Per Söderqvist Per Söderqvist Sales Engineer Some points to make: 3 Crucial things Layered security – well bars will only help you so and so much Sync Security – If guards and security systems can communicate this will be a weakness. RCA: End with this what is the most important thing well learning from your mistakes… Per Söderqvist Per Söderqvist Manager, Sales Engineer Nordics Sales Engineer

Next-Gen Firewall UTM Endpoint Wireless Analytics Next-Gen Endpoint Education Web Mobile Email Server File Encryption Disk Encryption

^Source: The State of Endpoint Security Today Survey CryptoCurrency malware using other machines to mine Crypto Advanced Malware *Malware that will not be detected by traditional AV New version of ransomware *Mery Christmas Ransomware SamSam RaaS Source: SophosLabs ^Source: The State of Endpoint Security Today Survey

Demo

Most Common Network Topology Vulnerable to lateral movement Internet Firewall Local Area Network Switch Now when it comes to the spread of threats on the internal network or LAN (also called lateral movement) it’s important to give the Firewall a fighting chance of blocking it. The Engineers in the audience probably already know this, but this illustration shows one network topology that is often used by customers that is not recommended for the best protection since all endpoints are connected through a single switch fabric and able to talk to each other without the firewall inspecting any of that traffic. In this setup, the firewall can only see traffic flowing in or out of the network, so while it can help prevent threats entering the network, it cannot prevent threats spreading unhindered within the network. INFECTED HOST INFECTED HOST

Best Practices Network Topology Internet Firewall Internal Zone IoT Zone Server Zone Guest Zone That’s why we recommend network segmentation as a best-practice topology for deploying a firewall… Segment LANs into smaller, isolated zones or VLANs that are secured and connected together by the firewall.  Then be sure to apply suitable IPS policies to rules governing the traffic traversing these LAN segments to prevent exploits, worms, and bots from spreading between LAN segments. XG Firewall offers flexible and easy segmentation tools like zones and VLANs to secure your LAN and reduce the risk of lateral movement and our hardware supports lots of additional ports specifically for this kind of setup.

Protection layers on the Endpoint Web Control Device Control App Control Firewall Control infection paths Web Security Deep Learning Skript- Analysis Download Reputation Live Protection Signatures Heuristics Pre-execution Host Intrusion Prevention Credential Theft Protection Exploit Prevention Anti-Hacker Anti- Ransomware Memory Scan Botnet-Traffic- Detection During execution Extended Cleanup Blocking Quarantine Recovery Synchronized Security Reaction Logging & Reporting Central Management Root Cause Analysis Alerting Visibility

Control infection paths Web Control Device Control App Control Firewall Control infection paths Web Security Deep Learning Skript- Analysis Download Reputation Live Protection Signatures Heuristics Pre-execution Credential Theft Protection Exploit Prevention Host Intrusion Prevention Anti-Hacker Anti- Ransomware Memory Scan Botnet-Traffic- Detection During execution Extended Cleanup Blocking Quarantine Recovery Synchronized Security Reaction Logging & Reporting Central Management Root Cause Analysis Alerting Visibility

Intercept X was built to defend against not just known threats, but never-seen-before threats as well With the power of our deep learning technology and advanced capabilities, we can actually foretell the good from the bad. And in a way, it lets us “see the future.” And as we like to say here at Sophos, “Seeing the future is the future of cybersecurity.” (click)

What is Sophos ? PROTECTION FROM UNKNOWN THREATS PROTECTION FROM RANSOMWARE PROTECTION FROM HACKER ACTIVITY EXTENDED CLEANUP ROOT CAUSE ANALYSIS Intercept X ist ein per Sophos Central verwaltetes Produkt, das die vorher genannten Technologien beinhaltet und zusätzlich zu einem bestehenden Endpoint/Anti-Virusprodukt eingesetzt wird – sei es ein Sophos Central verwalteter Endpoint oder ein Mitbewerber-AV

Invincea’s Data Scientists using DARPA driven technology One of the first IT-Security vendors to use Deep Learning

Computing power and deep knowledge about Artificial Intelligence 100’s of Millions of Malware Samples Computing power and deep knowledge about Artificial Intelligence

Synchronized Security Linking Network and Endpoint security to deliver unparalleled protection by automating threat discovery, analysis, and response.

Sneak Preview.

Social Engineering – One of the biggest threats Social Engineering bypasses all technologies, including firewalls. – Kevin Mitnick

Demo PhishThreat