ZERO-DAY,ZERO TRUSTSECURITY WITHIMMEDIATEROI

Transkript

1 MSSPCaseStudy ZERO-DAY,ZERO TRUSTSECURITY WITHIMMEDIATEROI Mostorganizationsareunabletoproperlydealwithcyberthreats because:theyaretooslow toidentifythem andtooslow tostop them from inflictingdamageoncetheorganizationisbreached. Thechalenge ismostcyber-securitysolutionsrequirehuman intervention smarthumansthatarespecificalytrainedinhow touseanarayofcomplicatedtoolstoidentifyathreatandthen figureouthow tostopit.theproblem,asthe2016verizondata BreachReportexposes,isthat95% ofatacksexfiltrateand/or coruptdatawithinafew hoursofabreach.thisisnotenough timeforeventhesmartesthumanstoreact.worseyet,analysts at451researchestimatethatfewerthan4% ofenterprisesand governmentorganizationshavededicatedsecuritystaffina securityoperationscenter(soc)tomonitoraltheseproducts forpossiblebreaches.smalandmedium sizedbusiness(smb) customersareincreasinglyaskingmanagedsecurityservice Providers(MSSPs)tohandletheirsecuritychalenges. Seceon szerotrustmodel, combinedwiththesonicwal next-generationfirewal (NGFW)securityservices providesapowerfulbreach detectionandmitigation solution.thecombined solutionenablesa breakthroughinreducing operationcost,whichalows forextremelyprofitable MSSPserviceofferings. Thefolowingexampledemonstratesthehighcostofdeployingcurentcybersecuritydefensesfor theenterpriseandilustratesthepainfulrealitythatsmbslackthefundingandresourcestoprotect preciousdigitalassets: FirewalsgenerateincidentsforNorth-Southtraffic,buttheseeventsdemanddeeperhumananalysis IncidentsforEast-Westtrafficareusualyunderstoodbylookingatserverlogsandnetworkflows, whichalsodemanddeeperhumananalysis,andoften,agreatdealoftimeevenwithagoodautomation Thevolumeofincidentsstacksuptomorethanevenadedicated,trainedstaffcanhandle, assuminga companyevenhasdedicatedsecuritystaff Flows/LogsTroubleshooting ActivityType Flow/Log Comments Instances NGFW (DelSonicWALL)generatesevents/logs North-South NGFW isresetingconnectionsfrom the aroundaninstanceofaninfecteddevice Activity 444 deviceovertimeandisnotcorrelating atemptingtoconnecttoabadwebsite. these"non-criticalflagged"incidents DeviceisalsoperformingIPSweeps East-West 135 Few separateinstancesacrosstheinternal Activity network DeviceisalsoperformingIPPortscans East-West 92 Few separateinstancesacrosstheinternal Activity network Deviceneedstobeidentified InternalActivity 1 Whatdeviceisit?Whichgroupitbelongsto? TotalActivity 672 Instancestoinvestigate 1

2 ResearchsuggeststhatatleastthreerelevantthreatsoccurdailyinaFortune5,000mid-size company.troubleshootingeachincidentrequiresweedingthroughthefirewalandserverlogs andfrequentlydemandslookingintonetworktrafficorpacketstodeterminetheexactanalysis ofthreat Theanalysisisconductedmostoftenbyahumananalyst.Thecostsoftheseanalystsareapproximately asfolows: Jr.SOCAnalyst Sr.SOCAnalyst Costs $75, $250, SOCanalystburdenedrate peryear $1, $4, Costperweek $36.06 $ Cost/hour $0.60 $2.00 Cost/minute Thecostoftroubleshootingjustoneincidentbyajunioranalystis$600overthecourseof2-3days, thereportofwhichmustthenbereviewedandanalyzedbyamoresenioranalystoverthecourse ofanother1-2days.overtime,thecostintimeandresourcesisapproximately$1800/day,adding upto$450k/year! Minutesperinstanceinvestigation 1.5 Totalminutesofeffortperincident Cost/minuteor$/minute $0.60 Totalcosttocorelateoneincident $ Typicalincidentsperbusinessdayinvestigatedatamid-sized 3 F5000(AsperPonemon/VerizonReports) Totalcostperbusinessday $1, Totalcostperyear $452, Automatingthisprocesswouldsavemostofthiscostandmostimportantly,thevariablecostofdata breaches.costofdatabreachesmostlydependsontheindustryandthevalueorcriticalityofthe informationbeingbreached;forexample,forhealthcareindustrytheapproximatecostoflosingone patient sphirecordis$355.soafirm thatdealswith100,000patientsinthisindustryisatriskof $35M ifadatabreachhappensstealingalofthesepatients records. Facedwithinsurmountablecostsanddemandfortalenttheyjustcan taccess,smbsturntomssps forhelpinaddressingtheirtechnical,resourceandbudgetchalenges. New Offeringfrom LeadingMSSPSecureDesigns,Inc.(SDI) Seceon+SonicWalZeroTrustapproachisacomprehensivereal-timepreventionmethod,aswelas detectionandresponseforbothnorth-southandeast-westtraffic.usingsonicwalnextgeneration

3 Amit firewals,sdioffersperimeter-baseddefensesformonitoringnorth-southtrafficandblocking unauthorizedaccess.simultaneously,usingseceon sotm forthreatdetectionandelimination,sdi isabletomonitor,detectandtakeactionforeast-westtrafficthatwouldnormalygoundetectedin Westtraffic,includingrouters,switches,servers,POS.directoriesandapplicationstoprovideasingle, comprehensiveview ofalfacetsofacustomer senvironment,includingprioritizedapplicationsto provideasingle,comprehensiveview ofalfacetsofacustomer senvironment,includingprioritized threatalertsandspecificactionstocontainthethreat.thissolutionnotonlydetectsthreatsin minutesitprovidescompleteanalysisanditautomatesremediationstepstoaclickofabuton.the averagetimespentperthreatcanbeafew minutespercustomerperincidenttodetectandstop theproblem. UsingourExample: 3threatspercustomerperday*Timespent:5minutesperthreat=yieldsacostof$8perday Corp.Ne. Public Operations ThisalowsanMSSPtoofferasuperiorserviceandchargeapremium WebServices Lab whilekeepingcoststooperatedowntoafew dolarspercustomer perday. ReferenceArchitecture DMZ DataCenterSer. Unknown Servers VPN-PPTP Servers BYOD DMZNetworks East-West East-West MSPInternalNetwork Internet CustomerVPN Networks MostSMBsandMSSPsareunable toproperlydealwithcyberthreats becausetheyaretooslow to identifyandstopthem from inflictingdamageoncethe traditionalsecuritydesigns.seceonintegrateseasilywithsonicwalngfw andanysourceofeast- organizationisbreached.more- over,mostsmbsdon thavethe resourcestospendoninvestigating everysecurityincidentandthus, aremorevulnerabletocyber securityatacks.automatingthis processwouldreducethisexpense and,mostimportantly,dramaticaly reducethevariablecostofdata breaches,whichcanbetensof milionsofdolarsdependingon thevalueorcriticalityofthe informationbeingbreached.by corelatingeventsandprioritizing legitimatethreats,seceonautomates tedious,butnecessary,manual tasks,improvingtheefficiencyof MSSPsecurityconsultantsand keepingthem focusedonaddressing cybersecurityissuescriticalto SMBsuccess. seceon.com 3

4 Considerthereferencearchitectureonhow SecureDesigns,orotherMSSP,candeploythecombined solutionofsonicwallandseceonotm.theseceonotm platform canscaleacrossmultiplecustomers whilemaintainingthesanctityofcustomerinformation,aswelasformssp sinternalnetworkand otherserviceprotections.multi-tenancyissupportedthroughasingleseceonotm platform,which providesseparatedashboardviewsformultiplecustomers,distributingthecostoftheplatform. Visibility Thefirststepinautomatingincidentanalysisandresponseistoprovidevisibilityintoaltrafficand thencorelateanyabnormalitieswithanomaliesinbehavior.seceonotm enablessecuredesigns tomaintainacomprehensiveview ofalcustomersthroughasinglepaneofglass-seeingeach customer sthreatstatusinonescreenwhilealowingprotectedportalaccesstoeachindividual customerenvironment. Real-TimeDetectionandElimination DataCenterSer. Servers Whencredentialsarecompromisedwithinminutes andmostofanorganization scriticaldataor intelectualpropertyislostwithinthefirsthour, timeisoftheessence.securedesignoffersa fulyintegratedseceonotm andsonicwall solutionthatprovidesautomated,real-time threatdetectionandeliminationby: Pushingpoliciestoisolateanysystems(end pointsorservers)thataremalware-infected ortopreventanexternalipfrom doingany harm (databreach) Corp.Ne. Public WebServices Operations DMZ Unknown VPN-PPTP Amit Servers Disablingofcredentialsinthecaseof compromisedcredentialsorinsiderthreats Preventinglateralpropagationofthreats Lab Multi-TenancySupport SeceonOTM providessecuredesignswithaproverbial SOC-in-a-Box, automatinghumanand timeintensiveanalysisanddecision-makingandsignificantlyspeedingthetimetodetectionand remediation.

5 ManagedsecurityServiceProvider AddClient Selectedtimeperiod:Last24hours Selectedrefreshrate:60seconds Clients AlState AtlasTech. DiNeroConstruction DowningIndust. FiveCentSavings FourtuneAcademy Minor:14 Critical:36 Major:5 Minor:145 GenericsBio New DealHospital OneFiveInc. Sampson ThomasRealEastate Zilow Major:3 Minor:45 1 Anticipatingatackers behaviorchoices,seceonenablessecure Designstoseeandstopthethreatsastheyhappenandsurfaces aconciselistofthreatsinplainlanguage.seceon sotm is purpose-builttobeoperationalyefficientandinstalationfriendly, alowingeasy-to-scaleandeffectivedeploymentwithminimal training.seceon sotm providessecuredesignswithasingle screenforviewingmultipletenantswhileenablingeachtenant orcustomertoonlyseeitsownassets.withseceonotm deployed,alsecuredesignscustomerscanbenefitfrom the platform smachinelearningcapabilities.anynew threatsare captured,reportedandfedbackintothesystem sthreatmodels, ensuringthecontinuoussharingofthreatinteligenceacross alcustomers. Seceon-SonicWalNGFW solution helpsmsspstoeasilyscalethe securityserviceswithlow initial investmentthatcanbeincreased incrementalywithgrowthintheir customerbase. Seceon szerotrustmodel,combined withtheefficacyofsonicwalngfw securityservices,breachdetection andmitigationiscontroledina swift,costeffectivemanner.the endresultisasafernetworkfor yourcompanyassets,personnel, andfinancialsuccess. AffordableInvestment,ImmediateROI SeceonOTM ssubscription-basedofferingisanaffordablemodelfororganizationsofanysize, providingimmediatecostsavingsthroughoperationalefficiency.theprotectedassets-based subscriptionmodelalowsmssps,includingsecuredesigns,todeployseceonotm withasmaler initialinvestmentandoperationalcoststhanmanycurentalternatives,includingsiems.thismodel enablesmsspstoeasilyscaletheirsecurityserviceswithlow initialinvestmentthatcanbeincreased asitscustomerbasegrows. seceon.com 5