1. Ilija Jovičić
Sophos Consultant

2. Where Malware is stopped at the Endpoint
80%
10% 5%
Reduce attack surface
URL Filtering
Download Reputation
Device Control
Pre-execution analysis
Heuristics
Rule based
Signatures
Known Malware families 3% 2%
Runtime
Behaviour monitoring
Exploit Prevention
Detection of exploit techniques
Traditional Malware
Modern Threats

3. Sophos Stops Crypto-Malware Anti-Ransomware Anti-Exploit
LIMITED VISIBILITY
RANSOMWARE
ZERO DAY
EXPLOITS
Stops Crypto-Malware
Detects and prevents unauthorized encryption
Restores unencrypted original files
Anti-Ransomware
Anti-Exploit
Stops unknown Malware
Signatureless prevention of 0-Day Malware
No performance impact
Removes the threat
Forensic detection and signatureless removal of yet unknown Malware
Extended Cleanup
Analyzes the attack
What has happened?
What is affected?
How do I prevent this in the future?
Root Cause Analysis
CRIME SCENE CLEANUP
Intercept X CryptoGuard technology protects you from ransomware that encrypts your data. Now we are adding boot record and disk wipe protection to further defend your computer against tampering.
CryptoGuard for servers
CryptoGuard now stops ransomware from encrypting data on Windows servers, including network shares. It can protect against ransomware running locally or remotely. You'll need a Server Protection Advanced license

4. CryptoGuard - local Ransomware
Unecrypted file before write operation
File write
Encrypted file after write operation
Secure file backup
Root Cause Analysis
Extended Cleanup with Sophos Clean

5. Where is the real threat?
Haha! All your files are encrypted! Give me money!
Let‘s see what we can find here..

6. Exploit Prevention Detection of new Malware via Exploit Techniques
Patches
Patches
Exploit Prevention
Signatures, Heuristics
Reputation
Behavioral Detection
Time
Vulnerabilities
Bugs in applications or the operating system
1,000*n /Year
Zero-Day-Exploits
Code, that uses unknown vulnerabilities ?
100*n /Year
Known Exploits
Code, that exploits known vulnerabilities
Malware
Typically uses exploits to infect target systems and executes malicious payload (e.g. encryption, data theft)
/Year 25
Exploit Techniques
Techniques to run malicious code within vulnerable applications, e.g. via buffer overflows

7. Exploit Prevention Detection of new Malware via Exploit Techniques
Patches
Patches
Exploit Prevention
Signatures, Heuristics
Exploit Prevention
Signatureless protection against 0-day attacks
No performance impact
Prevents the exploitation of vulnerabilities in insecure or unpatched applications
Stops the attack
Reputation
Behavioral detection
Time
Vulnerabilities Bugs in applications or the operating system
1,000*n /Year
100*n /Year
Known Exploits
Code, that exploits known vulnerabilities 25
Exploit Techniques
Techniques to run malicious code within vulnerable applications, e.g. via buffer overflows
Zero-Day-Exploits
Code, that exploits unknown vulnerabilities ?
Available in
Sophos Intercept X
Endpoint eXploit Prevention

8. Analysis of the incident
Root Cause Analysis
Analysis of the incident
Identification of relevant processes, registry keys, files and communication
Graphical display of chain of events
Identifies source of infection
What happened?
What is affected?
Affected Ressources
Which files and systems are affected?
Which file shares or removable media are affected?
What other systems do I have to clean up?
Consequences
Which malware entry channels do I have to close?
How can I prevent malware from spreading inside my network?
How do I prevent this in the future?

9. Intercept X Root Cause Analysis

10. Synchronized Security replaces best of breed
Sophos Central
Next-Gen
Firewall
UTM
Endpoint
Wireless
Next-Gen Endpoint
Analysis
Web
Mobile
Server
File Encryption
Disk Encryption

11. Security Heartbeat – Virus infection
Virus detected
Remove keys
Client in network quarantine

12. Demo