1.
X-Force 2011 Trend and Risk
Report
&
Advanced Threat Protection
Platform
Optimizing the World’s Infrastructure
May 2012
© 2012 IBM Corporation

2.
Please note:
• IBM’s statements regarding its plans, directions, and intent are
subject to change or withdrawal without notice at IBM’s sole discretion.
• Information regarding potential future products is intended to outline
our general product direction and it should not be relied on in making a purchasing
decision.
• The information mentioned regarding potential future products is not a
commitment, promise, or legal obligation to deliver any material, code or
functionality. Information about potential future products may not be incorporated
into any contract. The development, release, and timing of any future features or
functionality described for our products remains at our sole discretion.
• Performance is based on measurements and projections using standard IBM
benchmarks in a controlled environment. The actual throughput or performance
that any user will experience will vary depending upon many factors, including
considerations such as the amount of multiprogramming in the user's job stream,
the I/O configuration, the storage configuration, and the workload processed.
Therefore, no assurance can be given that an individual user will achieve results
similar to those stated here. 2

3.
Agenda
• X-Force overview
• Highlights from the 2011 IBM X-Force Trend and Risk Report
– New attack activity
– Progress in internet security
– New challenges from mobile and cloud
3

4.
X-Force research
X-Force Research
IBMThe missionteam isand
development of the to:
X-Force® research
14B analyzed Web pages & images
40M spam & phishing attacks
54K documented vulnerabilities
13B security events daily
 Research and evaluate threat and protection issues
 Deliver security protection for today’s security problems Provides Specific Analysis of:
 Develop new technology for tomorrow’s security challenges
 Educate the media and user communities
• Vulnerabilities & exploits
• Malicious/Unwanted websites
4

5.
2011: Year of the security breach
5

6.
Key Messages from the 2011 Trend Report
• New Attack Activity
– Rise in Shell Command Injection attacks
– Spikes in SSH Brute Forcing
– Rise in phishing based malware distribution and click fraud
• Progress in Internet Security
– Fewer exploit releases
– Fewer web application vulnerabilities
6

7.
SQL injection attacks against web servers
7

8.
Shell Command Injection attacks
8

9.
SSH brute force activity
9

10.
Explosion of phishing based malware distribution and
click fraud
10

11.
MAC malware
• 2011 has seen the most activity in the Mac
malware world.
– Not only in volume compared to previous
years, but also in functionality.
• In 2011, we started seeing Mac malware with
functionalities that we’ve only seen before in
Windows® malware.
11

12.
Key Messages from the 2011 Trend Report
• New Attack Activity
–Rise in Shell Command Injection attacks
– Spikes in SSH Brute Forcing
– Rise in phishing based malware distribution and click fraud
• Progress in Internet Security
– Fewer exploit releases
– Fewer web application vulnerabilities
12

13.
Public exploit disclosures
• Total number of exploit
releases down to a number
not seen since 2006
– Also down as a
percentage of
vulnerabilities
13

14.
Public exploits
14

15.
Decline in web application vulnerabilities
• In 2011, 41% of security vulnerabilities affected
web applications
– Down from 49% in 2010
– Lowest percentage seen since 2005
15

16.
Key Messages from the 2011 Trend Report
• New Attack Activity
–Rise in Shell Command Injection attacks
– Spikes in SSH Brute Forcing
– Rise in phishing based malware distribution and click fraud
• Progress in Internet Security
– Fewer exploit releases
– Fewer web application vulnerabilities
16

17.
Mobile OS vulnerabilities & exploits
• Continued interest in Mobile
vulnerabilities as enterprise users
request a “bring your own device”
(BYOD) strategy for the workplace
• Attackers finding these devices
represent lucrative new attack
opportunities
17

18.
Social Networking – no longer a fringe pastime
• Attackers finding social networks ripe with valuable informaiton they can mine to build
intelligence about organizations and its staff:
– Scan corporate websites, Google, Google News
– Who works there? What are their titles?
18
18

19.
Introducing IBM’s
Advanced Threat
Protection Platform

20.
IBM Security Framework
Enterprise Governance, Risk and Compliance Management
IBM OpenPages Algorithmics (recent acquisition) i2 Corporation (recent acquisition)
IBM Security Portfolio
IT GRC Analytics & Reporting
QRadar QRadar Log QRadar IBM Privacy, Audit and
SIEM Manager Risk Manager Compliance Assessment Services
Security
Consulting
IT Infrastructure – Operational Security Domains
People Data Applications Infrastructure
Network Endpoint
Identity & Access Guardium AppScan Network Endpoint
Management Suite Database Security Source/Std. Edition Intrusion Prevention Manager (BigFix)
Managed
Services
Federated Optim DataPower Server and
zSecure suite
Identity Manager Data Masking Security Gateway Virtualization Security
Enterprise Key Lifecycle Security QRadar Anomaly Native Server Security
Single Sign-On Manager Policy Manager Detection / QFlow (RACF, IBM systems)
X-Force
Data Security Application and IBM
Managed Firewall,
Identity Assessment, Assessment Service Assessment Service Research
Unified Threat and Penetration
Deployment and
Intrusion Prevention Testing Services
Hosting Services Encryption and AppScan OnDemand Services
DLP Deployment Software as a Service
20

21.
Advanced Threats: The sophistication of Cyber threats,
attackers and motives is rapidly escalating
1995 – 2005 2005 – 2015
1 Decade of the Commercial Internet
st
2 Decade of the Commercial Internet
nd
Motive
Nation-state Actors;
National Security Targeted Attacks / Advanced
Persistent Threat
Espionage,
Competitors, Hacktivists
Political Activism
Monetary Gain Organized Crime, using sophisticated tools
Revenge Insiders, using inside information
Curiosity Script-kiddies or hackers using tools, web-based “how-to’s”
Adversary
21

22.
IT Security is a board room discussion
Business Brand image Supply chain Legal Impact of Audit risk
results exposure hacktivism
Sony estimates HSBC data Epsilon breach TJX estimates Lulzsec 50-day Zurich
potential $1B breach impacts 100 $150M class hack-at-will Insurance PLc
long term discloses 24K national brands action spree impacts fined £2.275M
impact – private banking settlement in Nintendo, CIA, ($3.8M) for the
$171M / 100 customers release of PBS, UK NHS, loss and
customers* credit / debit UK SOCA, exposure of
card info Sony … 46K customer
records
22

23.
QRadar Security Intelligence
Enterprise Governance, Risk and Compliance Management
IBM OpenPages Algorithmics (recent acquisition) i2 Corporation (recent acquisition)
IBM Security Portfolio
IT GRC Analytics & Reporting
QRadar QRadar Log QRadar IBM Privacy, Audit and
SIEM Manager Risk Manager Compliance Assessment Services
Security
Consulting
IT Infrastructure – Operational Security Domains
People Data Applications Infrastructure
Network Endpoint
Identity & Access Guardium AppScan Network Endpoint
Management Suite Database Security Source/Std. Edition Intrusion Prevention Manager (BigFix)
Managed
Services
Federated Optim DataPower Server and
zSecure suite
Identity Manager Data Masking Security Gateway Virtualization Security
Enterprise Key Lifecycle Security QRadar Anomaly Native Server Security
Single Sign-On Manager Policy Manager Detection / QFlow (RACF, IBM systems)
X-Force
Data Security Application and IBM
Managed Firewall,
Identity Assessment, Assessment Service Assessment Service Research
Unified Threat and Penetration
Deployment and
Intrusion Prevention Testing Services
Hosting Services Encryption and AppScan OnDemand Services
DLP Deployment Software as a Service
23

24.
Solutions for the Full Compliance and Security
Intelligence Timeline
24

25.
Context & Correlation Drive Deepest Insight
25

26.
Solving Customer Challenges
26

27.
Fully Integrated Security Intelligence
• Turnkey log management
Log
Management
One Console Security
• SME to Enterprise
• Integrated log, threat, risk & compliance mgmt.
SIEM
• Upgradeable to enterprise SIEM
• Sophisticated event analytics
• Predictive threat modeling & simulation
Risk
Management • Asset profiling and flow analytics
• Scalable configuration monitoring and audit
Network • • Offense management and workflow
Network analytics
Activity &
Anomaly • Advanced threat visualization and impact analysis
Detection
• Behavior and anomaly detection
Network and • Layer 7 application monitoring
Application
Visibility
Built on a Single Data Architecture
• Fully integrated with SIEM
• Content capture
27

28.
IBM Security Threat Platform
Enterprise Governance, Risk and Compliance Management
IBM OpenPages Algorithmics (recent acquisition) i2 Corporation (recent acquisition)
IBM Security Portfolio
IT GRC Analytics & Reporting
QRadar QRadar Log QRadar IBM Privacy, Audit and
SIEM Manager Risk Manager Compliance Assessment Services
Security
Consulting
IT Infrastructure – Operational Security Domains
People Data Applications Infrastructure
Network Endpoint
Identity & Access Guardium AppScan Network Endpoint
Management Suite Database Security Source/Std. Edition Intrusion Prevention Manager (BigFix)
Managed
Services
Federated Optim DataPower Server and
zSecure suite
Identity Manager Data Masking Security Gateway Virtualization Security
Enterprise Key Lifecycle Security QRadar Anomaly Native Server Security
Single Sign-On Manager Policy Manager Detection / QFlow (RACF, IBM systems)
X-Force
Data Security Application and IBM
Managed Firewall,
Identity Assessment, Assessment Service Assessment Service Research
Unified Threat and Penetration
Deployment and
Intrusion Prevention Testing Services
Hosting Services Encryption and AppScan OnDemand Services
DLP Deployment Software as a Service
28

29.
IBM Security Network IPS:
Addressing Today’s Evolving Threats
>260
29
29

30.
Why Vulnerability-based Research = Preemptive
Security Approach
• Protecting against exploits is reactive
– Too late for many
– Variants undo previous updates
30

31.
31
IBM IPS Zero Day (Vuln/Exploit) Web App Protection
■ IBM IPS Injection Logic Engine has stopped every large scale SQL
injection or XSS attack day-zero.
• Asprox – reported 12/11/2008 – stopped 6/7/2007
New Vulnerability or Exploit Reported Date Ahead of the Threat Since
Nagios expand cross-site scripting 5/1/2011 6/7/2007
Easy Media Script go parameter XSS 5/26/2011 6/7/2007
N-13 News XSS 5/25/2011 6/7/2007
I GiveTest 2.1.0 SQL Injection 6/21/2011 6/7/2007
RG Board SDQL Injection Published: 6/28/2011 6/7/2007
• Lizamoon – reported 3/29/2011 – stopped 6/7/2007
BlogiT PHP Injection 6/28/2011 6/7/2007
IdevSpot SQL Injection (iSupport) 2011-05-23 6/7/2007
2Point Solutions SQL Injection 6/24/2011 6/7/2007
PHPFusion SQL Injection 1/17/2011 6/7/2007
ToursManager PhP Script Blind SQli 2011-07-xx 6/7/2007
Oracle Database SQL Injection 2011-07-xx 6/7/2007
• SONY (published)
LuxCal Web Calendar – reported May/June/2011
7/7/2011 – stopped 6/7/2007
6/7/2007
Apple Web Developer Website SQL 2011-07-xx 6/7/2007
MySQLDriverCS Cross-Param SQLi 6/27/2011 6/7/2007
31

32.
Ahead of the Threat
IBM’s Preemptive Approach vs.
Reactive Approach to address Threats
IBM Clients have typically been provided
protection guidance prior to or within 24
hours of a vendor vulnerability disclosure
being announced (89% of the time in 2010)
# of days IBM clients were
provided protection guidance
“Ahead of the Threat”
Source: IBM X-Force
32
32

33.
Network Security Product Line up
Product Description
The core of any Intrusion Prevention strategy, IBM
IBM Security Network
Security Network IPS appliances help to protect the
Intrusion Prevention
network infrastructure from a wide range of attacks, up to
System
23 Gbps inspected throughput
Focused on protecting individual assets on the network
IBM Security Endpoint
including servers and desktops from both internal and
Defence
external threats
Virtual Server Protection is integrated with the hypervisor
IBM Security Virtual
and provides visibility into intra-VM network traffic.
Server Protection
Supports ESX 4.1 and 5.0 and 10Gb Ethernet
Centralized management for IBM Security intrusion
IBM Security prevention solutions that provides a single management
SiteProtector System point to control security policy, analysis, alerting and
reporting
33

34.
IBM’s Vision for Infrastructure Threat Protection –
Roadmap
34

35.
1 1Q12: Launched IBM Security Network IPS
Powered by X-Force
• Meet signature sharing mandates (i.e. Core Capabilities
Government & Financial Institutions) Unmatched Performance delivering 20Gbps+ of
inspected throughput and 10GbE connectivity
without compromising breadth and depth of
• IBM Hybrid protection security
Evolving protection powered by world renowned
– Using X-Force Protocol Analysis with the X-Force research to stay “ahead of the threat”
ability to write or import custom Snort rules Reduced cost and complexity through
consolidation of point solutions and integrations
with other security tools
Make the move to
IBM Security Network IPS
• IBM Network IPS and Protocol Analysis Modules
(PAM) Core tenant for the Advanced Threat
Protection Platform
Custom Rules
Locked in to Signature-only IPS?
Custom Rules
35

36.
1 Extensible Protection with Protocol Analysis Module
Ahead of the Threat
extensible protection
backed by the power
of X-Force
Client-Side Application Web Application Threat Detection &
Virtual Patch Protection Data Security Application Control
Protection Prevention
What It Does: What It Does: What It Does: What It Does: What It Does: What It Does:
Mitigates vulnerability Protects end users Protects web applications Detects and prevents Monitors, identifies, and Manages control of
exploitation independent against attacks targeting against sophisticated entire classes of threats provides control over unauthorized applications
of a software patch, and applications used every application-level attacks as opposed to a specific unencrypted personally and risks within defined
enables a responsible day such as Microsoft such as SQL Injection, exploit or vulnerability. identifiable information segments of the network,
patch management Office, Adobe PDF, XSS (Cross-site (PII) and other such as ActiveX
process that can be Multimedia files and scripting), PHP file- Why Important: confidential information fingerprinting, Peer To
adhered to without fear of Web browsers. includes, CSRF (Cross- Eliminates need of for data awareness. Also Peer, Instant Messaging,
a breach. site request forgery), and constant signature provides capability to and tunnelling.
Why Important: Directory Traversals. updates. Protection explore data flow through
Why Important: In 2011, vulnerabilities includes the proprietary the network to help Why Important:
At the end of which affect client-side Why Important: technology such as Java determine if any potential Enforces network
2011, 36% of all applications represent Expands security bytecode exploit risks exist. application and service
vulnerabilities disclosed one of the largest capabilities to meet both detection, Flash exploit access based on
during the year had no category of all compliance requirements detection, and Shell Code Why Important: corporate policy and
vendor-supplied patches vulnerability disclosures. and threat evolution. Heuristics (SCH) Flexible and scalable governance.
available to remedy the technology, which has an customized data search
vulnerability. unbeatable track record of criteria; serves as a
protecting against zero complement to data
day vulnerabilities. security strategy.
36

37.
2 2Q12: Launch the X-Force IP Reputation Feed for QRadar
• 2Q12: IBM X-Force powers QRadar with the X-Force IP Reputation Feed
– Providing insight into suspect entities on the internet
• 15+ Billion URLs Monitored and Classified on a continuous basis
• Information about Malicious IPs, Malware hosts, SPAM sources, Dynamic IPs & Anonymous
Proxies
• Enhances QRadar correlation intelligence
37

38.
3 2Q12: Launch QRadar Network Anomaly Detection
Optimized for the Advanced Threat Protection Platform
• QRadar Network Anomaly Detection
 SiteProtector as core for command & control
 QRadar Network Anomaly Detection for
– An optimized version of QRadar which complements enhanced analytics
SiteProtector  QRadar QFlow and VFlow collectors provide
Network Awareness via deep packet
inspection
 Integrated policy management & workflows
within SiteProtector facilitate a rapid
• Greater visiblity for SiteProtector/IPS customers response to threat and more proactive
visibility.
• Network flow capture with behavioral analysis AppScan
and anomaly detection provides greater security intelligence: SiteProtector
QRadar NI
QRadar NIPS
Scanner Server
Desktop
– Traffic profiling for added protection from Low and Slow
Visibility Protection
and zero-day threats Suspicious Behavior  Proactive Prevention
38

39.
Summary
• Fever public vulnerabilities disclosures and exploits in 2011 compared to 2010,
but…
• We see more attack activity, with high profile breaches
39

40.
Acknowledgements, disclaimers
and trademarks
© Copyright IBM Corporation 2012. All rights reserved.
The information contained in this publication is provided for informational purposes only. While efforts were made to verify the
completeness and accuracy of the information contained in this publication, it is provided AS IS without warranty of any kind, express or
implied. In addition, this information is based on IBM’s current product plans and strategy, which are subject to change by IBM without
notice. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this publication or any other
materials. Nothing contained in this publication is intended to, nor shall have the effect of, creating any warranties or representations
from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM
software.
References in this publication to IBM products, programs or services do not imply that they will be made available in all countries in
which IBM operates. Product release dates and/or capabilities referenced in this presentation may change at any time at IBM’s sole
discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature
availability in any way. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any
activities undertaken by you will result in any specific sales, revenue growth, savings or other results. All statements regarding IBM
future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only.
Information concerning non-IBM products and services was obtained from a supplier of those products and services. IBM has not tested
these products or services and cannot confirm the accuracy of performance, compatibility, or any other claims related to non-IBM
products and services. Questions on the capabilities of non-IBM products and services should be addressed to the supplier of those
products and services.
All customer examples cited or described are presented as illustrations of the manner in which some customers have used IBM products
and the results they may have achieved. Actual environmental costs and performance characteristics may vary by customer and will
vary depending on individual customer configurations and conditions. Nothing contained in these materials is intended to, nor shall have
the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results.
Prices are suggested U.S. list prices and are subject to change without notice. Starting price may not include a hard drive, operating
system or other features. Contact your IBM representative or Business Partner for the most current pricing in your geography.
IBM, the IBM logo, ibm.com, Tivoli, the Tivoli logo, Tivoli Enterprise Console, Tivoli Storage Manager FastBack, and other IBM products
and services are trademarks or registered trademarks of International Business Machines Corporation in the United States, other
countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark
symbol (® or ™), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was
published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is
available on the Web at "Copyright and trademark information" at ibm.com/legal/copytrade.shtml
40

41.
Thank You- Q&A
41