Solution Brief A Well-Connected Sandbox Ensure the success of your advanced threat defense strategy Top of mind for most CSOs is the growing risk of advanced threats and the technical requirements to effectively defend against them. Threats are constantly evolving to mask their intent, conceal malicious payloads, exploit newly disclosed vulnerabilities, and evade detection. Today’s most effective method to address these challenges includes sandbox technology, which provides in-depth analysis of new or unknown files and executables in a secure environment. The effectiveness of a sandbox technology is determined by several factors. The first is the ability to detect evasive threats. Another key factor is how well the sandbox is integrated into the existing security infrastructure—from network edge through the endpoint. A well-connected sandbox is critical to the success of an effective threat defense strategy. Unlike stand-alone sandboxes that add complexity through isolation, McAfee® Advanced Threat Defense adds in-depth analysis as a tightly integrated, shared resource that strengthens and synchronizes defensive capabilities throughout the network. In this brief, we’ll take a look at common use cases that show how integration between McAfee Advanced Threat Defense and other security controls from McAfee, a part of Intel Security, create a multipronged strategy designed to make enterprise defenses both more effective in detecting previously unknown malware and globally responsive when a new attack occurs. Start with a Great Sandbox The first factor that extends—or limits—sandbox detection capabilities is the range of inspection techniques available. Many provide dynamic analysis only, which most commonly includes file detonation and observation of the resulting behavior. Dynamic analysis, while a good start, is vulnerable to evasive techniques, such as delayed execution and hidden execution paths. McAfee Advanced Threat Defense McAfee Advanced Threat Defense represents the next generation of advanced threat detection. This multilayered solution wraps a dynamic inspection engine with additional tools to detect evasive tactics. It applies a series of analytics in a down-select sequence of increasing computa tional intensity to deliver high levels of detection accuracy with extremely high throughput performance. Solution Brief The on-board features include: ■■ ■■ ■■ ■■ ■■ Signature-based detection of viruses, worms, spyware, bots, Trojans, buffer overflows, and blended attacks using a comprehensive knowledgebase created and maintained by McAfee Labs, which currently includes more than 300 million signatures. Reputation-based detection using the McAfee Global Threat Intelligence (McAfee GTI) network to detect newly emerging threats. Real-time emulation that simulates code execution using lightweight runtime environments and heuristic behavioral analytics to quickly find malware threats that evade signatures and reputation-based inspection. Dynamic sandbox analysis that executes files in a run-time environment and observes the resulting behavior. While requiring more resources and time than real-time emulation, it accurately discovers more sophisticated threats. McAfee Advanced Threat Defense uniquely configures virtual run-time environments to match the target host based on queries to McAfee® ePolicy Orchestrator® (McAfee ePO™) software. Analyzing behavior under the conditions of an intended host quickly produces accurate results, revealing behaviors often not triggered in a generic environment. Full static code analysis that analyzes the source code and instruction sets without execution. Comprehensive unpacking capabilities open all types of packed and compressed files to enable complete analysis and classification. Full static code analysis provides critical insight into input-dependent behaviors and delayed or hidden execution paths that often do not execute during dynamic analysis and are overlooked by less comprehensive solutions. Connect the Sandbox The in-depth inspection capabilities of McAfee Advanced Threat Defense are of most value when deeply integrated with inline security controls that can intercept and forward unknown files for analysis. With integration, sandbox convictions are quickly communicated so that security controls can take immediate action: blocking a malicious file, preventing its execution on an endpoint, or updating the defenses on other potential targets. Tight integration between McAfee Advanced Threat Defense and other Intel Security solutions creates new opportunities to reinforce malware security throughout the environment. Use Cases The well-connected sandbox offers robust protection against advanced threats across the entire enterprise environment. Let’s take a look at some use cases that clearly demonstrate how the Security Connected approach supports and extends the capabilities of McAfee Advanced Threat Defense throughout the infrastructure—from the network to content gateways to endpoints. Use case 1: Strengthening malware security at the network edge Intel Security products on deck: Deploy McAfee Advanced Threat Defense with McAfee Network Security Platform (IPS) and/or McAfee Next Generation Firewall to find and freeze emerging malware threats. Security Connected in action: When the intrusion prevention system (IPS) or firewall intercepts a file or executable, and cannot make a positive conviction with the real-time analytics available onboard, they forward a copy of the file or executable to McAfee Advanced Threat Defense for further analysis. McAfee Advanced Threat Defense applies its inspection engines in sequence, avoiding any that have already been run by the referring system. McAfee Advanced Threat Defense then posts the resulting score and report to the referring solution, which immediately incorporates the score into its own policy enforcement processes. The convictions appear in IPS and firewall A Well-Connected Sandbox Intel Security Security for the Network Edge McAfee Network Security Platform discovers and blocks sophisticated threats in the network using a set of real-time detection technologies. It delivers inline speeds up to 40 Gbps on a single appliance and maintains exceptional throughput performance and accuracy, regardless of security settings. McAfee Next Generation Firewall combines security with high availability and manageability, delivering advanced protection for corporate headquarters, data centers, or branch offices. It integrates layer 7 network application control, intrusion prevention, virtual private networking, and evasion prevention functionality on a unified software core. 2 Solution Brief logs and dashboards in near real time, as if the entire analysis had been completed onboard. This streamlines investigative workflows, allowing administrators to efficiently manage alerts through a single interface. Key advantages: Both McAfee Network Security Platform and McAfee Next Generation Firewall can leverage the complete McAfee Advanced Threat Defense inspection stack to find and stop stealthy malware attacks that would otherwise defeat their onboard defenses. McAfee Advanced Threat Defense McAfee Email Gateway McAfee Enterprise Security Manager (SIEM) McAfee Web Gateway McAfee Network Security Platform McAfee Next Generation Firewall Internet Corporate User McAfee Global Threat Intelligence McAfee ePO Figure 1. Integration points for finding, freezing, and fixing malware. Use case 2: Strengthening malware security at content service gateways Intel Security products on deck: Deploy McAfee Advanced Threat Defense with direct integration to McAfee Web Gateway or McAfee Email Gateway to find and freeze stealthy, evasive malware attacks embedded in web and email traffic. Security Connected in action: McAfee Web Gateway and McAfee Email Gateway scan their assigned traffic flows for potential threats embedded in web traffic and email messages. Any files that cannot be cleared or convicted with onboard analytics are forwarded to McAfee Advanced Threat Defense for further analysis. The referring gateway receives the score and automatically incorporates it in policy enforcement workflows and dashboards. Convicted files are blocked immediately and on all future appearances. Unlike most web security solutions, McAfee Web Gateway features onboard SSL decryption. This allows the gateway to send decrypted files to McAfee Advanced Threat Defense for faster, more accurate analysis. And because both gateways offer device profiling, suspect files can be sent to McAfee Advanced Threat Defense along with header information indicating the target platform (if McAfee ePO software is not available to provide that information). This helps the dynamic analysis engine load a matching virtual machine image for more accurate and complete analysis. Key advantages: With McAfee Advanced Threat Defense in the environment, McAfee Web Gateway and McAfee Email Gateway can leverage its complete file inspection stack to find and stop stealthy malware attacks that might otherwise slip past their onboard defenses. Because email traffic can tolerate small amounts of latency, suspect files can be held at the gateway until analysis is complete. And the web gateway’s flexible rules engine lets administrators set policy for whether files are held during analysis or allowed and tracked. Both instances allow “patient zero protection,” in which the first detected instance of a new threat is blocked, eliminating the need to locate and remediate one or more infected endpoints. A Well-Connected Sandbox Intel Security for Content Gateways McAfee Email Gateway McAfee Email Gateway combines inbound threat protection, outbound encryption, advanced compliance, data loss prevention, and adminis tration in a single, easy-todeploy appliance. McAfee Web Gateway McAfee Web Gateway provides broad capabilities, from web filtering and anti-malware scanning to deep content inspection and granular control over how websites and applications are used. 3 Solution Brief Use case 3: Strengthening malware security on the endpoint and beyond McAfee Next Generation Firewall McAfee Global Threat Intelligence McAfee Network Security Platform McAfee McAfee Web Gateway Email Gateway McAfee McAfee Threat Intelligence Advanced Threat Exchange Server Defense Third-Party Feeds Data Exchange Layer McAfee ePO McAfee Enterprise Security Manager McAfee McAfee VIrusScan Threat VIrusScan® Intelligence Enterprise Threat Module Intelligence Module Figure 2. Security components operate as one to immediately share relevant data among endpoint, gateway, and other security products. Intel Security products on deck: Deploy McAfee Advanced Threat Defense along with McAfee Threat Intelligence Exchange, McAfee ePolicy Orchestrator (ePO) and McAfee Endpoint Protection products to prevent patient-zero infections and remove convicted files from endpoints across the network. Leverage the data exchange layer to integrate additional security products and share new threat discoveries throughout the entire security environment in near real time. Security Connected in action: McAfee Advanced Threat Defense and McAfee Threat Intelligence Exchange work with McAfee ePO software to provide endpoint systems with real-time situational awareness about security events throughout the network. When a new file attempts to execute on an endpoint, it is initially inspected by endpoint security using signatures, rules, and reputation from McAfee Global Threat Intelligence. If endpoint security cannot convict or clear the file, it forwards a hash to McAfee Threat Intelligence Exchange, which consults local hash files, whitelists, blacklists, and various reputation sources to make a decision. If no reputation is available, McAfee Threat Intelligence Exchange forwards the file to McAfee Advanced Threat Defense for in-depth static code analysis and dynamic interrogation. Endpoint security is configurable to either hold execution of the unknown file until McAfee Advanced Threat Defense returns a verdict, or to allow execution of the file while McAfee Advanced Threat Defense completes its analysis. These results are returned to McAfee Threat Intelligence Exchange and immediately published to all endpoints and other security measures, including the referring endpoint, which will immediately close malicious process execution if it started during the analysis period. Additionally, McAfee Threat Intelligence Exchange-enabled endpoints continue to receive file conviction updates when off the network, extending protection to off-network assets and eliminating blind spots from out-of-band payload delivery. Intel Security Security for Network Endpoints and Beyond McAfee Threat Intelligence Exchange This tool enables adaptive threat prevention by sharing relevant security data across endpoints, gateways, and other security products. It relies on the data exchange layer, a bi-directional communications fabric that provides a persistent connection over which connected components share intelligence in real time, regardless of their location. McAfee ePO Software Our centralized manage ment console provides enterprise-class, unified management of endpoint, network, and data security. End-to-end visibility and powerful automations slash incident response times. McAfee Endpoint Security This comprehensive solution integrates numerous techn ologies for coordinated, complete protection against all five threat vectors— system, email, web, data, and network. Beyond endpoint protection, connecting McAfee Advanced Threat Defense to McAfee Threat Intelligence Exchange and other security measures through the data exchange layer creates a single collaborative system. New malware threats uncovered by McAfee Advanced Threat Defense working in tandem with edge, gateway, or endpoint security measures are instantly reported to connected security measures in near real time. The result is adaptive, cross-vector detection, blocking, and containment of advanced targeted attacks. The entire enterprise environment can now be secured against a newly discovered attack within a fraction of a second. Endpoints are protected against executing a known malicious file, and gateways are on alert to block subsequent instances at the network edge. A Well-Connected Sandbox 4 Solution Brief Key advantages: Any newly identified malicious file, no matter where it is first detected, can now be recognized and blocked at every endpoint and across the network. This adaptive response provides instant protection across the entire environment, including network, gateway, and endpoints. Responsive agility is increased, while the time-to-containment and time-to-remediation are dramatically reduced, all without the need to re-architect the network. Use case 4: FInding and fixing infected endpoints fast Intel Security products on deck: Deploy McAfee Enterprise Security Manager (SIEM) with McAfee Advanced Threat Defense, McAfee Complete Endpoint Protection, and McAfee ePO software to dramatically reduce the time required to track down and remediate compromised endpoint systems. Security Connected in action: When deployed in a network, McAfee Enterprise Security Manager collects, parses, correlates, and stores log and event information from security systems and other network devices. When McAfee Advanced Threat Defense convicts a suspect file, it funnels a CybOX STIX formatted indicator of compromise (IoC) to McAfee Enterprise Security Manager, which can then interpret and act on these artifacts. For both the original payload and any nested (unpacked) payloads revealed in the analysis, the data transferred includes the name, hash (MD5 or SHA-1), and severity of the convicted file; the gateway or device that first detected it; the message that carried it; the source and destination systems; and the source URL. The cyberthreat manager in McAfee Enterprise Security Manager incorporates this data in its correlations and analysis. All values are parsed and can be used to trigger security responses—both automated and interactive. Security analysts can query McAfee Enterprise Security Manager to correlate security event histories with IoCs reported by McAfee Advanced Threat Defense. Destination hosts can be listed to indicate potentially compromised machines. Source domains and IP addresses involved in multiple attacks can be identified. McAfee Enterprise Security Manager can also coordinate a variety of attack responses. It can create a blacklist of suspect IP addresses and instruct McAfee Network Security Platform or McAfee ePO software to disallow any connection requests. It can also create a watch list of suspect IP addresses and alert whenever it sees a connection attempt to or from an internal host. Solutions for Incident Analysis and Response McAfee Enterprise Security Manager McAfee Enterprise Security Manager brings together security intelligence and information management (SIEM) to provide situational awareness across the entire environment. It collects, processes, and correlates billions of log events and flow data from a distributed network of receivers, making years of data continuously available for immediate access and analysis. It calculates baseline activity norms and alerts on varia tions that might indicate an imminent threat. Tight integration between products from McAfee Enterprise Security Manager, McAfee Threat Intelligence Exchange, and others enables coordinated, timely response. A newly discovered file can be flagged as malicious, initiating a search across the network for additional instances of the same file, removal of the file, or blocked execution. Remediation actions can also include issuing new configurations, implementing new policies, removing files, and deploying software updates that can proactively mitigate risk. Key advantages: Security analysts can correlate IoCs extracted from malware analytics against aggregated security event histories to quickly identify compromised endpoints, contain attacks, mitigate damages, and remediate all affected systems. Learn more about McAfee Advanced Threat Defense at: www.mcafee.com/atd. Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee, the McAfee logo, ePolicy Orchestrator, McAfee ePO, and VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. The product plans, specifications and descriptions herein are provided for information only and subject to change without notice, and are provided without warranty of any kind, express or implied. Copyright © 2015 McAfee, Inc. 61642brf_well-connected-sandbox_0115_fnl_ETMG McAfee. Part of Intel Security. 2821 Mission College Boulevard Santa Clara, CA 95054 888 847 8766 www.intelsecurity.com
© Copyright 2024