PowerPoint Presentation

Size: px

Start display at page:

Download "PowerPoint Presentation"

원주 신
5 years ago
Views:

1 변화하는위협에대응하는이메일보안 2018/1/24

2 79% 랜섬웨어공격은피싱이메일을사용 Attacker sends First user opens phishing (average time) 1 First user opens attachment 1 45 seconds to entirely encrypt an endpoint :00 01:00 02:00 03:00 04:00 Minutes 1. Verizon 2016 Data Breach Investigations 2. Teslacript 3.0

3 Business Compromise (BEC, 비즈니스이메일위협 ) 공격 CEO Fraud 공급자사기 글로벌 $5B 가치의손실 사기건당평균 $132,000 손실 계정손상 Difficult to detect no attachment/url 3

4 조직내부의공격자 : 신뢰할수있는사용자의내부피싱이메일 Employee A 손상된장치또는이메일자격증명 Malware BEC/Fraud Employee B 이메일게이트웨이보안은내부메일을볼수없다! 4

5 피싱공격이 #1 보안이슈 Phishing 상위 5 관심사는모두이메일과관련 Targeted attacks Compliance Advanced Threat Ransomware 5 Cloud services Source: Black Hat Survey, July 2017

6 사용자행위 : 이메일첨부파일 클라우드파일공유 이메일게이트웨이보안은이미클라우드에업로드된파일을볼수없다! 6

Office 365 에포함된보안기능을보완하게되는이유는? Exchange Online is designed and SLA backed to catch 100% known malware But since 90% malware infects only 1 device, Only 10% malware is known.

7 Office 365 에포함된보안기능을보완하게되는이유는? Exchange Online is designed and SLA backed to catch 100% known malware But since 90% malware infects only 1 device, Only 10% malware is known. Every customer needs a strategy to deal with unknown malware at the layer E5/ATP adds sandboxing but misses significant amount of unknown malware and lacks BEC/fraud detection Office 365 popularity makes it worthwhile and easy for attackers to QA test their attacks on Office 365 If you bought a new home with a smoke detector guaranteed to detect 10% of fires would you supplement it? 7

8 규정준수및개인정보를유지할필요 많은데이터누출이잘못된첨부파일또는잘못된수신자에의하여발생 GDPR, PCI, HIPAA 또는기타규정을준수해야할필요 고객은비즈니스요구사항에대한복잡성이나간섭이없이보호받기를원함 8

9 Protect 9

LEGEND SMART: 이메일을보호하기위한계층적방어 Known Good Known Bad Unknown Sender

Attachment Filtering & Content Filtering Anti-Malware & URL Reputation

10 LEGEND SMART: 이메일을보호하기위한계층적방어 Known Good Known Bad Unknown Sender Authentication & Reputation Spam Content Analysis & Correlation Attachment Filtering & Content Filtering Anti-Malware & URL Reputation Machine Learning (Anti-Malware) Machine Learning & Expert Sys (Fraud/BEC) NEW! Document Exploit Detection / Macro Analysis Safe s allowed Sandbox Analysis Real-time URL Analysis at Click Time Malicious s blocked 10

11 첨부파일필터링정책 악성코드가사용할가능성이있는첨부파일타입을악성유무와관계없이차단.EXE,.DLL,.JS,.JSE,.VBS,.VBE,.WSH,.PS 등 11

12 알려지지않은악성코드의탐지 Pre-execution machine learning 수천개의파일기능과기계학습모델을사용하여악성파일을예측탐지. 샌드박스이전에알수없는악성코드를찾아이메일배달효율성을향상 Document Exploit Detection 파일을구문분석하여의도한애플리케이션에대한알려진악성및잠재적악성코드를탐지. 현장에서새로운제로데이익스플로잇을탐지하는기술 Sandbox analysis 병렬로멀티 OS 를사용한행위분석. 수분내에행위분석을완료 12

악성 URL 방어 Hundreds of millions of sensors 2

분석 Internet Email Gateway SaaS 기반메일보안 URL

13 악성 URL 방어 Hundreds of millions of sensors 2 trillion threat queries yearly Correlates files, IPs, URLs, vulnerabilities, and more Blocks 250M threats daily URL 평판조회 실시간 URL 분석 Internet Gateway SaaS 기반메일보안 URL rewritten 배달전대부분의공격을차단 사용자가링크를클릭시간지연을통한공격을차단 13

14 Intention Behavior A.I. 기반의사기이메일 (BEC) 탐지 : 보안전문가의분석판단모델을대입 Routing behavior Cousin domain High-profile user similarity 규칙가중치및상관관계 보다정확한식별 Payment, PII Urgency

15 클라우드파일공유에대한악성코드방어 Problem: Cloud file services include only basic AV - misses unknown malware. Network Breach Detection Systems don t see traffic between off-network devices and SaaS services Trend Micro prevents threats from spreading in OneDrive, SharePoint, Box, Dropbox, Google Drive: Advanced threat scanning Machine-learning based antimalware Document exploit detection URL analysis Sandbox analysis On-demand scan to discover existing threats 15

16 조직내부에서미리공격을감지 메일서버자체의악성탐지솔루션적용 내부이메일에서사기위협을검사 디렉토리그룹별세부정책 조치 : 태그 (warning), 삭제, 격리 Employee A compromised device or credentials Malware/Fraud Employee B 16

17 Office 365 보안솔루션을이용한악성파일검색및삭제 Office 365 Security Office 365 사서함또는파일공유의첨부파일들을검색하고삭제하는솔루션적용 17

18 Exchange/Domino 사서함내의파일검색및삭제 Trend Micro ScanMail Allows you to search and delete 18

19 Business Compromise/Fraud Protection 19

20 교육에도불구하고, 사용자는 Fake 이메일을판별하지못함 Fraud B Content word count: 37 97% 의사용자가정교한피싱메일을식별할수없다. - Inspired elearning July 2017

21 보안전문가만이이를식별할수있다면? Fraud B Content word count: 37

22 보안전문가는행위와의도두가지측면에서조사 B Mail Header Behavior Mail Content Intention Content word count: 37 22

23 Mail Header 해커행동특성 Received: from p3plwbeout05-06.prod.phx3.secureserver.net (p3plsmtp prod.phx3.secureserver.net [ ]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by itf-01.company.com (Postfix) with ESMTPS id E0B9815FC65 for Mon, 1 Aug :47: (UTC) Received: from localhost ([ ]) by p3plwbeout05-06.prod.phx3.secureserver.net with bizsmtp id Rhni1t00205rkER01hniYP; Sun, 25 Jul :17: X-CMAE: v=2.1 cv=l/atqoj8 c=1 sm=1 tr=0 p=i-petxfovf8a:10 a=gljzh28+bkptlj+hejpmag==:117 a=gljzh28+bkptlj+hejpmag==:17 a=l9h7d07yolsa:10 a=9cw_t1ccxrua:10 불안전한이메일공급자! a=s5jvgz67dgca:10 a=wja2bgnzfmma:10 a=a7pwo9xp048a:10 a=ikctkhd0fzma:10 a=7z1cn_iqozsa:10 a=xrinti-inqa6s2tnsgua:9 a=h8oodqkaz7yfceec:21 a=qexddo2ut3ya:10 a=_w_s_7vecoqa:10 Message-Id: < f2e65d9e fa8fa4@ 05.secureserver.net> User-Agent: Workspace Webmail X-Domain: entraser.com X-SID: Rhni1t00205rkER01 Received: (qmail invoked by uid 99); 1 Aug :47: Content-Transfer-Encoding: quoted-printable! 위조된폼 : domain From: "Wilson Ceo" <wilson_ceo@compony.com> To: Sandra_Finance@company.com Content-Type: text/html; charset="utf-8" X-Originating-IP: Subject: URGENT X-Sender: amina@entraser.com! 참조주소를프리이메일로변경 Reply-To: "Wilson Ceo" < president2@gmail.com> Date: Sun, 31 Jul :47:

24 Mail Content 이메일의도특성 재정적인정보 Need a same day payment of 22,110 made this morning, let me know if you are available to handle this now so i can forward details. Need it sorted today. Regards Wilson 시급함을강조 액션을요구 Sent from my iphone 24

25 Intention Behavior A.I. 기반의사기이메일 (BEC) 탐지 : 보안전문가의분석판단모델을대입 Routing behavior Cousin domain High-profile user similarity 규칙가중치및상관관계 보다정확한식별 Payment, PII Urgency

26 이메일내의사표시요소 사람이보는관점 정상메일과 Fake 메일이동일하게보임 액션을요구 재정정보 시급함을강조 Real 이메일서비스공급자 참조주소를프리이메일로변경 발신자위조 공격자의행위요소 26 Fake

27 전문가규칙에서의관점 의심메일 액션을요구 이메일서비스공급자 재정정보 참조주소를프리이메일로변경 시급함을강조 Real 발신자위조 27 Fake

28 전문가규칙 + 머신러닝 = 사기메일탐지 액션을요구 이메일서비스공급자 재정정보 참조주소를프리이메일로변경 시급함을강조 Real 발신자위조 28 Fake

29 분석의완성도향상 = 전문가규칙 + 머신러닝 사람 전문가규칙 전문가규칙 + 머신러닝 정상? 의심탐지! 29

30 Trend Micro Security 30

31 Security Portfolio Protection for Office 365 Internet Gateway - SaaS Service Integration - SaaS Gateway SW [Anti-Spam Appliance] Advanced Threat Protection HW [Anti-A.P.T. Appliance] Service Integration - SW [Groupware/Messaging Anti-Virus]

32 감사합니다. 32

PowerPoint Presentation

PowerPoint Presentation 변화하는위협에대응하는이메일보안 2018/6/8 79% 랜섬웨어공격은피싱이메일을사용 Attacker sends email First user opens phishing email (average time) 1 First user opens email attachment 1 45 seconds to entirely encrypt an endpoint 2 2 00:00