Le soluzioni e i servizi IBM per la sicurezza

Transcript

1 Le soluzioni e i servizi IBM per la sicurezza Security per una Nuova Era di Computing Luca Dalzoppo IBM Security luca_dalzoppo@it.ibm.com Maggio 2016

2 L Evoluzione del Crimine 2

3 3

4 Gli aggressori violano i controlli di sicurezza tradizionali tutti i giorni Milioni di record violati Miliardo di record violati 2015 Senza precedenti! Violati target di alto valore come mai Tempo medio per individuare un APT Costo medio di una violazione in USA $6.5M Costo medio di una violazione in ITALIA 1.98M 256 giorni V Source: 2015 Cost of Data Breach Study, Ponemon Institute 4

5 Le nuove tecnologie introducono nuovi rischi 44 % 33 % delle aziende non 11.6M testa le mobile apps di dispositivi mobile dei security leader si aspetta che uno tra i maggiori cloud provider avrà una grave violazione di security nel prossimo futuro Source: November 2014, Security for the Cloud and on the Cloud, Security Intelligence.com Il Mobile malware ha colpito le pratiche tradizionali di security non sono più sostenibili 85 security tools da 45 vendors Source: IBM Client Example 1.5M posizioni per la Security aperte e non soddisfatte entro il 2020 V

6 Pensiamo alla Security come ad un Sistema Immunitario Malware protection Incident and threat management Identity management Device management Data monitoring Transaction protection Firewalls Access management Entitlements and roles Data access control Privileged identity management Security research Sandboxing Endpoint patching and management Log, flow and data analysis Vulnerability assessment Criminal detection Antivirus Network visibility Content security Application security management Anomaly detection Application scanning Virtual patching Fraud protection 6

7 Potenziamo la Security usando la Intelligence e l Integrazione Global Threat Intelligence Incident and threat management Firewalls Sandboxing Virtual patching Network visibility Antivirus Endpoint patching and management Malware protection Transaction protection Device management Content security Application scanning Application security management Security Intelligence Security Research Log, flow and data analysis Anomaly detection Vulnerability assessment Fraud protection Criminal detection Data monitoring Data access control Cloud Consulting Services Managed Services Privileged identity management Entitlements and roles Access management Identity management 7

8 Bloccare le minacce avanzate Security Intelligence Security research Cloud 8

9 Prevenire attacchi dall interno Security Intelligence Security research Cloud 9

10 Supportare la trasformazione verso il Mobile Security Intelligence Security research Cloud 10

11 IBM Security Strategy SUPPORTARE l agenda del CISO CISO, CIO, Linee di Business Strategia e leadership Trasformazioni rapide Soluzioni integrate INNOVARE considerando i key trends Advanced Threats Compliance Mandatorie Cloud Carenza di Skill Mobile e Internet of Things LEADER in segmenti selezionati IBM Security Capability Framework Strategy, Risk and Compliance Cybersecurity Assessment and Response Security Intelligence and Operations Advanced Fraud Protection Identity and Access Management Data Security Application Security Network, Mobile and Endpoint Protection Advanced Threat and Security Research 11

12 IBM per proteggere contro nuove e complesse sfide alla sicurezza OTTIMIZZARE IL PROGRAMMA DI SICUREZZA Utilizzare gli esperti per modernizzare security, ridurre le complessità e contenere i costi BLOCCARE LE MINACCE AVANZATE Usare analytics e gli insight per una difesa più semplice ed integrata PROTEGGERE GLI ASSET CRITICI Utilizzare controlli sensibili al contesto per impedire l'accesso non autorizzato e la perdita di dati PROTEGGERE IL CLOUD ED IL MOBILE Usare la trasformazione dell IT per costruire una nuova, robusta postura di sicurezza 12

13 OTTIMIZZARE IL VOSTRO PROGRAMMA DI SICUREZZA Utilizzare gli esperti per modernizzare security, ridurre le complessità e contenere i costi IBM Vi può aiutare a Valutare e trasformare il vostro approccio alla sicurezza Costruire metodologie di sicurezza di nuova generazione Avere aiuto da esperti worldwide 24x7x365 13

14 Management, monitor e protezione per tutto l arco della giornata Protegge reti, server ed endpoint Firewall Management Unified Threat Management Intrusion Detection and Prevention System Management Managed Protection Services Secure Web Gateway Management Malware Defense Management Una migliore sicurezza per gli asset informative per la difesa da attacchi Internet Riduzione degli investimenti in security e dei costi di gestione Una migliore gestione delle compliance Miglioramento dell uptime dei sistemi e delle loro performance Gestione semplificata di molteplici apparati di sicurezza IBM Managed Security Services OTTIMIZZARE IL VOSTRO PROGRAMMA DI SICUREZZA 14

15 Accesso immediato a incident response ed a competenze forensi Incident Planning Proactive Preparation Periodic Reviews Incident Triage Containment, Eradication and Recovery Post-Incident Analysis Copertura 24h per aiutare i clienti a combattere le minacce, per il recupero più veloce e l analisi forense IBM Emergency Response Services OTTIMIZZARE IL VOSTRO PROGRAMMA DI SICUREZZA 15

16 BLOCCARE LE MINACCE AVANZATE Usare analytics e gli insight per una difesa più semplice ed integrata IBM Vi può aiutare a Difendersi dalle frodi web e la criminalità informatica Prevenire attacchi mirati in real-time Rilevare minacce con la Security Intelligence 16

17 Prevenire attacchi mirati in real-time Smarter Prevention Trusteer Apex Endpoint Malware Protection Prevent malware installation and disrupt malware communications IBM Security Network Protection XGS Prevent remote network exploits and limit the use of risky web applications IBM Guardium Data Activity Monitoring Prevent remote network exploits and limit the use of risky web applications Open Integrations Security Intelligence IBM Security QRadar Security Intelligence Discover and prioritize vulnerabilities Correlate enterprise-wide threats and detect suspicious behavior Continuous Response IBM Security QRadar Incident Forensics Retrace full attack activity, Search for breach indicators and guide defense hardening IBM Unified Endpoint Management Automate and manage continuous security configuration policy compliance IBM Emergency Response Services Assess impact and plan strategically and leverage experts to analyze data and contain threats Global Threat Intelligence Ready for IBM Security Intelligence Ecosystem Share security context across multiple products 100+ vendors, 400+ products IBM X-Force Threat Intelligence Leverage threat intelligence from multiple expert sources BLOCCARE LE MINACCE AVANZATE 17

18 Interrompere la procedura di attacco con le difese preventive Sull Endpoint Previene l installazione di malware, controlla i canali di comunicazione e previene la Perdita di credenziali Sulla Rete Previene l utilizzo di exploits mutati, blocca l active beaconing e le app malevoli All Accesso ai Dati Previene gli errori di uso, l intrusione ed il furto di dati sensibili Trusteer Apex Malware Protection IBM Security Network Protection XGS IBM Guardium Data Activity Monitoring IBM Consulting and Managed Security Services BLOCCARE LE MINACCE AVANZATE 18

19 Continuo monitoraggio dell'attività di tutta l'organizzazione Analisi Pre-Attacco Prevedere e stabilire le priorità delle Vulnerabilità di sicurezza prima deglii avversari Real-time Attack Analytics Rilevare attività ed anomalie al di fuori dal normale comportamento dei sistemi IBM Security QRadar Security Intelligence Platform IBM Security QRadar Vulnerability Manager IBM Security QRadar SIEM IBM Security Services IBM Managed SIEM BLOCCARE LE MINACCE AVANZATE 19

20 Indagare rapidamente, rispondere e imparare dalle violazioni Post-Attack Incident Forensics Ridurre il tempo necessario per scoprire cosa è successo e quando Real-time Incident Response Garantire il rispetto continuo delle compliance sull endpoint Emergency Response Services Prepararsi e Resistere alle Violazioni della sicurezza IBM Security QRadar Incident Forensics IBM BigFix IBM Emergency Response Services IBM Cyber Security Assessment and Response Services BLOCCARE LE MINACCE AVANZATE 20

21 PROTEGGERE GLI ASSET CRITICI Usare la trasformazione dell IT per costruire una nuova, robusta postura di sicurezza IBM Vi può aiutare a Valutare e trasformare il vostro approccio alla sicurezza Identificare e proteggere i dati sensibili Gestire la sicurezza delle applicazioni 21

22 Gestione dell Identità e degli Accessi consapevole delle minacce Identity Management Identity Governance ed Intelligence User Lifecycle Management Privileged Identity Control Access Management Adaptive Access Control e Federation Application Content Protection Authentication and Single Sign On Directory Services IBM Security Identity and Access Management Solutions and IBM Security Services Gestire e controllare le identità digitali nell'era del cloud e mobile PROTEGGERE GLI ASSET CRITICI 22

23 Identificare e proteggere i dati sensibili Identificare i Rischi Scoprire e classificare i dati sensibili Valutare le vulnerabilità del database Ardenizzare i Repository Criptare e mascherare i dati sensibili Archiviare / ripulire dati dormienti Revocare i diritti dormienti Controllare gli Accessi Monitor e allarme per attacchi in real-time Identificare attività sospette Produrre report dettagliati per compliance Proteggere i Dati Prevenire accesse non autorizzati a dati sensibili Irrobustire il controllo delle modifiche IBM Guardium Data Protection and IBM Critical Data Protection Program Proteggere i gioielli della corona e proteggere il Vostro Marchio PROTEGGERE GLI ASSET CRITICI 23

24 Gestire la sicurezza delle applicazioni Dynamic Application Scanning Identificare e porre rimedio alle vulnerabilità in applicazioni live Static Application Scanning Indirizzare la sicurezza delle applicazioni dal primo giorno di produzione Application Security Management Utilizzare una singola console per la gestione dei test delle applicazioni, il reporting e le policy IBM Security AppScan and IBM Application Security Services Key Integrations Network Security Intelligence Mobile PROTEGGERE GLI ASSET CRITICI 24

25 PROTEGGERE IL CLOUD ED IL MOBILE Usare la trasformazione dell IT per costruire una nuova, robusta postura di sicurezza IBM Vi può aiutare a Ottenere visibilità e controllo del Cloud Proteggere la Azienda mobile e gli endpoint 25

26 Ottenere visibilità e controllo del Cloud EMPLOYEES RISKY APPS BYOD ON PREM APPROVED APPS MOBILE DETECT CONNECT PROTECT Discovery and Visibility Identity and Access Control Cloud Event Correlation Threat Prevention Policy Enforcement PROTEGGERE IL CLOUD ED IL MOBILE 26

27 Gestione unificata degli endpoint Smartphones & Tablets Mobile Devices Mobile Apps PC s, Macs, POS, ATMs In rete e fuori dalla rete SaaS, On-premise, o MSP Compliance più veloci Comprehensive Security Contenimento del TCO Servers Fisici e Virtuali Patch Management Lifecycle Management Power Management Core Protection Security & Compliance SW Use Analysis Server Automation Mobile Management Trovare e Risolvere problemi in pochi minuti su tutti gli endpoint, dentro e fuori dalla rete Aggiungere nuove funzioni in pochi minuti senza risorse addizionalio infrastrutture IBM BigFix e MobileFirst Protection MaaS360 PROTEGGERE IL CLOUD ED IL MOBILE 27

28 Protezione avanzata degli endpoint Threat and Risk Reporting Vulnerability Mapping and Critical Event Reporting Advanced Threat Analysis and Turnkey Service Credential Protection Exploit Chain Disruption Malware Detection and Mitigation Lockdown for Java Malicious Communication Prevention Prevent reuse on non-corporate sites Protect against submission on phishing sites Report on credential usage Block anomalous activity caused by exploits Zero-day defense by controlling exploit chain Detection and mitigation of massively distributed APTs Cloud-based detection of known threats Block high-risk actions by malicious Java applications Administer the trust level reducing user disruption Global Threat Research and Intelligence Global threat intelligence delivered in near-real time from the cloud IBM Trusteer Apex Malware Protection Block malware communication Disrupt command and control Protects against data exfiltration PROTEGGERE IL CLOUD ED IL MOBILE 28

29 IBM Security quale Sistema immunitario per i sistemi informativi Global Threat Intelligence QRadar Incident Forensics QRadar Risk Manager Network Protection XGS SiteProtector BigFix Trusteer Apex zsecure IBM MaaS360 Trusteer Pinpoint QRadar SIEM Trusteer Mobile AppScan DataPower Web Security Gateway Security Intelligence QRadar Log Manager QRadar Vulnerability Manager Trusteer Rapport IBM Security Research Guardium Key Lifecycle Manager Cloud Cloud Security Enforcer Consulting Services Managed Services Privileged Identity Manager Access Manager Identity Manager Identity Governance and Intelligence 29

30 Come gestire in maniera integrata un incidente: Introduciamo la piattaforma Resilient Systems 30

31 Come gestire in maniera integrata un incidente: Introduciamo la piattaforma Resilient Systems 31

32 Come gestire in maniera integrata un incidente: Introduciamo la piattaforma Resilient Systems SECURITY MODULE Industry standard workflows (NIST, SANS) Threat intelligence feeds Organizational SOPs Community best practices 32

33 Come gestire in maniera integrata un incidente: Introduciamo la piattaforma Resilient Systems ACTION MODULE Automate processes Enrich incident details Gather forensics Enact mitigation 33

34 Come gestire in maniera integrata un incidente: Introduciamo la piattaforma Resilient Systems PRIVACY MODULE Global breach regulations Contractual obligations 3rd party requirements Organizational SOPs Privacy best practices 34

35 Come gestire in maniera integrata un incidente: Introduciamo la piattaforma Resilient Systems 35

36 Una nuova era per la Security Moats, Castles Intelligence, Integration Cloud, Collaboration, Cognitive 36

37 Cloud Il governo delle informazioni e degli accessi è fondamentale EMPLOYEES RISKY APPS BYOD ON PREM APPROVED APPS MOBILE IBM Security Cloud Enforcer 37

38 Collaboration 700+ TB di informazioni di Security aggiornate in tempo reale condivise gratuitamente 38

39 Collaboration Estensioni delle applicazioni per migliorare la visibilità, l integrazione e la produttività 39

40 Evolvere alla Cognitività Elaborazione del linguaggio naturale per sostenere l'analista di sicurezza Security che Capisce Ragiona Impara 40

41 IBM is uniquely qualified to help secure a new era of computing INTELLIGENCE and Cognitive Learnings from 35 billion security events managed per day Real-time intelligence and cognition to help detect, assess, stop cyber threats INTEGRATION and Cloud Integrated security services and technology solutions Security for the cloud from the cloud EXPERTISE and Collaboration Security best practices from tens of thousands of engagements Platforms to share threat research and new apps 41

42 2015 IBM Corporation 42

43 2015 IBM Corporation 43

44 Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. THANK YOU Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or capabilities referenced in these materials may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.

45 Learn more about IBM Security No fastest growing worldwide security software vendor industry analyst reports rank IBM Security as a LEADER Visit our website ibm.com/security Watch our videos on YouTube IBM Security Channel K + countries where IBM delivers managed security services clients protected including Read new blog posts SecurityIntelligence.com Join IBM X-Force Exchange xforce.ibmcloud.com 90 % of the Fortune 100 companies Follow us on V Strategy Overview 45

46 IBM Security Portfolio SECURITY TRENDS Advanced Threats Cloud Mobile and Internet of Things Compliance Mandates Skills Shortage IBM Security Capability Framework Strategy, Risk and Compliance Cybersecurity Assessment and Response Security Intelligence and Operations Advanced Fraud Protection Identity and Access Management Data Security Application Security Network, Mobile and Endpoint Protection Advanced Threat and Security Research DELIVERY MODELS Management Consulting Systems Integration Integrated Products Securityas-a-Service Managed Security Partner Ecosystem 46

47 IBM Security Product Portfolio IBM Security Product Portfolio Security Intelligence and Analytics QRadar Log Manager QRadar Security Intelligence QRadar Risk Manager QRadar Vulnerability Manager QRadar Incident Forensics Advanced Fraud Protection Identity and Access Management Data Security Application Security Network, Mobile and Endpoint Protection Trusteer Fraud Protection Suite Trusteer Pinpoint Detect Identity Governance Identity Manager Guardium Activity Monitoring for Databases Guardium Activity Monitoring for Files AppScan Source AppScan Standard Next Generation Network Protection (XGS) SiteProtector (threat management) Trusteer Apex Trusteer Pinpoint Malware Detection Privileged Identity Manager Guardium Data Encryption AppScan Enterprise IBM BigFix Trusteer Rapport Trusteer Mobile SDK and Secure Browser Access Manager Directory Suite Optim Data Privacy Key Lifecycle Manager DataPower Web Security Gateway Security Policy Manager IBM MaaS360 IBM Cloud Security Enforcer zsecure IBM X-Force Research

48 IBM Security Services Portfolio Security Strategy, Risk and Compliance Security Intelligence and Operations Cyber Security Assessment and Response Identity and Access Management Data and Application Security Infrastructure and Endpoint Security Ten Essential Practices Assessment Security Strategy and Planning Security Architecture and Program Design Critical Infrastructure Security Services PCI Compliance Advisory Services Information Security Assessment Security Framework and Risk Assessments Integrated Account Security Management Automated IT Risk Management Cloud Security Strategy Security Operations Consulting SIEM Design and Deploy Managed SIEM Security Intelligence Analyst Advanced Cyber Threat Intelligence Services Intelligent Log Management IBM X-Force Hosted Threat Analysis Service Emergency Response Services Incident Response Planning Active Threat Assessment Penetration Testing Smart and Embedded Device Security APT Survival Kit Consulting and Systems Integration Executive Protection Cybersecurity Awareness Training Managed Security Services Identity and Access Strategy and Assessment Access Management Design and Deploy Multi-factor Authentication Design and Deploy Identity and Access Solution Migration Identity Governance and Administration, Design and Deploy Managed Identity Cloud Identity Cloud Security Services Critical Data Protection Program Data Discovery and Classification Data Security Strategy and Architecture Data Loss Prevention and Encryption Application Security Assessment Application Source Code Security Assessment Managed Data Protection Services for Guardium Hosted Application Security Management Deployment and Migration Staff Augmentation Services Firewall Management Unified Threat Management Intrusion Detection and Prevention System Management Managed Protection Services Secure Web Gateway Management Malware Defense Management Managed Web Defense Hosted and Web Security Hosted Vulnerability Management