Ilija Jovičić Sophos Consultant

Where Malware is stopped at the Endpoint 80% 10% 5% Reduce attack surface URL Filtering Download Reputation Device Control Pre-execution analysis Heuristics Rule based Signatures Known Malware families 3% 2% Runtime Behaviour monitoring Exploit Prevention Detection of exploit techniques Traditional Malware Modern Threats

Sophos Stops Crypto-Malware Anti-Ransomware Anti-Exploit LIMITED VISIBILITY RANSOMWARE ZERO DAY EXPLOITS Stops Crypto-Malware Detects and prevents unauthorized encryption Restores unencrypted original files Anti-Ransomware Anti-Exploit Stops unknown Malware Signatureless prevention of 0-Day Malware No performance impact Removes the threat Forensic detection and signatureless removal of yet unknown Malware Extended Cleanup Analyzes the attack What has happened? What is affected? How do I prevent this in the future? Root Cause Analysis CRIME SCENE CLEANUP Intercept X CryptoGuard technology protects you from ransomware that encrypts your data. Now we are adding boot record and disk wipe protection to further defend your computer against tampering. CryptoGuard for servers CryptoGuard now stops ransomware from encrypting data on Windows servers, including network shares. It can protect against ransomware running locally or remotely. You'll need a Server Protection Advanced license https://news.sophos.com/en-us/2016/09/26/what-is-an-exploit/

CryptoGuard - local Ransomware Unecrypted file before write operation File write Encrypted file after write operation Secure file backup Root Cause Analysis Extended Cleanup with Sophos Clean

Where is the real threat? Haha! All your files are encrypted! Give me money! Let‘s see what we can find here..

Exploit Prevention Detection of new Malware via Exploit Techniques Patches Patches Exploit Prevention Signatures, Heuristics Reputation Behavioral Detection Time Vulnerabilities Bugs in applications or the operating system 1,000*n /Year Zero-Day-Exploits Code, that uses unknown vulnerabilities ? 100*n /Year Known Exploits Code, that exploits known vulnerabilities Malware Typically uses exploits to infect target systems and executes malicious payload (e.g. encryption, data theft) 100.000.000 /Year 25 Exploit Techniques Techniques to run malicious code within vulnerable applications, e.g. via buffer overflows

Exploit Prevention Detection of new Malware via Exploit Techniques Patches Patches Exploit Prevention Signatures, Heuristics Exploit Prevention Signatureless protection against 0-day attacks No performance impact Prevents the exploitation of vulnerabilities in insecure or unpatched applications Stops the attack Reputation Behavioral detection Time Vulnerabilities Bugs in applications or the operating system 1,000*n /Year 100*n /Year Known Exploits Code, that exploits known vulnerabilities 25 Exploit Techniques Techniques to run malicious code within vulnerable applications, e.g. via buffer overflows Zero-Day-Exploits Code, that exploits unknown vulnerabilities ? Available in Sophos Intercept X Endpoint eXploit Prevention

Analysis of the incident Root Cause Analysis Analysis of the incident Identification of relevant processes, registry keys, files and communication Graphical display of chain of events Identifies source of infection What happened? What is affected? Affected Ressources Which files and systems are affected? Which file shares or removable media are affected? What other systems do I have to clean up? Consequences Which malware entry channels do I have to close? How can I prevent malware from spreading inside my network? How do I prevent this in the future?

Intercept X Root Cause Analysis

Synchronized Security replaces best of breed Sophos Central Next-Gen Firewall UTM Endpoint Wireless Next-Gen Endpoint Analysis Web Mobile Email Server File Encryption Disk Encryption

Security Heartbeat – Virus infection Virus detected Remove keys Client in network quarantine

Demo