Upload File

the malware attack "fan-out" effect in the cloud

27
Netskope © 2015, Optiv Security Inc. © 2015 The Malware Attack “Fan-out” Effect in the Cloud Krishna Narayanaswamy, Chief Scientist, Netskope

Upload: netskope

Post on 11-Jan-2017

721 views

Category:

Technology


0 download

Report

TRANSCRIPT

Page 1: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

The Malware Attack “Fan-out” Effect in the Cloud

Krishna Narayanaswamy, Chief Scientist, Netskope

Page 2: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

4.1%We looked at hundreds of enterprises’ sanctioned

apps

Page 3: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Page 4: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Page 5: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

UNSANCTIONED

SANCTIONED

Page 6: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

10%

70%

20%

Mos

tly U

nsan

ctio

ned

Sanc

tione

d

IT-led

Business-led

User-led

Page 7: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

At least two dozen ecosystem apps per “anchor tenant” app

Page 8: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

IT estimates 30% business data is in cloud…

With ⅓“unknown”

Page 9: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

INSERT A CLOUD GRAPHIC

What role does the cloud play in perpetuating malware?

Page 10: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Page 11: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Infiltration and lateral movement phases of APTs

Page 12: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Other effects of malware

Presentation.pptxPO.docxFinancials.xlsxBusinessPlan.pptx

Presentation.pptxPO.docxFinancials.xlsxBusinessPlan.pptx

Presentation.pptxPO.docxFinancials.xlsxBusinessPlan.pptx

Presentation.pptxPO.docxFinancials.xlsxBusinessPlan.pptx

X&4$#(@!h~&6z^*ub$4)!~+0$%^&vb@!bw@$59&*@!!+=

X&4$#(@!h~&6z^*ub$4)!~+0$%^&vb@!bw@$59&*@!!+=

X&4$#(@!h~&6z^*ub$4)!~+0$%^&vb@!bw@$59&*@!!+=

X&4$#(@!h~&6z^*ub$4)!~+0$%^&vb@!bw@$59&*@!!+=

Page 13: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

The cloud malwareattack fan-out in action

Page 14: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Page 15: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Page 16: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Page 17: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Page 18: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

ROBUST CIPHERS RSA-2048, AES-128

MEMORY ONLY KEY STORAGE

ENCRYPT PORTIONS OF FILES FOR

SPEED

ENCRYPT IMPORTANT FILES

FIRST

FILE NAMES SCRAMBLED TO

THWART DECRYPTION

Page 19: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Page 20: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

Page 21: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

‣BACK UP versions of critical data

‣DETECT malware in sanctioned apps by scanning content-at-rest

‣DETECT incoming malware from sanctioned and unsanctioned apps

‣LOOK for anomalous behavior indicative of malware

‣MONITOR for data exfiltration

INREAL-TIME

Page 22: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

1. BACK UP CONTENT; ENABLE

“TRASH”v3 v2 v1

Ensure critical content is backed up and that prior versions are easily available

in the event of a fan-out attack involving ransomware. Enable “trash”

and set default purge to 1+ weeks.

Page 23: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

2. DETECT MALWARE IN SANCTIONED

APPS

Detect and quarantine malware in sanctioned apps. Detonate in sandbox.

Ensure full eradication through the cloud, network, and endpoint.

?

Page 24: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

3. DETECT INCOMING MALWARE

Detect and quarantine incoming malware in real-time. Detonate in sandbox. Ensure full eradication through the cloud, network, and

endpoint.

??

?

Page 25: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

4. LOOK FOR ANOMALIES

Detect anomalous behavior in real-time that indicates malware

Presentation.pptxPO.docxFinancials.xlsxBusinessPlan.pptx

X&4$#(@!h~&6z^*ub$4)!~+0$%^&vb@!bw@$59&*@!!+=

Page 26: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

5. MONITOR FOR DATA

EXFILTRATION

Detect sensitive data exfiltration in real-time

1 0 1 1 0 1 1 0 0 1 0 1

1 0 1 1 0 1 1 0 0 1 0 1

SENSITIVE

1 0 1 1 0 1 1 0 0 1 0 1 ‣Enterprise DLP

‣Data upload‣Sanctioned or

unsanctioned

Page 27: The Malware Attack "Fan-out" Effect in the Cloud

Netskope © 2015, Optiv Security Inc. © 2015

THANK YOU!


CyRiM Report 2019 Bashe attack Global infection by contagious malware · 2019-01-29 · 3 Bashe attack – Global infection by contagious malware Key contacts Trevor Maynard Head

BLADE, An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

Reverse Engineering Mac Malware - SANS · PDF fileReverse Engineering Mac Malware SANS DFIR Summit ... Mobile, Malware, ... General Forensics Nerd & Mac Fan Girl

1 Figure 4-16: Malicious Software (Malware) Malware: Malicious software Essentially an automated attack robot capable of doing much damage Usually target-of-opportunity

BLADE: An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

Mobile Malware Visual Analytics and Similarities of Attack ... · WHITE PAPER • Mobile Malware Visual Analytics and Similarities of Attack Toolkits Page 4. We chose DroidKungFu

Anatomy of a Malware Attack: The New Malware Ecosystem

Introduction to Malicious Code (Malware) - Chalmers Maliciou… · Introduction to Malicious Code (Malware) ... • But what type of content is safe? ... Salami attack Usesseemingly

THINK APP SECURITY FIRST HOW MALWARE CAN STEAL YOUR … · HOW MALWARE CAN STEAL YOUR DATA—AND WHAT YOU CAN DO TO STOP IT MALWARE MITM ATTACKS In this specialized attack, a user

Malware Images: Visualization and Automatic Classification · 2020-03-11 · malware. Hence, difficult to prevent a zero day attack. • Characterization: At present, the characterization

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow I: Attack Introduction Cliff Zou Spring 2012

BLADE : An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

Analysis of the First Malware to Attack a Power Grid

BLADE: An Attack-Agnostic Approach for Preventing Drive-By Malware Infections, L. Lu et al. BLADE: An Attack-Agnostic Approach for Preventing Drive-By

Enabling Distributed Threat Analysis: Common Attack Patterns and Malware Characterization

Malware and Attack Technologies Knowledge Area Issue 1 · 2019-11-10 · Malware and Attack Technologies Knowledge Area Issue 1.0 Wenke Lee Georgia Institute of Technology EDITOR

Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

MALWARE - cybok.org · Malware and Attack Technologies Wenke Lee January 2019 INTRODUCTION Malware is short for ’malicious software’, that is, any program that performs malicious

An emerging threat Fileless malware: a survey and research ... · detection system. The fileless malware attack is catastrophic for any enterprise because of its persistence, and

Frequent Sequential Attack Patterns of Malware in Botnets Nur Rohman Rosyid

Financial Aspects of Network Security: Malware and Spam › en › ITU-T › Workshops-and... · Malware attack trends Overall increases Monthly growth ¾Trojans, rootkits slowing

Forensic Challenge 2010: Scan 1: Attack Trace Solution€¦ · INCIDENT OVERVIEW The network traffic captured in the file attack-trace.pcap relates to an automated malware attack

Defending Web Infrastructures from Malware Attacks · PDF filekrona — up to £580000” by a single Malware attack ... *Ref. ... Banking Malware Attacks resemble

Stopping Ransomware and Polymorphic Malware Solution Brief · Malware needs an attack vector to establish its presence on an endpoint. After presence is established, malware stays

Malware, Zero Day and Advanced Attack Protection Analysis Zscaler Internet Security ... · 2017-01-06 · FireEye Web MPS 1310 Malware Detection System Solution FireEye Web MPS 1310

1 The Attack and Defense of Computers Dr. 許 富 皓. 2 Malware

Analysis of Malware Dns Attack on the Network Using Domain

2013 m sc econstructing the cryptanalytic attack behind the flame malware

Maximum Damage Malware Attack in Mobile Wireless Networks

CODE BLUE 2014 : Drone attack by malware and network hacking by DONGCHEOL HONG

CAP6135 Malware & Software Vulnerability On Limitations of ...cs.ucf.edu/~czou/CAP6135-14/PaperPresentation/LRPS.pdf · Brute Force attack • The power of brute force attack is given

Advanced Systems Security: Malware Detectiontrj1/cse544-s18/slides/cse544-malware.pdfSystems and Internet Infrastructure Security (SIIS) Laboratory Page Malware • Attack code supplied

Forecasting Malware Capabilities From Cyber Attack Memory … · Forecasting Malware Capabilities From Cyber Attack Memory Images Omar Alrawi*, Moses Ike*, Matthew Pruett, Ranjita

ATTACK LANDSCAPE H1 2020 - blog-assets.f-secure.com...Attack Landscape H1 2020 5 Malware distribution methods 7 Email

Modeling the Propagation of Trojan Malware in Online ...the malware from their systems, as in the case of a large-scale attack on Facebook caused by a malware named Magnet [9]. All