5 Habits of Highly Effective Endpoint Threat Protection
•Als PPTX, PDF herunterladen•
0 gefällt mir•2,450 views
In this webcast, guest speaker Rick Holland, VP Principal Analyst at Forrester, and Cindy Valladares, Director of Communications at Tripwire, will discuss how to build a defensible environment by using hunting techniques, rapidly detecting malicious indicators of compromise, fine-tuning alerts for action, incorporating threat intelligence feeds, and remediating with automatable capabilities.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Andere mochten auch
Andere mochten auch (20)
Ähnlich wie 5 Habits of Highly Effective Endpoint Threat Protection
Ähnlich wie 5 Habits of Highly Effective Endpoint Threat Protection (20)
Mehr von Tripwire
Mehr von Tripwire (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
5 Habits of Highly Effective Endpoint Threat Protection
- 2. © 2015 Forrester Research, Inc. Reproduction Prohibited 2 tripwire.com/blog forrester.com
- 3. © 2015 Forrester Research, Inc. Reproduction Prohibited 3 Endpoint security has been in drought conditions for years
- 4. © 2015 Forrester Research, Inc. Reproduction Prohibited 4 But now the rain is finally coming!
- 5. © 2015 Forrester Research, Inc. Reproduction Prohibited 5 Endpoint investment is increasing Source: Forrester’s Business Technographics® Global Security Survey, 2015 Note: Values may not equal 100% due to omission of “don’t know” responses
- 6. © 2015 Forrester Research, Inc. Reproduction Prohibited 6 5 Habits of Highly Effective Endpoint Threat Protection 1. Buyers must first live off the land 2. Prevention isn’t dead, but you must fall back to detection 3. This adversary isn’t going to hunt itself 4. Small footprint is required 5. Visibility isn’t enough, action is required
- 7. © 2015 Forrester Research, Inc. Reproduction Prohibited 7 asdf › asdf #1 Buyers must first live off the land
- 8. © 2015 Forrester Research, Inc. Reproduction Prohibited 8 Expense in Depth
- 9. © 2015 Forrester Research, Inc. Reproduction Prohibited 9 Where do you get diminishing returns on investments?
- 10. © 2015 Forrester Research, Inc. Reproduction Prohibited 10 Living off the land › Before you invest in any capabilities maximize all existing capabilities first › Look to existing vendors before adding new vendors to your portfolio › Investment in new technologies and vendors is legitimate, once appropriate due diligence is conducted first
- 11. © 2015 Forrester Research, Inc. Reproduction Prohibited 11
- 12. © 2015 Forrester Research, Inc. Reproduction Prohibited 12 Targeted-Attack Hierarchy of Needs
- 13. © 2015 Forrester Research, Inc. Reproduction Prohibited 13 NIST Cybersecurity Framework
- 14. © 2015 Forrester Research, Inc. Reproduction Prohibited 14 #3 The adversary isn’t going to hunt itself
- 15. © 2015 Forrester Research, Inc. Reproduction Prohibited 15 Solutions must posses ability to hunt › Need the ability to ingest Threat intelligence feeds Internally sourced threat intelligence › Proactively hunt for threat indicators › Manual hunting is bare minimum requirement, programmatic ability to ingest bulk indicators via API is preferred
- 16. © 2015 Forrester Research, Inc. Reproduction Prohibited 16 Hunting at scale, when one Vin Diesel isn’t enough
- 17. © 2015 Forrester Research, Inc. Reproduction Prohibited 17 #4 A small footprint is required
- 18. © 2015 Forrester Research, Inc. Reproduction Prohibited 18 When was the last time you heard anyone say that they have a “large footprint?”
- 19. © 2015 Forrester Research, Inc. Reproduction Prohibited 19 Small footprint required › Transparent user experience required › Transparent administration experience required › Be careful of “yet another agent syndrome” › Look at the size of the agent and the percentage of CPU utilized › Kernel or user space? Operating within the kernel can be dangerous
- 20. © 2015 Forrester Research, Inc. Reproduction Prohibited 20 #5 Visibility isn’t enough, action is required
- 21. © 2015 Forrester Research, Inc. Reproduction Prohibited 21 Automate as much as possible
- 22. © 2015 Forrester Research, Inc. Reproduction Prohibited 22 Crawl, walk, run with automation › Automation doesn’t have to sacrifice legitimate traffic › Human intervention required for automation until confidence is built › Enrichment can be automated › Automation from endpoint, to identity to network devices
- 23. © 2015 Forrester Research, Inc. Reproduction Prohibited 23 Wrap up – vendor selection
- 24. © 2015 Forrester Research, Inc. Reproduction Prohibited 24 Wrap up – vendor selection
- 25. © 2015 Forrester Research, Inc. Reproduction Prohibited 25 5 Habits of Highly Effective Endpoint Threat Protection 1. Buyers must first live off the land 2. Prevention isn’t dead, but you must fall back to detection 3. This adversary isn’t going to hunt itself 4. Small footprint is required 5. Visibility isn’t enough, action is required
- 30. Integrate to Enterprise Workflow Increase/Decrease Monitoring Run an Executable Investigate