How to improve endpoint security on a SMB budget
Download as PPT, PDF0 likes611 views
The document discusses improving security for small and medium-sized businesses on a limited budget. It outlines common security threats faced by SMBs, such as financially motivated attacks and intellectual property theft. It then discusses how traditional defenses like antivirus software and patching alone are often not effective. It recommends prioritizing security basics like rapid patch management, application control, and device encryption to minimize endpoint risks cost-effectively. A security suite that provides single console management is presented as an effective solution.
![Global Headquarters 8660 East Hartford Drive Suite 300 Scottsdale, AZ 85255 1.888.725.7828 [email_address] http://blog.lumension.com](https://image.slidesharecdn.com/lumension-howtoimprovesecurityonasmbbudgetfinal-110927093022-phpapp01/85/How-to-improve-endpoint-security-on-a-SMB-budget-33-320.jpg)
How to improve endpoint security on a SMB budget
- 1. Effective and Efficient Security on a SMB Budget Part I – How to Improve SMB Endpoint Security
- 2. Today’s Speakers Chris Merritt Director of Solution Marketing Lumension Roger A. Grimes Security Consultant, Author and Columnist
- 3. Today’s Agenda Today’s Threats Defenses – and What Does & Does Not Work Improving SMB Security Q&A
- 5. Today’s Threats General Categories Financially Motivated Bank Accts, Passwords, etc. Identity Theft Insiders Intellectual Property Theft Hacktivists IP / Customer data Denial of Service Reputational Damage
- 6. Today’s Threats Financially Motivated Examples Fraudulent Payroll / Accounting Transfers Bank Info Stealing Trojans Fake Invoices Malicious Long Distance Service Extortion
- 7. Today’s Threats IP Theft Examples Corporate Espionage Future Product Plans Trade Secrets Customer Lists Lawyer Case Files (sold to opposing counsel) RSA Attack
- 8. Today’s Threats Hacktivist Examples Wikileaks Retaliation Distributed Denial of Service (DDOS) as a Protest
- 10. Defense-in-Depth Traditional Defenses … Antivirus Patching Microsoft OS and Apps Firewalls Strong Passwords End-User Education Programs … Don’t Always Work: If They Did, We Wouldn’t Have IT Security Breaches!
- 11. Defenses – What Does Not Work
- 12. Defenses Where Traditional Defenses Fall Short Risk from Un-patched 3 rd Party Apps Controlling Local Admins Gone Wild Preventing Zero-Day Attacks and Targeted Malware End-User Education Isn’t Keeping Up Actionable Reporting and Security Measurement
- 13. Why Antivirus Doesn’t Work Swamped by the Deluge Can’t keep up with rising daily volume of malware Can’t defend against zero-day threats (on average, only 19% of new malware signatures are detected on day 1) Severely impacts endpoint performance 36% of SMBs rely on free AV
- 14. Hidden Costs of Antivirus Acquisition Costs Licensing (license cost, maintenance, support) Installation (HW / SW, roll-out, other) Operational Costs System Managemenet Incident Management (help desk, escalation, re-imaging) Lost Productivity Extraordinary Costs Data Breach Operational (60~80%) Acquistion (20~40%)
- 15. Why Patching Microsoft Alone Doesn’t Work Missing the Target Relying on “free” tools Go beyond Microsoft Most organizations take at least twice as long to patch 3 rd party application vulnerabilities than they do to patch OS vulnerabilities 60% of users are running un-patched versions of Adobe
- 16. Hidden Costs of Free Patching Why “Free” Can Cost You More Speed and Accuracy Time to deploy non-MSFT or custom application patches No CVE information Visibility and Compliance Lack of hardware and software inventory Limited reporting
- 17. Defenses What Else Doesn’t Work Buying advanced tools, such as IDS, PKI, black-box solutions, while ignoring the basics Preventing attack methods instead of shoring up IT risk sources and focusing on preventing malware execution
- 18. Defenses Better End-User Education Do your users know the company security policies and do they understand their importance? Do you show your users what your “real” AV detection screen looks like? Do they know that they are most likely to be infected from legitimate web sites, social media, USB keys, etc.?
- 19. Defenses – What Does Work
- 20. Defenses What Does Work Focusing on the Basics Prioritize and Implement Using past history to determine this year’s priorities Make a ranked list and begin Go for low hanging fruit first Using Strong Data to Convince Management
- 21. Focus on the Operational Basics Source: Aberdeen Group, Managing Vulnerabilities and Threats (No, Anti-Virus is Not Enough), December 2010 Assess Prioritize Remediate Repeat Identify all IT assets (including platforms, operating systems, applications, network services) Monitor external sources for vulnerabilities, threats and intelligence regarding remediation Scan all IT assets on a regular schedule for vulnerabilities, patches and configurations Maintain an inventory of IT assets Maintain a database of remediation intelligence Prioritize the order of remediation as a function of risk, compliance, audit and business value Model / stage / test remediation before deployment Deploy remediation (automated, or manually) Train administrators and end-users in vulnerability management best practices Scan to verify success of previous remediation Report for audit and compliance Continue to assess, prioritize and remediate
- 22. Defenses – What Does Work Augment existing defense-in-depth tools Comprehensive Patch and Configuration Management Application Control / Whitelisting Device Control Encryption Blacklisting As The Core Zero Day 3 rd Party Application Risk Malware As a Service Volume of Malware Traditional Endpoint Security
- 24. Minimize Your True Endpoint Risk Rapid Patch and Configuration Management Analyze and deploy patches across all OS’s and apps (incl. 3 rd party) Ensure all endpoints on the network are managed Benchmark and continuously enforce patch and configuration management processes Don’t forget about the browser! Un-patched browsers represent the highest risk for web-borne malware. Source: John Pescatore Vice President, Gartner Fellow 30% Missing Patches Areas of Risk at the Endpoint 65% Misconfigurations 5% Zero-Day
- 25. Antivirus Use for malware clean-up and removal Application control Much better defense to prevent unknown or unwanted apps from running Stop Malware Payloads with App Whitelisting Malware Apps Known Viruses Worms Trojans Unknown Viruses Worms Trojans Keyloggers Spyware Authorized Operating Systems Business Software Unauthorized Games iTunes Shareware Unlicensed S/W Un-Trusted
- 26. Stop Unwanted Applications Immediate and simple risk mitigation Denied Application Policy prevents unwanted applications even if they are already installed Easily remove unwanted applications
- 27. Reduce Local Administrator Risk Monitor / Control Local Admin Usage Local Admins can do ANYTHING on their systems Install unwanted and unauthorized software Install malware Remove patches Bypass security measures Change configurations
- 29. Encryption Endpoints (Whole Disk) Secure all data on endpoint Enforce secure pre-boot authentication w/ single sign-on Recover forgotten passwords and data quickly Automated deployment Removable Devices Secure all data on removable devices (e.g., USB flash drives) and/or media (e.g. CDs / DVDs) Centralized limits, enforcement, and visibility Laptop Thefts (IDC 2010) Lost UFDs (Ponemon 2011)
- 30. Improving SMB Security Problems Defense-In-Depth is not easy Hard to manage it all Different solutions don’t always work well together The more consoles you have to monitor, the less you’ll do it Unreviewed logs are useless It’s NOT compliance vs. security … both are necessary
- 31. Improving SMB Security Solution – Security Suites Single Server / Management Console Single Agent Modular, Extensible Design Organization-wide Reporting Lower Total Cost of Ownership (TCO) Single Console Agile architecture Single Promotable Agent
- 32. More Information SMB Security Series Resource Center: http://www.lumension.com/smb-budget Webcast Part 2: http://www.lumension.com/Resources/Webinars/How-to-Reduce-Endpoint-Complexity-and-Costs.aspx Quantify Your IT Risk with Free Scanners http://www.lumension.com/special-offer/PREMIUM-SECURITY-TOOLS.ASPX Lumension ® Endpoint Management and Security Suite Demo: http://www.lumension.com/endpoint-management-security-suite/demo.aspx Evaluation: http://www.lumension.com/endpoint-management-security-suite/free-trial.aspx SMB Market Survey www.lumension.com/smb-survey
- 33. Global Headquarters 8660 East Hartford Drive Suite 300 Scottsdale, AZ 85255 1.888.725.7828 [email_address] http://blog.lumension.com
Editor's Notes
- #4: © Copyright 2008 - Lumension Security
- #15: See http://www.lumension.com/Resources/Webcasts/The-True-Cost-of-AV.aspx
- #17: See http://www.lumension.com/Resources/Webcasts/Beyond-Windows-Patching.aspx
- #28: See http://www.lumension.com/Resources/Webcasts/How-to-Enable-Local-Admin-Access-Without-the-Risk.aspx