Download presentation
Presentation is loading. Please wait.
1
A Virtual Tour of SophosLabs Building next-generation protection
Fraser Howard Principal Researcher September 2016
2
Current Threat landscape SophosLabs Systems Layered Protection Demo
Agenda Current Threat landscape SophosLabs Systems Layered Protection Demo
3
Current Threat Landscape
4
Snapshot of 2016 Threat Landscape
150,000 Suspicious URLs seen & analysed daily 30,000 Malicious URLs daily, over 80% of which are from legitimate web sites 5 million Spam messages daily across 20 countries Malware samples added to Live Protection cloud daily 400,000 Previously unseen files received daily 2,000 Previously unseen Android apps daily 600 million Live Protection lookup events added to Hadoop cluster 50% Of detections based on small number of samples
5
Impact on security Automation Visibility Layered protection
Automated dynamic analysis Cloud response Visibility Track active campaigns Monitor protection levels Layered protection Protection technologies Application control
6
Roles & Responsibilities
SophosLabs Roles & Responsibilities Global Team Real-time response to incidents 24/7/365 operation Threat Response Deep expertise into threats & attacks Create powerful protection solutions Threat Research Build bespoke systems to automate threat analysis & response Enable SophosLabs to scale Automation development Ensure effectiveness & quality of releases Own risk management Quality Assurance Abingdon Vancouver Budapest Ahmedabad Sydney
7
SophosLabs Team Structure
Heuristic rules Advanced detection Customer escalations Anti-spam Android OSX Unix/Linux Android, Linux & Mac Files, URLs, IPs, certs Whitelisting Classifiers Automation Reputation Services Windows malware, PUAs, AppC TFT Unpacking Frameworks Generic Detection Runtime detections (CX, HIPs, mem) Web (CXweb) (CXmail) Dynamic Detection APTs Exploits New, niche threats Knowledge gain Emerging Threats Snort IPS data IPS automation C2 signatures Network Security
8
SophosLabs Systems (live!)
9
Web distributed threats
Visibility campaigns Web distributed threats Global spam traps Real-time picture of spam Phish Scams Meds Malware distribution Social engineering Education? The Web – all about content delivery, good or evil. Millions of pages scanned each day Telemetry provides visibility into malicious activity Track attacks Monitor Exploit Kits
10
Attack Demo: Spam campaign delivering Locky ransomware
Similar presentations
![[Name / Title] [Date] Effective Threat Protection Strategies.](/22/6388818/big_thumb.jpg "[Name / Title] [Date] Effective Threat Protection Strategies.>")
