Advance Endpoint Security

Advance Endpoint Security

1. Endpoint Security Basics

   • New techniques and types of attacks
     • Ransomware attacks
       • Infected machine is encrypted until ransom is paid
     • Living-off-the-land attacks
       • Pre-installed system tools to attack
       • Incrusion
       • Persistence
       • Payload
     • FIleless attacks
       • SQL Slammer
       • VBS load points
       • Dual-use tools: psExec.exe
       • Non-portable-executable
   • Understanding the Attack Cycle
     • Reconnaissance
     • Delivery
     • Exploitation
     • Execution
       • Establishing persistence
       • Escalating privileges
       • Commnand and Control
     • Lateral movement
       • Looking for critical assets
     • Exfiltration
       • Information encrypted and tranferered out of the network
   • Security Framework Next Generation Endpoint Security
     • Prevention
     • Application isolation and Control
     • Deception
     • Detection and Response
     • Mobile threat defense
     • Endpoint vulnerability and patch management

2. Next Generation Endpoint Protection Technologies

   • Machine Learning
     • Usefull detecting unknown threats
     • build models for interpreting actions and events for decision-making
     • Advance ML is usefull to detect zero-day exploit
   • Preventing Exploits
     • Memory Exploit Mitigation
       • Available on zero-day
   • Monitoring Behavior
     • Artificial Inteligency
       • Custom behavioral signatures
       • Lockdown policies to monitor script behavior as it executes real time
   • Intrusion Prevention and Firewall
     • HIPS
       • Detects potentially malicious network traffic
     • Personal Firewall
       • Packet filtering
       • Stateful inspection of traffic
       • Blocks connections based on rules
   • File Reputation
     • Real-time, cloud based threat intelligence to inspect, analyze and classify files
       • Classify by age, download frecuency, source
   • Emulation
     • Emulation Environment
       • Polymorphic virus, change its appearance in host programs

3. Application Isolation and Control

   • Trusted Applications Are the Riskiest
     • Allow scripted content
       • Microsoft Word, Excel and Adobe PDF
     • Can contain vulnerabilities
   • Preventing Attacks from All Angles
     • Threats
       • Blocked and eliminated inmediately
     • Potential threats
       • Monitored to identify behavior
     • Unknown
     • Potentially good
       • Protected from exploits
     • Known good
     • Blacklisting
       • "Allow" model, denying the applications that are blacklisted
     • Whitelisting
       • "Deny" model, allowing the applications that are whitelisted
     • Application isolation
       • "Zero-trust" model, restricts the behavior of approved applications

4. The Art of Deception

   • Trick attackers
     • Bait examples
       • Fake files
       • Fake crendentials
       • Fake network shares
       • Cached items
       • Fake endpoints
   • Need for Deception
     • Common attacks
       • Social Engineering
       • Technology vulnerability
       • Endpoint weaknesses
       • Misconfigurations
   • Offensive layer

5. Detection and Response

   • Cloud-Based Threat Intelligence
     • Phase One: Environment assesment
       • Environment examination
       • Threat events
       • Adversary intelligence
       • Continuos recording
       • User account abuse
       • Persistence mechanisms
       • DLL injection
       • Command line and interactive behavior
       • Perimeter event logs
       • DNS logs
     • Phase Two: Deep analysis and threat behavior verfication
       • High Risk Endpoint
       • Active threat hunting
       • Sandboxing and payload detonation
       • Additional indicators
       • Network connections and ip reputation
       • Software usage history
       • Memory artifacts
   • Isolating and Investigating Threats
     • Spot, understand and isolate threats
     • Understand threats in the environment
       • Identify all affected endpoints
     • Respond faster
       • Plan and execute an effective responde
     • Reduces risk
       • Make configuration changes based on vulnerabilities identified in the enviroment
     • Remediation
       • Quarantine
       • Blacklist files, URLs and IP addresses
       • Delete files and artifacts that impacted the endpoint

6. Mobile Threat Defense

   • Exposed Attack Surface
     • Mobile security requieres different aproach
       • Different resources
       • Different operating systems
       • Different user behavior
         • Bring-your-own-device
   • Mobile device management
   • Containerization
   • VPN tunneling
     • Disadvantages
       • Disrupted privacy and enablement
       • Lack of seamless continuity
         • High latency problems affecting productivity and workflow
       • Incomplete security
   • Protecting against Network, Device, OS and Application Vulnerabilities
     • Mobile threat defense must
       • Non-invasive experiences
       • MInimal fooprint
       • Ease of use
       • Accurate alerts

7. Good Endpoint Hygiene with Patch Management

   • The Continuing Issues with Vulnerabilities
     • Products rushed into the market
     • Effective patch management
       • Good endpoint security
   • Full Endpoint Estate Visibility - Inside and Outside the Network
     • Modern threat landscape
       • Worm
       • Malware
       • Ransomware
   • Common challenges for organizations
     • non-Microsoft operating systems and applications
       • MacOS
       • Unix
       • Linux
       • Adobe
       • Google
       • Java
       • Oracle
   • Effective patch management
     • Broad coverage across operating systems
     • Broad support for apllications
     • Appropiate priorization of updates
     • Automatization and optimization of the patching process
     • Test the impact on the system or application

8. Integrating Endpoint Security with the Rest of Your Security Infraestucture

   • Security Information and Event Managers (SIEM)
     • Export threat events to a SIEM via a connector or app
     • Help SOC teams correlate and priritize threat data
       • Security Operations Center (SOC)
     • Should allow incident responders to blacklist and delete malicious files
     • SIEM unifies
       • Endpoint Security
       • Network Security
       • Email Security
       • Cloud Security
   • Security Orchestration, Automation and Responce (SOAR)
     • Allow customers to collect disparete security and threat data from a variety of sources
       • Enable automated and standarized incident responce workflows
     • Execution of incident analysis and responce procedures via automated playblooks
   • Ticketing
     • Monitor the process of critical resquest and report on incident perfromance metrics

9. Ten tips for Effective Endpoint Security

   • Conduct end-user security awareness training
   • Harden your enpoint with application isolation and control
   • Be deceptive
   • Use personal firewalls and HIPS
   • Install DLP solutions
   • Enable disk encryption
   • Protect mobile devices
   • Leverage cloud-based threat inteliigence
   • Integrate enpoint security in the rest of your security ecosystem
   • Patch vulnerabilities