1. Synchronized Security
Paul Zindell
SE, Mountain Region
“I didn’t understand it but the half hour wasn’t boring to a technologically impaired person. I actually listened to the whole thing.” – Fela, Paul’s Mom
“Much of the high tech terminology was beyond my understanding, but your expertise and command in computer security is impressive.” – Larry, Paul’s Dad
Andy Thomas – original member of N Sync
I Can Feel Your Heartbeat
Don’t Turn Me Red
Keep ‘em Isolated
2015 – Launched Sync Sec
2016 – Partner Momentum (New Accounts, Cross-sell NW/End)
2017 – Customer Traction

3. Increasing attacks, increasing sophistication
Attack surface exponentially larger
Attacks are more sophisticated than defenses
Threat landscape is constantly changing
Average user had 3 devices and both user and device are mobile
Everything will be Cloud Managed
IoT
Attackers coordinate and combine tecniques to improve thier strike rate.
Resuable code, online tools, it’s easy
Soccer/Football – Red Cards (7 player minimum)
Laptops/Desktops
Phones/Tablets
Virtual servers/desktops
Cloud servers/storage
IoT
Syndicated crime tools
Zero day exploits
Memory resident
Polymorphic/metamorphic
Multilevel botnets

4. Synchronized Security
Admin
| Manage All Sophos Products
Self Service
| User Customizable Alerts
Partner
| Management of Customer Installations
Sophos Central
In Cloud
On Prem
Next-Gen Firewall
Next-Gen Endpoint
Wireless
Mobile
Server
Web
Encryption
How do we solve this issue?
Our Vision/Strategy/Ref Architecture
All products working together in a system (security services)
Best of Breed vs. Integrated System – old thinking
Heartbeat, Cloud Intelligence, Analytics – for Action, not Info
Managed by Sophos Central (Easy, Scale, Service)
Who is using it? POLL
Cloud Intelligence
Analytics
| Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
Sophos Labs
| 24x7x365, multi-continent operation |
Malware Identities | URL Database | Machine Learning | Threat Intelligence | Genotypes | Reputation | Behavioral Rules | APT Rules | App Identities | Anti-Spam | DLP | SophosID | Sandboxing | API Everywhere

5. Synchronized Security
Best of breed security system that enables your defenses to be more coordinated than the attacks.
Unparalleled Protection
Automated Incident Response
Real-time Insight and Control
Breach Prevention
Reduce Breach Impact
Simplify IT Management
Rest of presentation – IN ACTION
Demos
Customers
How it’s being sold

6. Next-Gen Endpoint Protection
Synchronized Security
Device And App Control
Reputation Security
Signatures Genes
Prevention
Exploit
Behavioral Detections
Memory Scanning
CryptoGuard
Sophos Central Mgmt.
pre- -->
<-- post-
Machine Learning
Root Cause Analysis
Malicious Traffic Detection
.exe Malware
Malicious URLs
Non-.exe Malware
Exploits
Sync Security is broader than Heartbeat
Technologies within the Endpoint work together
One tech spots suspicious, can kick off another tech to scan
Script-based Malware
Removable Media
Phishing Attacks
Unauthorized Apps

7. Next-Gen Endpoint + Network Protection
Web Protection
Protection
Sandboxing
Application Protection
User identity
Encrypted Traffic Inspection
Advanced Threat Protection
IPS
Synchronized Security
Device And App Control
Reputation Security
Signatures Genes
Prevention
Exploit
Behavioral Detections
Memory Scanning
CryptoGuard
Sophos Central Mgmt.
pre- -->
<-- post-
Machine Learning
Root Cause Analysis
Malicious Traffic Detection
.exe Malware
Malicious URLs
Non-.exe Malware
Exploits
ATP finds bad URL, bad traffic, but unknown
Asks endpoint for detail – run a scan, or give me the process info
Script-based Malware
Removable Media
Phishing Attacks
Unauthorized Apps

8. Security Heartbeat Available Now
Admin
| Manage All Sophos Products
Self Service
| User Customizable Alerts
Partner
| Management of Customer Installations
Sophos Central
In Cloud
On Prem
Security Heartbeat™
UTM/Next-Gen Firewall
Next-Gen Endpoint
Server
Encryption
Cloud Intelligence
Analytics
| Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
Sophos Labs
| 24x7x365, multi-continent operation |
URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

9. Bad guy’s trilemma Leaves Sophos Security alone Disable
Disable Heartbeat
Sophos sees everything they do
Intercept X blocks attack
Red Health sent through HB
FW Isolates Endpoint
FW detects Missing Heartbeat
FW Isolates Endpoint

10. Lateral Movement Detection and Prevention
XG Firewall
Endpoints
Security Heartbeat™
Security Heartbeat™
Internet
Servers
Detection and Isolation

11. Lateral Movement Detection and Prevention
XG Firewall
Endpoints
Security Heartbeat™
Security Heartbeat™
Internet
Servers
Detection and Isolation – Endpoint Stonewalling

12. Lateral Movement Detection and Prevention
Security Heartbeat™
XG Firewall
Endpoints
Security Heartbeat™
Security Heartbeat™
Internet
Servers
Detection and Isolation – Wireless Heartbeat

13. Lateral Movement Detection and Prevention
XG Firewall
Endpoints
Security Heartbeat™
Internet
Servers
Detection and Isolation – Destination Based Rules

14. Automated Incident Response
Available
Next
Security Heartbeat
Intercept X
Server Heartbeat
Synchronized Encryption
Credential Theft Detection
Synchronized
Endpoint Stonewalling
Synchronized Mobile
Wireless Heartbeat
Isolation
Lateral Movement Detection and Prevention

15. Reporting and Analysis
Infrastructure visibility
Machine, Process, User
Threat chain visibility
Security Heartbeat
Active Threat ID
Root Cause Analysis

16. Dynamic Application Control – Coming Soon
Automatically identifies unknown app traffic
Better visibility than any other Firewall on the market
Risk Reduction
Morphing Apps attempting to avoid Firewalls/Sandboxing
Suspicious Applications
Performance improvement
Bandwidth storms

17. Synchronized Security
Security Heartbeat™
UTM/Next-Gen Firewall
Next-Gen Endpoint
Wireless
Mobile
Server
Encryption
Web
“It only took 2 minutes to find out that everything was under control. Sophos XG Firewall detected the threat and Security Heartbeat allowed the infected host to be immediately identified, isolated and cleaned up. Instead of going into fire drill mode, we were able relax and finish our lunch.”
DJ Anderson, CTO, IronCloud