Background–RemovethisslidebeforeuseAudience:Usethispresentationtoeducateyourprospectsontheproblemoftargetedemailattacksandwhytheyneedtotakeaction,todefinekeycapabilitiestheyneedtosolvetheproblem,understandwhatmakesTrendMicrounique,andnextstepstheycantakeAdditionalassets:GotoSalesHubfordemos,datasheets,whitepapersandmoreSupport:Forquestionsorcommentspleasecontactbobcorson@orkevinfaulkner@1StopTargetedEmailAttacksSalesPlayBobCorson&KevinFaulknerJune1,2014Confidential|Copyright2012TrendMicroInc.2ContentWhyareTargetedEmailAttacksaConcern?TrendMicro’sSolutionWhatMakesUsDifferentNextStepsAppendixTechnicalOverviewDemonstration3Email–thedominantattackvectorSource:TrendLabsResearch,2013Verizon:201491%oftargetedattacksbeginwithaspear-phishingemailEmailattachmentsremainthemostprolificattackvectorat78%Usesocialengineeringtotargetemployees!Source:Gartner,2013SecureEmailGatewayMQ“Thereisampleevidencethatemailisthepreferredchanneltolaunchadvancedtargetedattacks”Email–thedominantattackvectorWhatisaTargetedEmailAttack?Attackersusesocialengineering&backgroundresearchtotargetaspecificindividualororganizationAttackerscreateandsendaspearphishingemailthatembedsadvancedmalwareinattachmentsand/orURLsEmailcontainsuserrelevantcontent,contextandmotivationforrecipienttoopenaURLorattachmentAdvancedMalwareisdeliveredandinstalledrecipient’sdevice.1.2.3.4.Thetargetedattackbegins5.WhyTargetedEmailAttacksAreInVogueAttacker’sPathofLeastResistanceAccesstoSocialNetworkingPlatformAgnosticLackofTraining&EducationTargetedEmailAttacks

ConvincingtoUsersyetDifficulttoDetectSpoofedemailaddressofsomeoneknowntoyouWell-researched,

convincingsocialengineeringMalwareconcealedinalegitimatelookingattachmentorURLLowvolumeofrecipientsOftensentfromatrustedIPaddressWhyTraditionalEmailSecurityNeedsHelpObliviousto‘safe’emailcontentthatisusedtofoolarecipientInabilitytodetectadvancedmalware:HiddeninOffice,PDFdocuments&attachmentsBlindtozerodayvulnerabilities&exploitsAttackerstestpayloadspriortoanattackExampleofautomatedmalwareQAtestingserviceUnexpected

CostsUnexpected

RisksUnexpectedStrategicImpactsUnexpected

CareerImpactsImpactsofTargetedAttacksCXOCXO2023-01-1011TheTrendSolutionDeepDiscoveryEmailInspector

TargetedEmailAttackProtectionAdedicatedemailappliancethatdetectsandblocksemailscontainingmaliciouscontent,attachmentsorURLsCustomsandboxinganddetectionenginesanalyzeemailattachmentsFullanalyzesembeddedURLdestinationsDerivespasswordsforprotectedfilesCo-existswithotheremailsecurityproductsStoptargetedemailsthatleadto

databreachEmailInspector–AtaGlanceAttachments:Analyzedwithdetectionengines&sandboxingPasswords:Intelligentlyderivedusingheuristics&listsURLs:Reputation,scanning&sandboxingformalware&exploitsCustomSandboxing:ConfiguredtopreciselymatchyoursystemsPolicyControls:MakeitsimpletocustomizesecuritypoliciesThreatAnalysis:Tools&intelligencetoassessthenatureoftheattackEmailGWEmailServerDeep

DiscoveryXAdvancedThreatProtectionblockstargetedemailattacksCopyright2014TrendMicroInc.14郵件安全設(shè)備趨勢科技高級威脅郵件安全網(wǎng)關(guān)DDEI附件分析及沙盒技術(shù)URL分析及沙盒技術(shù)郵件策略控制威脅分析檢測-阻止-分析AttachmentAnalysisAttachmentsareunpacked,decompressed,andunlockedusingheuristicrulesandcustomer-suppliedkeywordsDetectionenginesandcustomsandboxinganalysisidentifyadvancedmalwareanddocumentexploitsAnalyzesawiderangeoffiletypesandcontentincluding:Windowsexecutables,MicrosoftOffice,PDF,Zip,JavaURLAnalysisURLsarereputation-checkedviaSmartProtectionNetworkPagecontentisscannedandsandboxedtodiscoverredirects,advancedmalware,andexploitsusedindrive-bydownloadsEmailInspector–BetterDetection

1515DeepDiscovery

EmailInspectorDetectionEngines,CustomSandboxing,GlobalIntelligenceSametechnology!!EmailInspector–HowItWorks

BeyondDetectionCopyright2014TrendMicroInc.16Contentexamination,heuristics,andcustomer-definedkeywordsaid

theanalysisofpassword-protectedfilesandZipfilesIntegratedportaldeliversglobalintelligencerelevanttoyourattack

–malwareprofiles,C&Cnetworks,attackgroup,andmoreQuarantine,deletion,forward-with-tagareconfigurablebydetection

severity.Sandboxanalysiscanbecontrolledbyattachmenttype

Password-protectedAttachmentsPolicyManagementThreatConnectPortalAnalysis&ActionDetection&

QuarantineListsSandbox

AnalysisExportable

IOCDataDetailedReportingDeepDiscoveryProductsCopyright2014TrendMicroInc.18DeployprotectionwhereitmattersmosttoyourorganizationInspectorDetectandanalyzetargetedattacksanywhereonyournetworkNetwork-wide

attackdetectionAnalyzerImprovethethreatprotectionofyourexistingsecurityinvestmentsIntegratedsandboxingEmailInspectorStopthetargetedattacksthatcanleadtoadatabreachEmailattackprotectionEndpointSensorInvestigate&respondtoattackswithnetworkdetection+endpointintelligence

Endpoint

Investigation2023-01-1019WhatMakesUsDifferentTheCurrentRealityCopyright2014TrendMicroInc.20InteroperabilityisMandatoryExistingSecureEmailGatewaysBetterProtectionRequiredTrendMicroValuePropositionCopyright2014TrendMicroInc.21SeamlessInteroperabilityLowCostofOwnershipBestThreatDetectionBestThreatDetectionCopyright2014TrendMicroInc.22TechnologyandenginesbasedontheawardwinningDeepDiscoveryInspectorNSSLabsBDSTestfoundTrendMicrodetected100%ofemailbasedmalwareHeuristicsandalgorithmstodetectembeddedpasswordsandattachmentsbetweenemailsPoliciestodefinesandboxanalysisrulesSeamlessInteroperabilityCopyright2014TrendMicroInc.23DetectionandblockingoftargetedemailattacksinteroperateswithexistingsecureemailgatewayNoconfigurationorarchitecturalchangesrequiredNochangesinemailpoliciesoruserbehaviorOptiontodefinesandboxanalysispoliciesEx:analyzeallPDFattachmentsLowCostofOwnershipCopyright2014TrendMicroInc.24Singleappliancedoesitall…nomultipleboxesforemail&webNocustomintegrationordevelopmentcostsforcustomsandboxanalysisNostrandedinvestmentsorripandreplacecostsEmailserveragnostic:workswithMicrosoftExchangeorLotusNotesemailserversThreatintelligenceisintegratedandzerocost…noadditionalsubscriptionfeerequiredNextStepsConfidential|Copyright2012TrendMicroInc.252023-01-10HowwecanhelpyouNextStepsSolutionDemoProofofConceptWhereYouHaveBeenTargeted?MonitorYourEmailReviewReportBriefCISOandCxOsCopyright2014TrendMicroInc.262023-01-10Confidential|Copyright2012TrendMicroInc.27SolutionAppendixDeploymentOptions28ActivelyblocksmaliciousemailsProvidesthreatanalysisMXrecordroundrobinallowsmultipleEmailInspectorunitsandbypassesitifunavailablePassivelyanalyzesemailsProvidesthreatanalysis&alertingIndirectmonitormodeonlyBMTAModeBCCModeEmailGWEmailServerDeepDiscoveryEmailGWEmailServerDeepDiscovery下一代郵件安全解決方案29與傳統(tǒng)郵件網(wǎng)關(guān)共存直接攔截威脅郵件提供威脅分析利用輪叫調(diào)度，支持高可用性旁路分析威脅郵件提供威脅分析及告警

BMTA模式旁路模式IMSA或其他傳統(tǒng)郵件網(wǎng)關(guān)郵件服務(wù)器DDEIIMSA或其他傳統(tǒng)郵件網(wǎng)關(guān)郵件服務(wù)器DDEIEmailInspector7100vsFireEyeEX540030DeepDiscovery

EmailInspector7100v2.0SP1FireEyeEX5400v7.1Capacity400,000emails/day300,000emails/dayEmailAttachment

Detection&AnalysisMultipledetectionenginespluscustomsandboxingDocumentexploitdetectionUser-definedandcontext-derivedpasswordsforprotectedattachmentsAlertonattachments/archivesthatarenotscanableGenericsandboxingdetectionforunknownmalwareEmbeddedURLDetection&AnalysisReputationbaseddetectionSuspiciousURLanddrive-bydownloadbehavioranalysisbysandboxingWebexploitdetectionforHTML/Java/JavaScript/VBScript/PDF/FlashFullURLanalysis&sandboxingrequirespurchaseofadditionalWebMPS,CMSappliance,andDynamicThreatIntelligencefeedDeploymentAvailableasHWapplianceSupportcopperandfibernetworkinterfaceAvailableasHWapplianceorcloudserviceOnlysupportcoppernetworkinterfaceTCOSingleapplianceat50%thecostofcompleteFEsolutionNochargeaccesstoSmartProtectionNetworkHigherpricedemailappliancealsorequiresthreeboxes(Email/Web/CMSappliance)Competition–GWVendorsw/sandboxing31Cisco/Ironport–limitedbolt-oncloudsandboxingLimitedsandboxingfromthecloudMSFTmalwareonly;Noin-depthURLanalysisNSSLabsresultsrequiredfullSourceFireIPS+endpointagentMcAfee–integratedsandboxingonlyMSFTmalwaredetectionbutnodocumentexploitNopasswordintelligenceNoin-depthURLanalysisProofPoint–

cloudsandboxing&URLanalysisLimitedsandboxingfromthecloudGatheringfurtherdata…Beawareof“good-enough’solutionfromincumbentvendorDeepDiscoveryCustomsandboxingDeepURLanalysisPasswordintelligenceThebestdetection&threatintelligenceCopyright2013TrendMicroInc.32ScanMailforExchangeInstalledBase

-Analyzer&EmailInspectorComparisonAnalyzerEmailInspectorPreferred

ProductPositioningThepreferredsolutionforintegratingadvancedmalwaredetectionintoallTrendproductsSinglepointofcontrolSharab