Managing End Point Security Starts at the Perimeter DIR ISF April 14&15, 2016 Randy Guin, CISSP, CGEIT

What is an Endpoint? Desktop Computer Server Laptops Tablets Smart Phones POS Device Printers

What is End Point Security? End Point Security protects a network by requiring endpoint devices (laptops, mobile devices, etc.) to comply with corporate security standards before access is granted. These security standards may include an approved OS, a VPN client and anti-virus software.

What has Changed? Threat Landscape Virus/Trojans - old Phishing s – Social Engineering Malicious - Ransomware APT’s – AET’s Focus Privileged accounts - old Authenticated users End point devices – Management (who’s - what – when - where) Technology Antivirus – old Solutions Architecture – integrated security

5

End Point Security - Technology Methodology Signature based Specific code profiles – Palo Alto Heuristic / Behavorial Analysis IOC (Indicators of Compromise) – Tanium/McAfee/Fireeye Attack Indicators – Symantec ATP Proactive - Shavlik

Attack Focus

Endpoints – Who’s, What, When, Where? Who’s Company/Agency Employee’s Vendor What Desktop Laptop/Tablet Smart Phone POS When ???? Where Office Data Center Cloud Remote

The Perimeter Next Generation Firewall (NGFW) Fortinet - Palo Alto – Checkpoint– Cisco Application Awareness Authenticated Users Advanced Threat Protection Sand boxing (on prem and cloud)

The Perimeter Next Generation Firewall (NGFW) Gateways On Premise Cloud Internet – gmail, yahoo, hotmail MDM BYOD MAM VPN Other Agencies Vendors

Case Study Infrastructure – McAfee Implemented Tanium Implemented Malware Bytes Leveraged Palo Alto

What’s to come IoT – Internet of Things Endpoints Change the definition Number/types Manage Security Patches Integration Connectivity Anywhere - Anytime

Summary Endpoints what was what is what will be Threat Landscape Phishing s Malicious stuff APT’s – AET’s Technology Methodology Architecture What’s to come IoT Security Architecture Integrated Security

Questions?