1. Defeat Tomorrow’s Threats Today

2. Problems Evolving threat landscape
Traditional security detection being bypassed
Lack of enterprise incident response tools

3. Value Proposition Belief that your network is targeted by bad guys
Belief that traditional detection is easily bypassed
Desire for proactive early detection
Desire to learn what adversaries are doing
Want automated and scalable incident response

4. Detection at Endpoints
HBGary’s Big Picture
Detection at Endpoints
Forensic Analysis
Incident Response
Threat Mitigation

5. Physical Memory Forensics
Endpoint Detection
Digital DNA
(Behavioral Analysis)
Code
Reverse
Engineering
Physical Memory Forensics
Under the hood we start with physical memory. If you ever looked at a memory dump you’ll see that it is unstructured garble-dee-goop. HBGary has reverse engineered over 50 undocumented Windows structures to give you organized information of the data contained in memory. We uncover all digital objects, so automated reverse engineering on each and every binary to uncover low level behaviors. Digital DNA examines the behaviors to identify which binaries are malware.

6. Digital DNA Automated malware detection
Digital object classification system
5000 software and malware behavioral traits
Example
Huge number of key logger variants in the wild
About 6 logical ways to sniff a keystroke

7. Ranking Software Modules by Threat Severity Software Behavioral Traits
Digital DNA
Ranking Software Modules by Threat Severity
0B 8A C2 05 0F F B ED C D
8A C2
Malware shows up as a red alert. Suspicious binaries are orange. For each binary we show its underlying behavioral traits. Examples of traits might be “packed with UPX”, “uses IRC to communicate”, or “uses kernel hooking with may indicate a presence of a rootkit”. The blue bar shows the Digital DNA sequence for the binary iimo.sys.
0F 51
0F 64
Software Behavioral Traits

8. Efficacy Curve Efficacy is rising ZERO KNOWLEDGE DETECTION RATE DDNA
Detecting more (> 80%)
ZERO KNOWLEDGE DETECTION RATE
Detecting very little
Signatures
And scaling issue getting worse

9. Active Defense Endpoint Visibility
Web-based console
Network
Digital DNA™
Physical Memory
Raw Physical Disk
Live Operating System
Event Timeline
AD Server
Host Information Sources
https
Under the hood we start with physical memory. If you ever looked at a memory dump you’ll see that it is unstructured garble-dee-goop. HBGary has reverse engineered over 50 undocumented Windows structures to give you organized information of the data contained in memory. We uncover all digital objects, so automated reverse engineering on each and every binary to uncover low level behaviors. Digital DNA examines the behaviors to identify which binaries are malware.

10. Efficacy of IOC Scans Blacklists Code-level IOC’s Lifetime 
Signatures
Code-level IOC’s
NIDS sans address
Lifetime 
IP Address
Protocol
Install
Hooks
Algorithms
Checksums
Developer Toolmarks
DNS Name
Minutes Hours Days Weeks Months Years
Under the hood we start with physical memory. If you ever looked at a memory dump you’ll see that it is unstructured garble-dee-goop. HBGary has reverse engineered over 50 undocumented Windows structures to give you organized information of the data contained in memory. We uncover all digital objects, so automated reverse engineering on each and every binary to uncover low level behaviors. Digital DNA examines the behaviors to identify which binaries are malware.

11. Traditional Forensics and Incident Response are Difficult
Requires lots of technical expertise
Time consuming
Expensive
Doesn’t scale
Traditional methods to analyze memory and malware are difficult. It requires expertise, is time consuming and expensive, and it doesn’t scale. 15

12. Responder Professional

13. Threat Mitigation Bolster network defense through intelligence
Develop new network device signatures
Inoculation Shot
Alternative to re-imaging
Enterprise malware removal

14. Integration with McAfee ePO
Responder
Professional
ePO
Console
ePO
Server
ePO
Agents
(Endpoints)
DDNA is automatically installed across the enterprise by ePO. We give a ePO a couple of zip files. ePO installs HBGary code onto the ePO server and onto each endpoint. The ePO scheduler tells DDNA when to run on each endpoint. We run, examine memory, create DDNA alerts, hand the alerts and traits to the ePO agent which sends them to the ePO SQL server. The DDNA alerts are displayed on the ePO console. DDNA is not installed as an agent. It is a command line utility that loads runs when ePO tells it to. After executing DDNA exits memory. ePO’s AV, firewall and HIDS runs 24x7 as a service. DDNA runs at a point in time to find malware.
Schedule
Licensing
HBGary
Active Defense
Server
SQL
Events
Search
Collect
HBG Extension
HBGary DDNA