IBM Security Systems. Smarter Security per MSP. Giovanni Todaro IBM Security Systems Leader

Transcript

1 IBM Security Systems Smarter Security per MSP Giovanni Todaro IBM Security Systems Leader

2 Le tecnologie Innovative stanno cambiando tutto attorno a noi miliardi di oggetti collegati 1 Miliardo di lavoratori mobile Social business Bring your own IT 2 Cloud e virtualizzazione

3 Attacchi: Motivazioni e raffinatezza sono in rapida evoluzione Sicurezza Nazionale Nazioni Stati Cyberwar Stuxnet Spionaggio, Attivismo Competitors e Hacktivists Aurora Guadagno Finaziario Criminalità Organizzata Zeus Vendetta, Curiosità Insiders and Script-kiddies Code Red 3

4 Il mondo sta diventando più digitalizzato ed interconnesso, aprendo la porta alle minacce emergenti e le perdite di dati DATA EXPLOSION Le organizzazioni continuano a muoversi a nuove piattaforme compresi cloud, virtualizzazione, mobile, social business e molto altro ancora IBM Security Solutions Focus SECURITY INTELLIGENCE CONSUMERIZATION OF IT Con l'avvento di Enterprise 2.0 e di social business, la linea tra le ore di uso personale e professionale, i dispositivi e dei dati è scomparso MOBILE SECURITY EVERYTHING IS EVERYWHERE L'età dei Big Data - l'esplosione di informazioni digitali - è arrivata ed è facilitata dalla pervasività delle applicazioni accessibili da ovunque CLOUD SECURITY ATTACK SOPHISTICATION La velocità e la destrezza degli attacchi è aumentata accoppiata con nuove motivazioni della criminalità informatica ADVANCED THREAT 4

5 IBM Vi porta nell Era della Security Intelligence IBM Security Solutions Le organizzazioni hanno bisogno di un nuovo approccio alla sicurezza che sfrutta l'intelligenza per stare al passo con l'innovazione. IBM Security Intelligence guida il cambiamento da una strategia "point-product" ad un framework integrato di sicurezza aziendale: La traduzione dei dati di Security in conoscenze fruibili: Riduce i rischi ed i costi commerciali Innovazione con agilità e sicurezza Migliora la continuità operativa 13 Miliardi di eventi di Security gestiti giornalmente 1,000 Security Patents 9 Security Operations Centers 600 Security Sales Professionals 11 Laboratori di sviluppo per Soluzioni di Security 5

6 IBM Security: Fornire l'intelligenza, l'integrazione e le competenze in un Framework completo Incrementa la Accuratezza e la consapevolezza nella Security Individuare e prevenire minacce avanzate Una maggiore visibilità e consapevolezza della situazione Condurre indagini complete sugli incidenti Semplicità di Gestione Semplificare la gestione del rischio e il il processo decisionale Migliorare le capacità di controllo e di accesso Intelligence Integration Expertise Riduzione dei costi e complessità Fornire una rapida installazione, un minore TCO lavorando con un unico partner strategico, con un ampio portafoglio integrato 6

7 Fattori chiave che influenzano il business del sw di sicurezza Non è più sufficiente proteggere il perimetro - attacchi sofisticati stanno aggirando le difese tradizionali, le risorse IT sono in movimento al di fuori del firewall, e le applicazioni aziendali ed i dati sono sempre più distribuite su diversi dispositivi 1. Advanced Threats Sofisticati, attacchi mirati, volti a ottenere l'accesso continuo alle informazioni critiche, sono in aumento nella severità e nella ricorrenza. Advanced Persistent Threats Stealth Bots Designer Malware Targeted Attacks Zero-days 2. Cloud Computing La sicurezza è una delle preoccupazioni principali del cloud, in quanto i clienti drasticamente ripensano il modo in cui sono state progettate, distribuite e consumate le risorse IT. 3. Mobile Computing Come gestire dispositivi di proprietà dei dipendenti e garantire connettività alle applicazioni aziendali sono esigenze da indirizzare per i CIO ampliando il supporto per dispositivi mobili. Enterprise Customers 4. Regulations and Compliance Le pressioni normative e le conformità continuano ad aumentare insieme alla necessità di memorizzare i dati sensibili e le aziende diventano suscettibili ai fallimenti di audit. 7

8 Fattori chiave che influenzano il business del sw di sicurezza Non è più sufficiente proteggere il perimetro - attacchi sofisticati stanno aggirando le difese tradizionali, le risorse IT sono in movimento al di fuori del firewall, e le applicazioni aziendali ed i dati sono sempre più distribuite su diversi dispositivi 1. Advanced Threats 2. Cloud Computing Sofisticati, attacchi mirati, volti a ottenere l'accesso continuo alle informazioni critiche, sono in aumento nella severità e nella ricorrenza. La sicurezza è una delle preoccupazioni principali del cloud, in quanto i clienti drasticamente ripensano il modo in cui sono state progettate, distribuite e consumate le risorse IT. BIG DATA Advanced Persistent Threats Stealth Bots Designer Malware Targeted Attacks Zero-days 3. Mobile Computing Come gestire dispositivi di proprietà dei dipendenti e garantire connettività alle applicazioni aziendali sono esigenze da indirizzare per i CIO ampliando il supporto per dispositivi mobili. Enterprise Customers 4. Regulations and Compliance Le pressioni normative e le conformità continuano ad aumentare insieme alla necessità di memorizzare i dati sensibili e le aziende diventano suscettibili ai fallimenti di audit. 8

9 Una migliore protezione contro gli attacchi più sofisticati Misconfigured Firewall 0day Exploit Malicious PDF Spammer Infected Website SQL Injection Botnet Communication Phishing Campaign Vulnerable Server Brute Force Malicious Insider On the Network Across the Enterprise Across the World 9 IBM Advanced Threat Protection IBM QRadar Security Intelligence IBM X-Force Threat Intelligence

10 IBM offre Soluzioni di Security in tutte le aree della Cloud Security IBM protegge contro i rischi di cloud comuni con un ampio portafoglio di soluzioni flessibili e di livelli di sicurezza IBM Security Federated Identity Manager IBM Security Key Lifecycle Manager 10 Protezione contro le minacce, riconquistare visibilità e dimostrare la compliance con il monitoraggio delle attività, il rilevamento delle anomalie e la Security Intelligence

11 Mettere in sicurezza il Mobile Enterprise con le soluzioni IBM 11

12 La strategia IBM per la Data Security Data Security Proteggere i dati in qualsiasi forma, in qualsiasi luogo, da minacce interne o esterne Semplificare i processi di Compliance Ridurre i costi operativi circa la protezione dei dati Governance, Security Intelligence, Analytics Audit, Reporting, and Monitoring Policy-based Access and Entitlements Security Solutions integrate Stored (Databases, File Servers, Big Data, Data Warehouses, Application Servers, Cloud/Virtual..) Data Discovery and Classification over Network (SQL, HTTP, SSH, FTP, ,. ) at Endpoint (workstations, laptops, mobile, ) integrate IT & Business Process 12

13 Un Portfolio completo in tutti i domini di sicurezza Security Ecosystem Partner Programs (3 rd rd party) Standards 13

14 IBM Identity and Access Management - Visione e Strategia Temi Chiave 14 Standardized IAM and Compliance Management Expand IAM vertically to provide identity and access intelligence to the business; Integrate horizontally to enforce user access to data, app, and infrastructure Secure Cloud, Mobile, Social Interaction Enhance context-based access control for cloud, mobile and SaaS access, as well as integration with proofing, validation and authentication solutions Insider Threat and IAM Governance Continue to develop Privileged Identity Management (PIM) capabilities and enhanced Identity and Role management

15 Data Security Vision QRadar Integration Across Multiple Deployment Models Temi Chiave Reduced Total Cost of Ownership Enhanced Compliance Management Dynamic Data Protection 15 Expanded support for databases and unstructured data, automation, handling and analysis of large volumes of audit records, and new preventive capabilities Enhanced Database Vulnerability Assessment (VA) and Database Protection Subscription Service (DPS) with improved update frequency, labels for specific regulations, and product integrations Data masking capabilities for databases (row level, role level) and for applications (pattern based, form based) to safeguard sensitive and confidential data

16 Application Security Vision Temi Chiave 16 Coverage for Mobile applications and new threats Continue to identify and reduce risk by expanding scanning capabilities to new platforms such as mobile, as well as introducing next generation dynamic analysis scanning and glass box testing Simplified interface and accelerated ROI New capabilities to improve customer time to value and consumability with out-of-the-box scanning, static analysis templates and ease of use features Security Intelligence Integration Automatically adjust threat levels based on knowledge of application vulnerabilities by integrating and analyzing scan results with SiteProtector and the QRadar Security Intelligence Platform

17 Infrastructure Protection Endpoint Vision Temi Chiave 17 Security for Mobile Devices Provide security for and manage traditional endpoints alongside mobile devices such as Apple ios, Google Android, Symbian, and Microsoft Windows Phone - using a single platform Expansion of Security Content Continued expansion of security configuration and vulnerability content to increase coverage for applications, operating systems, and industry best practices Security Intelligence Integration Improved usage of analytics - providing valuable insights to meet compliance and IT security objectives, as well as further integration with SiteProtector and the QRadar Security Intelligence Platform

18 Threat Protection Vision Security Intelligence Platform Log Manager SIEM Network Activity Monitor Risk Manager Future Threat Intelligence and Research Vulnerability Data Malicious Websites Malware Information IP Reputation Future Advanced Threat Protection Intrusion Prevention Content and Data Security Web Application Protection Network Anomaly Detection Application Control Future IBM Network Security Temi Chiave Advanced Threat Protection Platform Helps to prevent sophisticated threats and detect abnormal network behavior by using an extensible set of network security capabilities - in conjunction with real-time threat information and Security Intelligence Expanded X-Force Threat Intelligence Increased coverage of world-wide threat intelligence harvested by X- Force and the consumption of this data to make smarter and more accurate security decisions Security Intelligence Integration Tight integration between the Advanced Threat Protection Platform and QRadar Security Intelligence platform to provide unique and meaningful ways to detect, investigate and remediate threats 18

19 X-Force Threat Intelligence: The IBM Differentiator X-Force database il più esteso catalogo di vulnerabilità Web filter database il DB relativo a Siti infetti o malevoli IP Reputation botnets, anonymous proxies, bad actors Application Identification web application information X-Force Threat Intelligence Cloud Vulnerability Research le + aggiornate vulnerabilità e protezioni Security Services gestiscono IPS più di 3000 Clienti 19

20 Security Intelligence: L'integrazione tra silos IT Security Devices Servers & Hosts Network & Virtual Activity Database Activity Application Activity Configuration Info Vulnerability Info Event Correlation Activity Baselining & Anomaly Detection Offense Identification User Activity High Priority Offenses Extensive Data Sources Deep Intelligence + = Exceptionally Accurate and Actionable Insight 20 JK

21 Tutti i domini alimentano la Security Intelligence Correlate new threats based on X-Force IP reputation feeds Hundreds of 3 rd party information sources Guardium Database assets, rule logic and database activity information Identity and Access Management Identity context for all security domains w/ QRadar as the dashboard 21 Tivoli Endpoint Manager Endpoint Management vulnerabilities enrich QRadar s vulnerability database IBM Security Network Intrusion Prevention System Flow data into QRadar turns NIPS devices into activity sensors AppScan Enterprise AppScan vulnerability results feed QRadar SIEM for improved asset risk assessment

22 IBM Qradar La Security Intelligence per la protezione dei Data Center Luigi Perrone IBM SWG - Security Systems & z/os Security

23 Agenda Qradar overview Demo Considerazioni finali 23

24 Perché una Security Intelligence? Risposta alle esigenze di auditing Automazione e snellimento dei processi di raccolta eventi Collezionamento eventi multi-sorgente Gestione e archiviazione sicura dei dati di log (conformità alle normative) Aggregazione dati e correlazione eventi Monitor ed analisi dati per: - identificazione scoperture/anomalie di sicurezza - attivazione allarmi - avvio processi investigativi - report di conformità 24

25 Le fasi che riguardano il ciclo di vita degli eventi 25

26 1 - Un efficiente gestione degli eventi Forte acquisizione, profonda analisi, elevata reattività Registrazione in tempo reale Facilità di configurazione Modalità agent-less Integrazione standard di molteplici dispositivi MONITOR & ASSET DISCOVERY Auto-discovery of log sources Auto-discovery of applications Auto-discovery of assets Auto-grouping of assets Centralized log management VA Scanner nflow sflow qflow jflow Event Flows syslog odbc wmi jdbc ftp/sftp snmp wincollect snare Log Event 26 IDS-IPS Switch-Router Firewall Server Applications Database

27 2 - Un potente motore di elaborazione e correlazione Un potente motore di correlazione analisi investigativa e reportistica avanzata per l identificazione di eventi critici e loro immediata risoluzione Auto-tuning Advanced security analytics Easy-to-use event filtering Auto-detect threats ANALYSYS Thousands of pre-defined rules 27

28 3 - Allarmi in tempo reale e profondità investigativa Controllo chiaro e completo di tutte le attività di rete con monitoraggio in tempo reale Avvisi ed individuazione di eventi insoliti rispetto alla condizione di normalità Analisi investigativa e reportistica avanzata Report di sicurezza standard integrati e di facile personalizzazione ACTIONS & REPORTS Thousands of predefined reports Asset-based prioritization Auto-update of threats Auto-response Directed remediation 28

29 Qradar: le componenti Log Management Risk Management Turnkey log management Upgradeable to enterprise SIEM Predictive threat modeling & simulation Scalable configuration monitoring & audit SIEM Scale Sophisticated event analytics Asset profiling and flow analytics Event processors Network activity processors Network Activity and Anomaly Detection Visibility Network analytics Behavioral and anomaly detection Layer 7 application monitoring Content capture 29

30 30

31 31

32 Next Generation IPS Salvatore Sollami IBM Security Systems Technical Sales and Solutions

33 The challenging state of network security Stealth Bots Targeted Attacks Worms Trojans Designer Malware SOPHISTICATED ATTACKS Increasingly sophisticated attacks are using multiple attack vectors and increasing risk exposure STREAMING MEDIA Streaming media sites are consuming large amounts of bandwidth SOCIAL NETWORKING Social media sites present productivity, privacy and security risks including new threat vectors URL Filtering IDS / IPS IM / P2P Web App Protection Vulnerability Management POINT SOLUTIONS Point solutions are siloed with minimal integration or data sharing 33

34 Network Defense: Traditional solutions not up to today s challenges Current Limitations Threats continue to evolve and standard methods of detection are not enough Streaming media sites and Web applications introduce new security challenges Basic Block Only mode limits innovative use of streaming and new Web apps Poorly integrated solutions create security sprawl, lower overall levels of security, and raise cost and complexity Internet Stealth Bots Worms, Trojans Targeted Attacks Designer Malware Firewall/VPN port and protocol filtering Requirement: Multi-faceted Protection 0-day threat protection tightly integrated with other technologies i.e. network anomaly detection Ability to reduce costs associated with nonbusiness use of applications Controls to restrict access to social media sites by a user s role and business need Augment point solutions to reduce overall cost and complexity Gateway message and attachment security only Everything Else Web Gateway securing web traffic only, port 80 / 443 Multi-faceted Network Protection security for all traffic, applications and users 34

35 The Need to Understand the Who, What, and When Web Category Protection Server Access Control Protocol Aware Intrusion Protection Network Geography Web Applications Non-web Applications Client-Side Protection Reputation Botnet Protection User or Group Network Awareness Web Protection Reputation Who , Bob, Alice Allow marketing and sales teams to access social networking sites What 80, 443, 21, webmail, social networks Block attachments on all outgoing s and chats A more strict security policy is applied to traffic from countries where I do not do business Advanced inspection of web application traffic destined to my web servers Block known botnet servers and phishing sites Allow, but don t inspect, traffic to financial and medical sites Traffic Controls Policy July

36 The Advanced Threat Protection Platform Security Intelligence Platform Log Manager SIEM Network Activity Monitor Vulnerability Manager Risk Manager Threat Intelligence and Research Vulnerability Data Malicious Websites Malware Information IP Reputation Advanced Threat Protection Platform Intrusion Prevention Content and Data Security Web Application Protection Network Anomaly Detection Application Control IBM Network Security Advanced Threat Protection Platform Ability to prevent sophisticated threats and detect abnormal network behavior by leveraging an extensible set of network security capabilities - in conjunction with real-time threat information and Security Intelligence 36 Expanded X-Force Threat Intelligence Increased coverage of world-wide threat intelligence harvested by X-Force and the consumption of this data to make smarter and more accurate security decisions across the IBM portfolio NEW Security Intelligence Integration Tight integration between the Advanced Threat Protection Platform and QRadar Security Intelligence platform to provide unique and meaningful ways to detect, investigate and remediate threats

37 Next Generation Network IPS 37

38 Immediately discover which applications and web sites are being accessed Understanding who, what, and when Quickly Identify misuse by application, website, user, and group Understand who and what are consuming bandwidth on the network Superior detection of advanced threats through integration with QRadar for network anomaly and event details Network flows can be sent to QRadar for enhanced analysis, correlation and anomaly detection Identity context ties users and groups with their network activity - going beyond IP address only policies Application context fully classifies network traffic, regardless of port, protocol or evasion techniques Increase Security Reduce Costs Enable Innovation 38

39 Next Gen IPS: IBM Security Network Protection XGS 5100 NEW WITH XGS NEW WITH XGS PROVEN SECURITY ULTIMATE VISIBILITY COMPLETE CONTROL Extensible, 0-Day protection powered by X-Force Understand the Who, What and When for all network activity Ensure appropriate application and network use IBM Security Network Protection XGS 5100 builds on the proven security of IBM intrusion prevention solutions by delivering the addition of next generation visibility and control to help balance security and business requirements 39

40 Proven Security: Extensible, 0-Day Protection Powered by X-Force Next Generation IPS powered by X-Force Research protects weeks or even months ahead of the threat Full protocol, content and application aware protection goes beyond signatures Expandable protection modules defend against emerging threats such as malicious file attachments and Web application attacks IBM Security Network Protection XGS 5000 IBM Security Threat Protection Backed by X-Force 15 years+ of vulnerability research and development Trusted by the world s largest enterprises and government agencies True protocol-aware intrusion prevention, not reliant on signatures Specialized engines Exploit Payload Detection Web Application Protection Content and File Inspection 40 Ability to protect against the threats of today and tomorrow

41 QRadar Network Anomaly Detection QRadar Network Anomaly Detection is a purpose built version of QRadar for IBM s intrusion prevention portfolio The addition of QRadar s behavioral analytics and real-time correlation helps better detect and prioritize stealthy attacks Supplements visibility provided by IBM Security Network Protection s Local Management (LMI) Integration with IBM Security Network Protection including the ability to send network flow data from XGS to QRadar 41

42 IBM X-Force Threat Information Center Real-time Security Overview w/ IP Reputation Correlation Identity and User Context Real-time Network Visualization and Application Statistics Inbound Security Events 42

43 The XGS 5100: The Best Solution for Threat Prevention Better Network Control Natural complement to current Firewall and VPN Not rip-and-replace works with your existing network and security infrastructure More flexibility and depth in security and control over users, groups, networks and applications Internet Stealth Bots Worms, Trojans Targeted Attacks Designer Malware Firewall/VPN port and protocol filtering Better Threat Protection True Protocol aware Network IPS Higher level of overall security and protection More effective against 0-day attacks Best of both worlds true protocol and heuristicbased protection with customized signature support Gateway message and attachment security only Everything Else Web Gateway securing web traffic only, port 80 / 443 IBM Security Network Protection XGS 5100 IBM Security Network Protection XGS 5100 Proven Security Ultimate Visibility Complete Control 43

44