03se产品介绍ddei客户交流英文版

Background–RemovethisslidebeforeuseAudience:Usethispresentationtoeducateyourprospectsontheproblemoftargetedemailattacksandwhytheyneedtotakeaction,todefinekeycapabilitiestheyneedtosolvetheproblem,understandwhatmakesTrendMicrounique,andnextstepstheycantakeAdditionalassets:GotoSalesHubfordemos,datasheets,whitepapersandmoreSupport:Forquestionsorcommentspleasecontactbobcorson@orkevinfaulkner@1StopTargetedEmailAttacksSalesPlayBobCorson&KevinFaulknerJune1,2014Confidential|Copyright2012TrendMicroInc.2ContentWhyareTargetedEmailAttacksaConcern?TrendMicro’sSolutionWhatMakesUsDifferentNextStepsAppendixTechnicalOverviewDemonstration3Email–thedominantattackvectorSource:TrendLabsResearch,2013Verizon:201491%oftargetedattacksbeginwithaspear-phishingemailEmailattachmentsremainthemostprolificattackvectorat78%Usesocialengineeringtotargetemployees!Source:Gartner,2013SecureEmailGatewayMQ“Thereisampleevidencethatemailisthepreferredchanneltolaunchadvancedtargetedattacks”Email–thedominantattackvectorWhatisaTargetedEmailAttack?Attackersusesocialengineering&backgroundresearchtotargetaspecificindividualororganizationAttackerscreateandsendaspearphishingemailthatembedsadvancedmalwareinattachmentsand/orURLsEmailcontainsuserrelevantcontent,contextandmotivationforrecipienttoopenaURLorattachmentAdvancedMalwareisdeliveredandinstalledrecipient’sdevice.1.2.3.4.Thetargetedattackbegins5.WhyTargetedEmailAttacksAreInVogueAttacker’sPathofLeastResistanceAccesstoSocialNetworkingPlatformAgnosticLackofTraining&EducationTargetedEmailAttacks

ConvincingtoUsersyetDifficulttoDetectSpoofedemailaddressofsomeoneknowntoyouWell-researched,

convincingsocialengineeringMalwareconcealedinalegitimatelookingattachmentorURLLowvolumeofrecipientsOftensentfromatrustedIPaddressWhyTraditionalEmailSecurityNeedsHelpObliviousto‘safe’emailcontentthatisusedtofoolarecipientInabilitytodetectadvancedmalware:HiddeninOffice,PDFdocuments&attachmentsBlindtozerodayvulnerabilities&exploitsAttackerstestpayloadspriortoanattackExampleofautomatedmalwareQAtestingserviceUnexpected

CostsUnexpected

RisksUnexpectedStrategicImpactsUnexpected

CareerImpactsImpactsofTargetedAttacksCXOCXO2023-01-1011TheTrendSolutionDeepDiscoveryEmailInspector

TargetedEmailAttackProtectionAdedicatedemailappliancethatdetectsandblocksemailscontainingmaliciouscontent,attachmentsorURLsCustomsandboxinganddetectionenginesanalyzeemailattachmentsFullanalyzesembeddedURLdestinationsDerivespasswordsforprotectedfilesCo-existswithotheremailsecurityproductsStoptargetedemailsthatleadto

databreachEmailInspector–AtaGlanceAttachments:Analyzedwithdetectionengines&sandboxingPasswords:Intelligentlyderivedusingheuristics&listsURLs:Reputation,scanning&sandboxingformalware&exploitsCustomSandboxing:ConfiguredtopreciselymatchyoursystemsPolicyControls:MakeitsimpletocustomizesecuritypoliciesThreatAnalysis:Tools&intelligencetoassessthenatureoftheattackEmailGWEmailServerDeep

DiscoveryXAdvancedThreatProtectionblockstargetedemailattacksCopyright2014TrendMicroInc.14邮件安全设备趋势科技高级威胁邮件安全网关DDEI附件分析及沙盒技术URL分析及沙盒技术邮件策略控制威胁分析检测-阻止-分析AttachmentAnalysisAttachmentsareunpacked,decompressed,andunlockedusingheuristicrulesandcustomer-suppliedkeywordsDetectionenginesandcustomsandboxinganalysisidentifyadvancedmalwareanddocumentexploitsAnalyzesawiderangeoffiletypesandcontentincluding:Windowsexecutables,MicrosoftOffice,PDF,Zip,JavaURLAnalysisURLsarereputation-checkedviaSmartProtectionNetworkPagecontentisscannedandsandboxedtodiscoverredirects,advancedmalware,andexploitsusedindrive-bydownloadsEmailInspector–BetterDetection

1515DeepDiscovery

EmailInspectorDetectionEngines,CustomSandboxing,GlobalIntelligenceSametechnology!!EmailInspector–HowItWorks

BeyondDetectionCopyright2014TrendMicroInc.16Contentexamination,heuristics,andcustomer-definedkeywordsaid

theanalysisofpassword-protectedfilesandZipfilesIntegratedportaldeliversglobalintelligencerelevanttoyourattack

–malwareprofiles,C&Cnetworks,attackgroup,andmoreQuarantine,deletion,forward-with-tagareconfigurablebydetection

severity.Sandboxanalysiscanbecontrolledbyattachmenttype

Password-protectedAttachmentsPolicyManagementThreatConnectPortalAnalysis&ActionDetection&

QuarantineListsSandbox

AnalysisExportable

IOCDataDetailedReportingDeepDiscoveryProductsCopyright2014TrendMicroInc.18DeployprotectionwhereitmattersmosttoyourorganizationInspectorDetectandanalyzetargetedattacksanywhereonyournetworkNetwork-wide

attackdetectionAnalyzerImprovethethreatprotectionofyourexistingsecurityinvestmentsIntegratedsandboxingEmailInspectorStopthetargetedattacksthatcanleadtoadatabreachEmailattackprotectionEndpointSensorInvestigate&respondtoattackswithnetworkdetection+endpointintelligence

Endpoint

Investigation2023-01-1019WhatMakesUsDifferentTheCurrentRealityCopyright2014TrendMicroInc.20InteroperabilityisMandatoryExistingSecureEmailGatewaysBetterProtectionRequiredTrendMicroValuePropositionCopyright2014TrendMicroInc.21SeamlessInteroperabilityLowCostofOwnershipBestThreatDetectionBestThreatDetectionCopyright2014TrendMicroInc.22TechnologyandenginesbasedontheawardwinningDeepDiscoveryInspectorNSSLabsBDSTestfoundTrendMicrodetected100%ofemailbasedmalwareHeuristicsandalgorithmstodetectembeddedpasswordsandattachmentsbetweenemailsPoliciestodefinesandboxanalysisrulesSeamlessInteroperabilityCopyright2014TrendMicroInc.23DetectionandblockingoftargetedemailattacksinteroperateswithexistingsecureemailgatewayNoconfigurationorarchitecturalchangesrequiredNochangesinemailpoliciesoruserbehaviorOptiontodefinesandboxanalysispoliciesEx:analyzeallPDFattachmentsLowCostofOwnershipCopyright2014TrendMicroInc.24Singleappliancedoesitall…nomultipleboxesforemail&webNocustomintegrationordevelopmentcostsforcustomsandboxanalysisNostrandedinvestmentsorripandreplacecostsEmailserveragnostic:workswithMicrosoftExchangeorLotusNotesemailserversThreatintelligenceisintegratedandzerocost…noadditionalsubscriptionfeerequiredNextStepsConfidential|Copyright2012TrendMicroInc.252023-01-10HowwecanhelpyouNextStepsSolutionDemoProofofConceptWhereYouHaveBeenTargeted?MonitorYourEmailReviewReportBriefCISOandCxOsCopyright2014TrendMicroInc.262023-01-10Confidential|Copyright2012TrendMicroInc.27SolutionAppendixDeploymentOptions28ActivelyblocksmaliciousemailsProvidesthreatanalysisMXrecordroundrobinallowsmultipleEmailInspectorunitsandbypassesitifunavailablePassivelyanalyzesemailsProvidesthreatanalysis&alertingIndirectmonitormodeonlyBMTAModeBCCModeEmailGWEmailServerDeepDiscoveryEmailGWEmailServerDeepDiscovery下一代邮件安全解决方案29与传统邮件网关共存直接拦截威胁邮件提供威胁分析利用轮叫调度，支持高可用性旁路分析威胁邮件提供威胁分析及告警

BMTA模式旁路模式IMSA或其他传统邮件网关邮件服务器DDEIIMSA或其他传统邮件网关邮件服务器DDEIEmailInspector7100vsFireEyeEX540030DeepDiscovery

EmailInspector7100v2.0SP1FireEyeEX5400v7.1Capacity400,000emails/day300,000emails/dayEmailAttachment

Detection&AnalysisMultipledetectionenginespluscustomsandboxingDocumentexploitdetectionUser-definedandcontext-derivedpasswordsforprotectedattachmentsAlertonattachments/archivesthatarenotscanableGenericsandboxingdetectionforunknownmalwareEmbeddedURLDetection&AnalysisReputationbaseddetectionSuspiciousURLanddrive-bydownloadbehavioranalysisbysandboxingWebexploitdetectionforHTML/Java/JavaScript/VBScript/PDF/FlashFullURLanalysis&sandboxingrequirespurchaseofadditionalWebMPS,CMSappliance,andDynamicThreatIntelligencefeedDeploymentAvailableasHWapplianceSupportcopperandfibernetworkinterfaceAvailableasHWapplianceorcloudserviceOnlysupportcoppernetworkinterfaceTCOSingleapplianceat50%thecostofcompleteFEsolutionNochargeaccesstoSmartProtectionNetworkHigherpricedemailappliancealsorequiresthreeboxes(Email/Web/CMSappliance)Competition–GWVendorsw/sandboxing31Cisco/Ironport–limitedbolt-oncloudsandboxingLimitedsandboxingfromthecloudMSFTmalwareonly;Noin-depthURLanalysisNSSLabsresultsrequiredfullSourceFireIPS+endpointagentMcAfee–integratedsandboxingonlyMSFTmalwaredetectionbutnodocumentexploitNopasswordintelligenceNoin-depthURLanalysisProofPoint–

cloudsandboxing&URLanalysisLimitedsandboxingfromthecloudGatheringfurtherdata…Beawareof“good-enough’solutionfromincumbentvendorDeepDiscoveryCustomsandboxingDeepURLanalysisPasswordintelligenceThebestdetection&threatintelligenceCopyright2013TrendMicroInc.32ScanMailforExchangeInstalledBase

-Analyzer&EmailInspectorComparisonAnalyzerEmailInspectorPreferred

ProductPositioningThepreferredsolutionforintegratingadvancedmalwaredetectionintoallTrendproductsSinglepointofcontrolSharab