL reputation check

• Rewrites delivered URLs

Click Time• URL reputation check

• Enterprise web security scanning for 0-hour malware

• Safe Preview

Any device,

anywhere, anytime

Is the URL safe?

Is the URL still

safe?

Page 13: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

ClickProtect for Embedded URL Protection

13

Customizable Template Reinforces Awareness

AV-Test.org

Enterprise Web Security

McAfee Blue Coat Websense Cisco

95%

74%

58%

25%

Zero Day Protection Rate

Page 14: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

ClickProtect for Embedded URL Protection

14

Customizable Template Reinforces Awareness

Unmasked Web Address

http://www.funshion.com

McAfee GTI® Web Reputation: Unverified

McAfee GTI® Web Category: Entertainment, Streaming Media

Enterprise Web Security

Unmasks URL

Page 15: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

ClickProtect for Embedded URL Protection

15

Customizable Template Reinforces Awareness

Is that your destination site?

Enterprise Web Security

Unmasks URL

Safe Preview

Page 16: 95% of all attacks on the enterprise network are the result of successful spearphishing -Allen Paller Director of Research, SANS Institute 1 NetworkWorld

ClickProtect for Embedded URL Protection

16

Policy Configuration – Custom Warnings