Upload File

phishing, impersonation, and malware · cds2018-solns-s6-email security – phishing,...

  • Home
  • Documents
  • Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created
23
OCTOBER 1 – 4, 2018 | WASHINGTON, D.C. Phishing, Impersonation, and Malware Defending Email Against Today’s Advanced Threats

Upload: others

Post on 06-Jun-2020

3 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

OCTOBER 1 – 4, 2018 | WASHINGTON, D.C.

Phishing, Impersonation, and MalwareDefending Email Against Today’s Advanced Threats

Page 2: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

DISCLOSUREAny future offering, feature, or related specification that may be referenced in this presentation is for information purposes only, is not a commitment to deliver any offering, technology, functionality or enhancement, and should not be relied on in making purchasing decisions. We reserve the right to modify future product and service plans at any time.

Page 3: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Agenda

3

Email Threat Landscape

FireEye Email Security Progression

Demos• Cloud Edition • FireProof – Email Threat Analysis

Customer Reference

Page 4: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Evolving Email Threat Trends

Phishing Sites

Shift to URLs over malware90% blocked attacks were

malware-less1

Go live after passing email security

Spear Phishing

Continued sophistication of

social engineering

ImpersonationSender spoofed attacks

such as CEO fraud17% of all blocked attacks

utilized impersonation tactics1

Malware-less emails may lead to malware1 Source: Internal data January - June 2018

4

Page 5: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Malware-Less versus Malware Attacks

Source: Internal data January - June 2018

5

JANUARY FEBRUARY MARCH APRIL MAY JUNE

MALWARE MALWARE-LESS

of attacks blocked were malware-less90%

▷ Impersonation ▷ CEO fraud ▷ Whaling

▷ Spear phishing ▷ W2 fraud

of attacks blocked contained malware10%

▷ Viruses ▷ Ransomware ▷ Worms

▷ Spyware ▷ Trojan horses

Page 6: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Customer Email Security Pain Points

URLs

Multi-StageImpersonation or Imposter

Attachments

6

Page 7: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

How Impersonation Attacks Have Evolved

[email protected] <[email protected]>

[email protected]

7

Page 8: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Impersonation Detectionaka Business Email Compromise threats

Techniques Used to Stop Evolving Inline Attacks

Newly Existing Domains

Looks-Like & Sounds-Like Domains

Reply-to-Address & Message Header Analysis

Friendly Display Name & Username Matching

CEO Fraud Algorithms

8

Page 9: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

9

Impersonation Detections Are Growing

Page 10: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

On the Roadmap – Outbound Detection

§ Scan outgoing email

– Filter spam and viruses (AVAS)– Detect advanced threats– Apply Smart Rules

§ Detect compromised email accounts

– Prevent domain blacklisting

§ Detect advanced threats

– Stop threats coming from network via outgoing email

§ Strengthen inbound filtering

Internet

FireEye Email Security Service

Cloud Email Service/O365

Inbound detection Outbound detection

10

Page 11: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Increased Detections Over Time

Advanced URL Defense v3.0 Release(May 2017)

PhishVision & Skyfeed v3.6 Release(Feb 2018)

11

Page 12: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

ThreadKit Exploit Campaign

FireEye Threat Intelligence

identified large volumes

of phishing emails

FireEye threat researchers

analyzed and tested

ThreadKIt

Reported to FireEye Labs

FireEye Email Security

detections in place

12

1

23

4

Page 13: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

One Source CommunicationsCustomer and Partner Reference

§ Full solution suite including FireEye Email Security and FireEye Helix

§ Increased malware-less threat detection and blocking

– URL rewrites provide better visibility into environment

– Retroactive URL alerts

– Reduced reliance on end user making a choice

§ MSSP with 800 clients – value Cloud Edition portal enhancements

– Create complex policies for message analysis and for multiple domains

§ O365 migrations – won’t implement w/out email security solution

– More is better – MS ATP and other solutions aren’t good enough

– FireEye Threat Intelligence & Email Security – unmatched for stopping evolving threats

13

Page 14: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created
Page 15: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

1

2

3

Cloud Edition Demo

Dashboard

Advanced Threats

Smart Rules (Advanced Custom Rules)

15

Page 16: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

FireProof

Page 17: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

FireProof - Email Threat Analysis

20

Research shows FireEye Email Security deployed behind Microsoft O365 with ATP can improve email threat detection by at least 25%.

Enhance your Office O365 email protection with an easy to set up process that analyzes your delivered email and surfaces threats undetected by your current email security solutions.

Receive a summary and discuss the detailed findings with FireEye’s Office 365 experts.

1

2

3

Stop by the Solution Expo to participate and request your analysis today.4

Page 18: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Email Threat Analysis (Overview)

§ Set up

– Specify delivered email timeframe– Select email count – Designate mailboxes (optional)

§ Authorize Office 365 access – admin credentials needed

§ Receive status emails

§ Get analysis summary

§ Request detailed report discussion with SE

21

Page 19: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Setting up Evaluation (Customer)

22

§ Press “Accept”

Page 20: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Tracking Progress (Customer)

23

§ When the process is completed, the customer receives an email update.

Page 21: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Tracking Progress (Sales and Customer)

24

§ After the Evaluation has been completed, the report is sent to the Sales team in a PDF file.

§ FireEye SE follows up and goes over report.

Page 22: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

©2018 FireEye

Recap

§ Continue investment and innovation to protect users against email threats

§ Our focus

– Be the best at detecting advanced threats, including phishing and impersonation

– Position as a leader in the Secure Email Gateway market§ Visit the CDS Solutions Expo

– Request a FireProof evaluation. Discover enhanced Office 365 email protection.– Questions? … ask our email security experts

§ Contact your account manager to organize a roadmap session

25

Page 23: Phishing, Impersonation, and Malware · CDS2018-Solns-S6-Email Security – Phishing, Impersonation, and Malware Defending Email Against Today's Advanced Threats Final 3_10.2 Created

Thank You


Marshal Security Threats: Spam, Phishing, MalwareMARSHAL SECURITY THREATS: SPAM, PHISHING, MALWARE - DECEMBER 2007 MARSHAL TRACE REPORT 4 as the spam-sending botnets sought to expand

Data Privacy and Cybersecurity for Tax Professionals · • Identify and protect high-risk data. • Recognize the signs of phishing, spear-phishing, ransomware, malware, and other

Gone Phishing: 2015 Global Malware Round Up Report€¦ · professionals manage to quarantine and eliminate one type of malware, more dangerous malware alternatives are being bred

Fraud Risk and Control in the New Normal Age · WIFI hotspots Business impersonation techniques Phishing attempts Evolving financial crime ... Identify potential sources of electronic

New Developments on Brazilian Phishing Malware€¦ · Malware 4 –Ransomwareis all about Money The malware locks the files and applications through a “ GetActiveWindow” call;

Data Breaches, Phishing, or Malware? Understanding the ... · Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials Kurt Thomas⋄ Frank Li† Ali Zand⋄

Best Practices for Dealing with Phishing and Next ... Practices … · Malware being introduced from employees’ home computers 17% Malware being introduced from employees’ use

Phishing - University of Arizonacollberg/Teaching/466-566/2012/Reso… · 4 Pharming 5 Malware 6 Phishing through PDF 7 References. Malware Malware: a piece of software developed

How to Build Efficient Security Awareness Programsfiles.brucon.org/2017/006_Vlad_Styran_Security_Awareness_v3.pdf · Attack methods: phishing, impersonation, elicitation, phone pretexting,

GUDURU PRAVEEN REDDY.NET IMPERSONATION. Contents Introduction Impersonation Enabled Impersonation Disabled Impersonation Class Libraries Impersonation

Spear Phishing Defense Framework - PhishLabs · A strategic, end-to-end model for managing and improving protection against spear phishing attacks Security Awareness Training Malware

Malware & Phishing Intelligence

URLCheck Malware and Phishing URLs agggg gregator · URLCheck Malware and Phishing URLs agggg gregator by ... (nigerian scam, lottery, etc) 5. ... phishing protection“ published

Viruses, Spyware , Malware and Phishing

What is Bad Email? Spam, Phishing, Scam, Hoax and Malware distributed via Email

DigiCert Phishing White Paper: A Primer on What Phishing ...docs.apwg.org/.../DigiCert_Phishing_White_Paper.pdf · click on a link to his Facebook account. ... phishing malware propagates

PHISHING THREAT MALWARE REVIEW - Cofense · PHISHING THREAT AND MALWARE REVIEW: 2019 Figure 1: As identified by the Cofense Phishing Defense Center. PHISHING THREATS BY TYPE October

Phishing (main malware phishing cases in Poland) Tomasz Sawiak tomasz.sawiak (at) safecomp.com tomasz.sawiak (at) safecomp.com

Threat intelligence, detection and response @ scale Prevention Monitoring / Visibility Response Delegating Trust Summary 2 ... Online banking 8 Adware Phishing Malware Exploit. Malware

Phishing, Impersonation, and Malware - FireEye · 2018-12-10 · Enhance your Office O365 email protection with an easy to set up process that analyzes your delivered email and surfaces

Hard Truths about Account Takeover & Strategies to Defend ......Use of stolen creds Malware: Export data Malware: C2 Social: Phishing Malware: Spyware/keylogger Incident Count Palo

Phishing is More Common and More Sophisticated · with a phishing email, but email hacking is much more than phishing and launching malware. Join Roger A. Grimes, KnowBe4’s Data-Driven

Google Chrome: How to protect from phishing and malware

Cisco Connect Dubrovnik · 2000s 2015 Spam Email Malware Spear Phishing Social EngAttacks Business Email Compromise 2017 Content Deception Identity Impersonation Zero Day Attacks

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2013

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2011

Phishing, Malware and DDoS Cyber Attacks Likely to Increase Over Next 12 Months

Turning on network protections for Web Fraud · F5 Agility 2014 2 Fraud and malware remains a challenge Malware/Fraud Statistics Mobile Malware (MM) Phishing attacks 15% increase

Protecting Your Network from Malware - Akamai...Protecting Your Network from Malware The threat landscape is becoming increasingly hostile. Malware and ransomware campaigns, phishing

Using Deep Networks and Transfer Learning To Address ... · Transfer Learning Multi-class: friend, 419 scam, malware, credential phishing, phishing training, propaganda, social engineering,

Online ID Theft, Phishing, and Malware

Deep Malware Analysis - Joe Sandbox Sandbox Cloud Feature... · Sandbox Cloud Deep Malware Analysis Classification Ransomware Spreading Phishing Banker Adware Trojan / Bot Spyware

SPEAR PHISHING - dandh.com...SPEAR PHISHING VS PHISHING Spear phishing and phishing attacks both leverage impersonation to commit fraud. The difference between the two is that spear

Data sheet AntiFraud Protect your brand from phishing and malware … · 2020-07-16 · Protect your brand from phishing and malware attacks Data sheet | AntiFraud Overview For brand

Detecting & Avoiding Scamsswestcc.org/resources/DetectingScamsPresentation.pdf · Phishing and Malware Phishing The criminal tries to learn information by masquerading as a legitimate