OSB140: Want a Safer Network? You Can Remove Local Admin Rights with Ivanti Application Control
1 like221 views
The document discusses Ivanti's approach to privilege management aimed at enhancing network security by removing local admin rights. It highlights key challenges posed by user-targeted cyberattacks and offers insights into effective strategies, such as application whitelisting and minimizing administrative privileges. Additionally, it provides success stories and tips for implementing these security measures effectively.
OSB140: Want a Safer Network? You Can Remove Local Admin Rights with Ivanti Application Control
- 2. Shane Wescott Mark Williamson AppSense Technology Evangelist – Aust/NZ Technical Lead (AM) OSB140 - Want a safer network. you can remove local admin rights with Ivanti application control
- 3. Agenda Who are we Why Ivanti for Privilege Management How does it work – What’s under the hood Tips and Tricks What’s the Challenge Customer Success Stories Demo – Show me already Q & A
- 4. Who are we ?
- 6. User-Targeted Attacks Of Cyberattacks Start With A Phishing Email PhishMe 2016 Enterprise Phishing Susceptibility and Resiliency Report https://phishme.com/2016-enterprise-phishing-susceptibility-report
- 7. User-Targeted Attacks of recipients open phishing messages, and 12% click on attachments. Verizon 2016 Data Breach Investigations Report http://www.verizonenterprise.com/DBIR/2016/ Up from 23% and 11%, respectively, in 2015
- 10. Mitigate Impact A vulnerability that when exploited allows the attacker to operate in the context of the current user. Reducing user privileges reduces the attackers ability to operate thereby slowing their ability to move around your environment. Privilege Management Reduces Impact: 0 2 4 6 8 10 12 14 16 18 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec total Priv mgmt mitigates
- 11. SANS Training Example from Dr Eric Cole • 47 users across 47 companies • Average required rights to data 42% • Of total data loss, ONLY 17% would have been lost • Remaining 83% equated to $4.5 Million • Roughly $100K per user breached
- 13. SANS – 1st Five… SANS “First Five”—as providing the most immediate increase in efficient and effective reduction in risk from advanced targeted attacks: 1) software whitelisting, 2) secure standard configurations, 3) application security patching, 4) system security patching and 5) minimization of administrative privileges.
- 14. How does it work – What’s under the hood?
- 15. ivanti User Privilege Management Enable admin apps & features for standard users Allow personal apps with IT control Full auditing capability
- 16. Standard Elevation with Ivanti Application Control 16 AM Agent LSASS Amend Token? CreateProcess Regedit.exe AMAppHook.Dll NTDLL LSA Client Custom LSA Auth Package AMMessageAssist Regedit.exeReparent CreateProcess - Regedit.exe Explorer.exe
- 18. Discover Provide Insight Take Action
- 19. Our History
- 20. History and Experience • 18 years experience Whitelisting from AppSense • 14 years experience Patching from Shavlik • 7 years experience Privilege Management from AppSense
- 21. Control Administrative Rights Applications OS Components Websites Services Installs
- 23. Application Network Access Control Control outbound connections: IP Hostname URL UNC or Port
- 24. What Do I Need To Elevate?
- 25. Ivanti is QUICK to protect Deploy Audit Review Update Proven Methodology
- 26. Granular, Contextual Policies • Allows authorised users to access “break glass” functionality • All based on granular, contextual policies • All policy based with full auditing
- 27. 85% of Windows intrusion threats Organizations can prevent up to by implementing four key disciplines PATCH OPERATING SYSTEMS 1 PATCH APPLICATIONS 2 PRIVILEGE MANAGEMENT 4 APPLICATION WHITELISTING 3 Powered ByPowered By
- 28. Our defense-in-depth products PATCH & VULNERABILITY MANAGEMENT APPLICATION CONTROL & PRIVILEGE MANAGEMENT ENDPOINT SECURITY SUITES SECURE PROGRAM MANAGEMENT • IVANTI PATCH FOR ENDPOINTS • IVANTI PATCH FOR SERVERS • IVANTI PATCH FOR SCCM • IVANTI APPLICATION CONTROL FOR ENDPOINTS • IVANTI APPLICATION CONTROL FOR SERVERS • IVANTI APPLICATION CONTROL FOR SCCM • IVANTI ENDPOINT SECURITY • IVANTI SERVER SECURITY • IVANTI SERVICE MANAGER • IVANTI ASSET MANAGER Provide Insight Compliance and monitoring by Xtraction
- 30. Only product Customer bought off a Beta
- 31. Hassell – Removal of Admin/App Store
- 32. Demo – Show me already
- 33. 33
- 34. Tips and Tricks
- 35. 1. Follow the advice from Experts SANS, CIS, ASD –do the most important things FIRST Follow a proven methodology If you want more info on this jump into this session OSB310 – Whitelisting, The Good, the Bad, the Ugly. Our Experts help you avoid Common Pitfalls Thursday 10:15- 11:15 Jamaica B
- 36. 2. Get buy in from the Business • It cant just be driven by the Security Team • Communications is the key – user and departmental • Make sure people understand the business benefit
- 37. 3. Do your Discovery - Don’t assume anything What’s running on your network? What apps need admin rights? How quickly user behaviour can change Xtraction can be Awesome to help get that single page view
- 38. 3. Do your Discovery - Don’t assume anything Xtraction example: ASD TOP 4 Single pane view Multiple data sources
- 39. Plug for Xtraction OSL140 - Here’s Your #$@&%*! Report! Test Drive Xtraction for Security Wednesday 14:15 – 15:15 MEC C1
- 40. Q + A Thank you