Embed Size (px)
Citation preview
The Current State and Future Path of Endpoint
Security
In conjunction with:
Adrian Sanabria
(@sawaba)
• Industry Analyst: 4 years
• Red Team: 5 years
• Blue Team: 5 years
• IT: 4 years
• Compulsive researcher
• ‘Big Picture’ focus
• Often find inspiration outside InfoSec
2
TL
;DL
The Big Picture
Indust
ry
Trends and Terms
Indust
ry The Market View
Anal
ysi
s
The Future
Technology has changed
Attacker tactics have changed
Defenses stayed the same...
Sorry, no, they got worse
• Endpoint Security is primarily a
Windows problem
• Microsoft is currently innovating
faster than the AV industry
• Most enterprises use 3 or more
endpoint solutions simultaneously
4
TL;DR, or before I lose you in my rant...
Yes, there is a “but”
Endpoint Security is already solved!
Security Usability
The evolution of endpoint security
6
• Endpoint Security = AV2002• Endpoint Security = AV, VPN client, NAC client,
host-based FW, HIPS, FDE, patching, device/port control, FIMaaaaaaa, this is so confusing!2005
• Heavy consolidation2006
• Endpoint Security = EPP (AV ‘suites’)2008
The evolution of endpoint security
7
• Rise of the advanced, sophisticated moderately competant adversary2010
• Endpoint Security = AV, NGAV, EDR, Threat Hunting, Isolation, Exploit Prevaaaaaaaaaaaaa, this is so confusing!2015
• Heavy consolidation2016+
• Endpoint Security = NGEPP? (please, no)2018
Why is the endpoint important?
1. This is where work happens
2. One of the easiest paths into a company
3. BYOD and ShadowIT are unsolved problems
4. Endpoints don’t stay at work anymore…
Why endpoint?
12
Blind Spot #3:
The Cloud
Most enterprise spending
is tied up in the perimeterBlind Spot #1:
The Endpoint
Blind Spot #2:
Internal network Communications
(East-West traffic)
Blind Spot #4:
Data
Where did we go wrong?
1.Not enough root cause analysis
2.Not enough process improvement (if any)
3.Even when we do succeed, we force the attacker to change tactics.
Are we ready for that?
Discarding useful tech because it wasn’t a silver bullet
2011: “By 2015, more than 50% of enterprises will have instituted 'default deny' policies that restrict the applications users
can install.”
14
TL
;DL
The Big Picture
Indust
ry
Trends and Terms
Indust
ry The Market View
Anal
ysi
s
The Future
Buzzwords explained: NGAV and EDR
NGAV: The ability to stop threats without prior knowledge of them
A variety of new techniques, significantly more effective at stopping unknown threats.
EDR: Endpoint Data Recorder (a slight acronym modification)
What makes a product NGAV?
17
Use of one or any of these new(ish) malware prevention techniques:
• Use of static machine learning models on the endpoint
• Examples: Cylance, Crowdstrike, Sophos (Invincea X), Symantec
• OS Level Behavioral Analysis (observing malware behavior)
• Examples: SentinelOne, Crowdstrike, Barkly, Cybereason
• Exploit prevention
• Examples: Palo Alto TRAPS, Endgame, Digital Immunity, Sophos (HitmanPro)
• A few other novel techniques
• Virtual patching in-memory (0Patch)
• Various kernel shims and anomaly detection (Abatis, Ceedo, ROMAD)
• Memory randomization (Morphisec)
Myth-busting time: ML/AI versus ‘Signatures’
1. AV hasn’t been ‘signature-based’ since the early 1990s.
2. ML is still effectively pattern-matching.
3. ML relies on the analysis of existing malware.
4. ML/AI is demonstrably better at detecting unknown malware, but is also more false-positive prone.
The only time I want to hear “Next Generation”
19
Our long-range
sensors suggest the
term ‘next-gen’ is
more harmful than
helpful!
I don’t think AI
means what they
think it means.
What comes after ‘next-gen’?
Nothing.
2013-2016Next-Gen AV describes a
variety of new approaches to
detecting and stopping binary
malware.
2017+Next-Gen AV techniques have
been absorbed into existing AV
suites, and NGAV startups have
become suites.
NGAV is now just ‘AV’.
EDR: Endpoint Detection and Response
Many use cases:
• detection
• forensics
• incident response
• source for automation event triggers
Ultimately, EDR is a sensor that provides rich, forensic data before you need it
21
What about remediation and response?
Who is cleaning this mess up?
Discuss: Remediation vs Containment
Explain: Automated Endpoint Remediation
22
What about remediation and response?
23
Silly marketing trend: using percentages
1. A percentage isn’t useful at large scale.
2. The raw number stopped isn’t important.
3. Percentages can’t measure threats that don’t exist yet.
4. Adversaries don’t give up when a single attack fails
Attacks simply don’t work this way.
99% coverage!
The dog is gone.
100% coverage!
TL
;DL
The Big Picture
Indust
ry
Trends and Terms
Indust
ry The Market View
Anal
ysi
s
The Future
Industry missteps
Products that only work on the corporate network
Products that break the user
Assuming any one layer must achieve 100% efficacy
Products that bury the customer in data
Making consumers a secondary priority
28
The endpoint security market, high level
Prevention (pre-execution)
Detection and Data Collection (post-execution)
Platform Hardening80+
Vendors
65/45 split
complementary/
primary
NGAV
NEED: a better malware
mousetrap
WHAT: Automated detection of
unknown threats
WHY: auto-generated
malware gets through
EDR
NEED: endpoint visibility; serious
blind spot otherwise
WHAT: Record detailed endpoint
data
WHY: detect attacks that defeat
1st layers of defense
Hardening
NEED: More permanent,
resilient solutions
WHAT: Wide variety of
approaches
WHY: Passive defenses reduce
pressure on frontline defenses
Remediation
NEED: Contain and clean up
threats
WHAT: Containment and
automated remediation
WHY: Reduce expense and labor
of dealing with threats
Endpoint categories: What’s driving them?
Prevention vs Detection: Pros and Cons
Prevention (e.g.
AV, NGAV)
Detection (e.g.
EDR)
Likelihood of user disruption Low to none Generally higher
False positives Lower Higher
False negatives Higher Potentially lower
Detect/prevent non-malware threats Generally, no Yes
Labor-to-value ratio Low High
The First Great Endpoint Security Consolidation
32
2003 2006 2010
~30 acquisitions
Events that helped kickstart the Second Great Endpoint
Security Consolidation
Before 2010
2003-2009
• Mostly adjacent endpoint security/management technologies
• Took our eyes ‘off the ball’
• Got waaaay too excited about whitelisting
• Laptops instead of Desktops
After 2010
2010: Stuxnet• State-sponsored malware
2013: APT1• More state-sponsored malware
2013: Snowden• Domestic malware, threats and attack
tools
2014: Ransomware
33
The Second Great Endpoint Security Consolidation
34
2010 2014 2017+
~30 acquisitions (so far)
TL
;DL
The Big Picture
Indust
ry
Trends and Terms
Indust
ry The Market View
Anal
ysi
s
The Future
In a word: Microsoft
• EMET
• AppLocker
• Device Control
• LAPS
• Windows 10 S
• Credential Guard
• Defender SmartScreen
• Defender AV
• Defender Application Guard
What’s the future of endpoint security?
• DEP
• ASLR
• SEHOP
• Controlled folder access
• Defender
• AMSI
• MSRT
• Sysmon
• Sysinternals Suite
Is antivirus dead?
“Nobody wants to say antivirus is
dead, but let’s just say they’re planning
ahead for the wake and eyeing the
stereo.”Wendy Nather, 451 Research (2013)
Adrian’s Endpoint Security Roadmap
1. Build a better malware mousetrap (NGAV)
2. Threat-driven hardening (kill Flash!)
3. Detect/Stop Non-Malware attacks
4. Full-system visibility (EDR)
5. Data visibility
6. More resilient host (less need for AV)
38
Do enterprises even need better AV?
Hardening Windows
• CIS benchmarks (hardening)
• Update to Windows 10!
• Ad-blocking
• Remove unnecessary software/features
• Least privilege:
• flash click-to-run,
• disable/restrict java plugin
• selective whitelisting
Free/OSS Tools
• Microsoft EMET
• Microsoft AppLocker
• Artillery (Binary Defense)
• OSSEC (Trend Micro)
• El Jefe (Immunity)
• Sandboxie (Invincea)
• AIDE (FIM)
• ROMAD
• 0Patch
• OSQuery
39
Adrian Sanabria - @sawaba
Ed Rojas
http://TacticalEdge.co
