際際滷

際際滷Share a Scribd company logo
Complete Endpoint Protection
Cybereason
Complete Endpoint Protection
EDR + NGAV
Complete Endpoint Protection
July 6, 2017: One of the largest health, hygiene, and
home products manufacturers announced a $129
million decline in yearly forecast.
August 16, 2017: The world's largest container
shipping company had a $300 million impact on Q3
results, after halting worldwide operations.
August 2, 2017: The second largest confectionary
manufacturer in the world lost $150 million in quarterly
sales and had incremental expenses of $7.1 million from
one attack.
August 3, 2017: A company that is home to several of the
world's largest skin care brands delayed $41 million of
second-quarter sales, after 10 days of shipping and
production delays .
July 28, 2017: One of the top 5 largest pharmaceutical
companies in the world had operations and drug production
disabled for more than a month after a cyber attack.
September 7, 2017: One of the three major consumer
credit reporting agencies experienced a breach,
compromising the personal information of as many as
half of all American adults
July 17, 2017: The worlds 3rd largest shipping company
announced a cyberattack in filing with the U.S. Securities
and Exchange Commission. Estimated impact is in the
hundreds of millions of dollars.
July 21, 2017: Computer Software company announced
its revenue for Q3 will be down as much as $20 million
from original expectations. In addition, their stock price
has steadily declined sine the cyber attack.
覦覲給 螻も
- 2
Complete Endpoint Protection
EDR 螻 襷
From RealSecu, 2018-01-24, 2018綛 EDR 覲伎, 覺覦 覿
誤碁 ロ 襷 る  讌れ 豢蟲伎 碁
讌 豢. 蟆郁記 蠏瑚崖  蟆 螻 讌れ
給.
Kevin Mandia, Founder of Mandiant
譟磯螳 襷 蠍一れ 覦煙  蟇 覃豢 蟆企 螻旧
 覯  讓曙朱 覦レ  蟆.
蠏碁Μ螻 蠏 觜襴襯 襦 誤 襭れ 豈 蟆.
Chris Sherman, Forrester Research
誤 伎 讌 覈磯 覲伎 螻
伎譯.
讌襷 讌朱 覈磯 り 企 譬 蟆螻  蟆
蟲覿讌 覈詩覃 覓企  る 蟇 螻螳 蟾給.
蠏碁Μ螻 豌企ゼ 覲  伎 蠏碁 蟆一 企Υ  る 蟆.
蠏碁 螳煙 螳譟磯螻, 蟆曙讌 覲伎  襷 蟯螻
朱 蠏語 磯 覦煙襷朱  る 蟆 螳譟磯
蟆伎.
讌れ 糾 Josh Applebaum
- 3
Complete Endpoint Protection
EDR 
- 4
Features Buyers Guide
E
Endpoint
Endpoint SW agent れ
 れ machine 讌螳?
 蟆暑 SW agent (CPU, Memory, Disk..)
 豢 伎 豕 覦  讌
 牛 Agent (NG AV, EDR..)
D
Detection
Prevention 糾骸 / 壱 
讌
 谿(Prevention) 讌螳?
 (Behavior) 蠍磯 覿 螻牛螳?
R
Response
 れ螳 / 襦 
  譟一(Investigation) / 蠏殊 覿 (Root cause)
 覿  覓語  ?
 一危 覿 蠍一 (, ), 企殊磯 / 蟲豢
 襦語 suspend, kill
  delete, quarantine, acquisition
 Machine 蟆襴
 API 磯
Complete Endpoint Protection
EDR 蟲襷 伎
- 5
8%
16%
15%
15%
14%
12%
10%
10%
蠏螳 蟇磯 EDR 襭 
蟯  譯殊 伎 覓伎蟾?
(豌 旧 = 339)
一危  覲危 覦 豢
覦讌襯  企  
讌螳     覦
襷 觜  覈磯
.
螻(Incident) 譟一 蟯
螳螻 煙 螳 
 り 覩酔給.
螻(Incident)  覦 豌願襯
螳蠍  轟 螻糾鴬 豌伎 
危危る 豌  覈譯手鍵
 螳煙 .
螻(Incident) 讌 蟇碁Μ
螳 螳   り 覩酔給.蠍一ヾ  誤 覲危 
(EPP) 蟲一 覲伎り
覩酔給.
螻  螳   譟一
覲伎 豺企 螻蠍一, EDR
襭   
(Mitigation)蠍磯 給.
 覲伎螻螳 伎 EDR
 豢讌 .
 覿 襷 螻旧螳
. 蠏 覿覿 襷 
襴 覩衰 給.
豢豌 : Enterprise Strategy Group, 2017
  覿 螻旧 
 蠍一ヾ 覦煙 螻
 企  螳
 譟一 螳
Complete Endpoint Protection
 :
Spark Capital, CRV, Lockheed Martin, Softbank,
Wells Fargo
 400螳 伎 朱一
 伎る殊 蟲一 豌覲 覿 (Unit 8200) 豢
 25襷 伎 誤語   螻螳 襦
 覲伎ろ 覲語 | 企 | 貎 | 磯 | 
ABOUT US
- 6
Complete Endpoint Protection
Comprehensive Security: Enterprise Attack Protection
- 7
Complete Endpoint Protection
Cybereason Product 蟲
Cybereason EDR
誤語 覃覲企ゼ 讌 企 螻糾鴬 讌襯
蟯覿 覦 襾語朱 れ螳朱  讌螻 
   企 覲伎 .
Cybereason NGAV
れ讌   貊, れ  貊,
, Fileless(PowerShell)  貊 
覈 譬襯  貊襯 谿  
谿碁 磯企
+
Cybereason Services
覓語 讌螻 蠍一 螳讌
覲伎 覿螳 螻螳讌(旧)
- 8
Detection
れ螳 
 讌
Prevention
煙
ろ覦讌
Remediation
 
讀螳 
Investigation
所 ル
豢譟一
企 螻糾鴬
NGAV 
豺 覦讌
EDR 
豺 讌
覦 
豺  豺
Complete Endpoint Protection
Cybereason Layer of Protection
1. NGAV Anti-Malware
- 蠏碁豎 蠍磯
2. NGAV Anti-Malware
- 襾語 蠍磯
3.   覿
- Anti-Ransomware
- Fileless  覲危
4. EDR
Pre-Execution Dynamic Post-Infection
Cybereason 誤碁ゼ 覲危誤蠍  螻覲襦 覲危碁逢 螻.
螳 螻 襦 るジ   覃 蟯 覲伎 螻.
覯 語ろ( 伎狩-覈)襦 EDR+NGAV .
- 9
Complete Endpoint Protection
Cybereason EDR
轟 讌蠍 螻糾鴬 覦螻 給蟾?
EDR(Endpoint Detection and Response):誤  讌 覦
Complete Endpoint Protection
Cybereason EDR 螳
讌譴 螻糾鴬 讌蟯朱 螳.
 螳 豢
"Cybereason EDR  螻糾鴬螳 螻螳 ろ語 蟆曙
  螻 讌 螳襯  覈磯螻
AI 讌 牛 覲企ゼ 覿 れ螳朱 企 螻糾鴬
讌. 螳讌   螻糾鴬 碁 覲企ゼ 蠍 所   
 蟯襴 覃伎朱 蟆  螻糾鴬 豌 
讀 螳螻 蟆 豌襴    企 覲伎 
(EDR : Endpoint Detection and Response) 螻.
- 11
螳煙 ,
豢伎
蟆讀 覿螳
覿譟
企欧 
れ 企れ
 讌 覓
襴 覿 螳
覦

蠍一 れ 覓語
Complete Endpoint Protection
Cybereason EDR 蟲譟
- 12
  覈 ろ 殊  EndPoint 一危磯ゼ
 讌 襦語,  レ, 覃覈襴, 讌ろ碁Μ,
蠍壱 殊企 覲襯 蠍磯.  襦語れ 讌,  蟆襴
讌ろ碁Μ    れ 譟一.
  語, 襾語,  覿  れ 誤磯 蟲
Cybereason ,   語螻 朱 螻糾鴬朱
郁屋 蟆 "Malop : Malicious Operation朱 螳讌..
 螻糾鴬 碁 覲企ゼ 蠍 所     蟯襴
覃伎朱 螻糾鴬 豌 讌 螳 螻牛 覿螳螳
碁  蟆 蠏覈螻 豕 願屋 覦 螻ろ蟆 .
 Cloud 覦 On-premise 覦 覈 讌
Complete Endpoint Protection
Cybereason EDR 麹 蠍磯 碁覈襴 覿
- 13
80,000
RECORDS PER SECOND
VS.
8,000,000
RECORDS PER SECOND
GEN 2
SECURITY SOLUTIONS
GEN 3
CYBEREASON
Complete Endpoint Protection
Cybereason EDR Built-in 讌 覈 - 豌伎
- 14
Infiltration
(豺)
螻糾鴬螳 豺蠍  
れ蟇磯 れ讌  覃,
覃 , Zero-day 旧ろ襦 讌
Privilege
Escalation
(蟠)
螻糾鴬 谿剰鍵  蟠轟企 
覯 蠏殊  
襦語  譟一
C & C
企 襴れ 碁 螻糾鴬
C&C 旧 讌(DGA)
Data
Exfiltration
(覲伎豢)
一危磯ゼ 碁襦 豢  企
ろ語 螻糾鴬襯 螳  覲
Lateral
Movement
(豸°危)
蠍一ヾ 覲伎 襭 讌 讌 覈詩
螻糾鴬 蟇一  覦 覦  讌
Ransomware
 誤煙   覲
れ 覃(TI) & れ讌
 覃 讌
襷 一危 譟郁 蟯
 蟯 覿
Fileless 覃 螻糾鴬 讌
(PowserShell)
 蠍磯 覿
ろ & 螻狩 豕
襭磯  豕 覿
Zero 覃誤磯
谿覲
Complete Endpoint Protection
Cybereason EDR 覿讌(Hunting Engine)
- 15
EndPoint
Facts
Evidence
Suspicions
Malop
Hunting
Engine(觜一危)
Malop  企欧 覲
ル碁´蟇磯 覲豺
Facts 豢豢
れ螳 覃 一危 讌
(ろ語 , 襦語る)
IP, 覃碁  覲 觜蟲
れ螳 れ姶 覿
 螳レ 
Evidence 豢豢(螻豺 )
Complete Endpoint Protection
Cybereason EDR 譯殊 蠍磯
襷  誤碁
れ螳 覈磯 螳
蠍一 覲伎 れ 誤語
  貊 螳 覦 螻糾鴬
讌螻 覯襯 誤螻 蟆
 蟆  殊 .
Cybereason EDR 襷  
誤 蟆曙 れ螳朱
覈磯螻 螻糾鴬  譟郁鍵
 ろ.
Windows, Mac OS, Linux
覯襯  覈 覈磯
覲伎 豈  螳蟲 覈 
誤碁ゼ 螳螻 蠏碁れ  
讌, 覲,  讀 危  螻,
螳 , 蟆暑  狩企ゼ 蟆 
 襭  蟲.
Cybereason EDR れ 蟆曙 螳,
螻糾鴬 豌  螳螻  
 弰.
覈 誤語
襯 蠍 所 螳
企 螻糾鴬 覦覯  蟲覓 伎螻
朱, 誤語 襯  
   蟆曙  覲伎 誤
 谿場覲願鍵 企旧給.
Cybereason EDR 螻糾鴬 讌襯 
覿 覦 螻糾鴬 覦覯 煙 覿 牛
讌譴 螻糾鴬 讌蟯朱 螳
蟆   給.
Cybereason れ螳 螻糾鴬 讌 覦  弰  讌, 覯渚  語 覦 螻糾鴬   蟾 危企ゼ 螻.
- 16
Complete Endpoint Protection
Cybereason EDR 谿覲 覦  螻
襾語  譬 螻糾鴬 讌
豐 800襷覯 伎 觜一危 覿
蟲一 覲伎 譴 企 螻糾鴬  豌願 讌
覿 牛 れ讌    .
れ螳朱 企 螻糾鴬 豌  .
伎る殊 蟲一 豌覲 覿 豢 誤磯ゼ 讌.
讌 螻糾鴬 讌蟯朱 螳
る  豢豢 郁屋 朱 螻糾鴬 ろ襴襦 螳.
螻糾鴬 蠏朱蓋 ,  , 旧, レ 覦 蠍郁鍵 襯
螻企 朱  伎 覲伎 覓企ゼ 譴願  螳 豢.
Cybereason 谿覲
Cybereason  螻
 覦壱,
襴  豕
螻糾鴬 豌 
讀 
螳 蠍 
蟯襴 覃
  れ螳
 螳讌 覦 
- 17
豢  伎, 誤  豕
覿 牛 れ讌    .
Complete Endpoint Protection
Cybereason EDR 譯殊 蠍磯  Dashboard
螻糾鴬 螻覲  讌 
豐蠍郁 蟠   C&C 一危一豢
螳 蠏覈(覯觚 蠍)
螳  蟆所骸 螳(覯觚 )
螻糾鴬  糾
螳覲 糾
 讌  
讌蟯 れ螳 
覲企
 螻糾鴬  螻
螻 覩殊鴬蟆  
襦 螳企.
- 18
Complete Endpoint Protection
Cybereason EDR 譯殊 蠍磯  Malop 
螻糾鴬 
蠏朱蓋
螳朱 襷 覲
螻糾鴬 螻()
狩  螻糾鴬 蠏碁9
ろ螻  螻糾鴬 覈襦
誤螻 觜襯願 蟆 .
- 19
Complete Endpoint Protection
Cybereason EDR 譯殊 蠍磯  Malop 碁 伎 
覯 企Ν朱 覦襦 譟一 讌
蠏朱蓋 語 
レ 覦 蠍郁鍵  覲 
蟯  旧 覿
  蟲 
螻糾鴬 殊
覿/讌 蟆郁骸  蠏碁渚
螳螳 碁 覈 企Ν 誤
覲企ゼ 襴企れ 襦 譟壱 覦 .
- 20
Complete Endpoint Protection
Cybereason EDR 譯殊 蠍磯   覦 譟一
螳覲  覲旧 誤語 覯 企Ν朱 
ろ語
誤碁ゼ 蟆襴
(旧   讌)
襦語 譴讌(Kill Process)
 蟆襴(Quarantine Process)
讌ろ碁Μ (Remove Registry)
襦語 ろ 覦讌(Prevention)
- 21
Complete Endpoint Protection
Cybereason EDR 譯殊 蠍磯   覿
覿 譟郁唄   貎朱Μ , 譯  貎朱Μ  蠍磯
Cybereason 螻牛 れ 譟郁唄譴
 譟郁唄  牛  伎 譟壱.
譟郁唄 朱 ロ螻 譟壱 螳
 RestAPI 螻旧朱 貎朱Μ    語
牛 蟆郁骸  蠍磯 讌.
- 22
Complete Endpoint Protection
Cybereason EDR 譯殊 蠍磯  File 蟆
豌 誤語  蟆
- 23
蟠覲 蠏, 蟆 蠍磯 襦蟾,
朱  朱覓語(*)蠍磯 蟆,
Offline 殊 3   ,
3手  伎 覲願,
朱/語ろ語企/蟆暑/伎/
覦  讌 覲,
 れ企
襴 譟壱
Complete Endpoint Protection
Cybereason NGAV
谿碁 磯企
- 24
Complete Endpoint Protection
Cybereason NGAV   谿碁 磯企
れ讌   貊, れ  貊, ,
PowerShell(Fileless)  貊  蠍一 揃 譟一 襷れ 襷 譬襯
 讌襷, 讌蠍蟾讌 蠏碁 覈    磯企
襭 譟伎 讌 給.
誤語 覦企ゼ 螻ろ  襷れ 襷 譬襯  る
蟆 蟾螻 覈   貊襯 讌    襭
蟆伎 .
Cybereason 谿碁 磯企(NGAV) 覈  
貊     磯企 襭 EDR螻 
伎 (殊) 螻牛.
蠍一ヾ れ  貊 覦 れ讌  襦  貊 煙 覩語一 覦讌螻 伎 覿  煙 螻.
- 25
Complete Endpoint Protection
Cybereason NGAV  4螳讌 譯殊 轟
れ讌  Malware:
瑚概讌(襾語)
:
 覿
Fileless :
 覿
れ
Malware:
覦企

NGAV
譯殊蠍磯
 瑚概讌(AI)  れ讌   襦蠏碁 覦讌
襾語 螻襴讀(AI) 牛 覦企  (蠏碁豎) 螳讌   
れ讌   貊襯 豕螻 讌襯螻 螳  ろ襯襦 螳讌/谿.
  覦讌
 覿 牛 殊 誤蠍     ,
Fileless , MBR 蠍磯 企ゼ 讌 揃 谿.
  PowerShell ろ襴渚(Fileless) 覦讌
Powershell  OS 蠏 蟲襯  Fileless  貊  螻糾鴬
 讌/谿.
 れ  貊  蟆
企 れ  貊 蠍一ヾ 覦企  (蠏碁豎) 伎
朱 讌/谿.
- 26
Complete Endpoint Protection
Cybereason NGAV  煙 れ  覦讌
覲伎 企轟  覿伎
譴譯朱  讌 覦 譟一
Need your attention
  NGAV螳 讌讌襷 朱 豺襭/覦
   Malware襯 覲伎譴.
豢螳 覿(Investigation) 牛 譟一 蠍磯 讌.
Completed
  NGAV螳 豺襭  覦蟇磯 襭襦
 Malware 覈襦 .
- 27
Complete Endpoint Protection
Cybereason NGAV   覦讌
Deception(覩碁) 蠍磯  螳讌
襷蠍一 覩碁 殊 蟆螻 蠏 覩碁
殊 誤 蟆 碁Μ蟇壱 螳讌.
れ蟇磯 れ讌 
 螳讌
 覿 牛 螳讌
Cybereason 郁規 30,000蟇伎 伎
襦襯 覿 42螳  蟲一朱
覿襯  轟 螳讌.
- 讌 蠏碁企
ろ語襯 牛 狩 
伎 れ讌 
企 螳讌 覦 譴讌
れ  覦 れ讌  企ゼ  螳讌 覦覯朱 螳讌
- 28
Complete Endpoint Protection
Cybereason NGAV  Fileless  貊 覦讌
豕蠏 Fileless  貊 螻糾鴬 讀螳螻 SANS 2017 Threat Landscape Survey 磯ゴ覃, 蠍一 3
覿 1 Fileless  螻糾鴬 讌覃危螻 る 蟆郁骸  給.
蠍一ヾ  貊  螻糾鴬螻朱 襴, 企   螻糾鴬螳  貉危一
語企ゼ れ 螳 給.  Windows 伎ル  朱  襦蠏碁 覦 IT
蟲, 麹 PowerShell 螻 給.
Fileless Malware螳 れ   覦企襴螳 螻 蠍磯蓋朱 襤壱   蠏 蟲襯
螻 蠍 覓語 螳讌螻 覦讌 蟆 麹 企旧給.
Cybereason Fileless  貊 覦讌 蠍磯レ  襴?
 ろ襴渚碁 覈 譴 覲企 蟆  Powershell 讌 ろ 貊 
 覈  覲願鍵  襦語 譴 訖襷   蟾 貊 譴 
覿   給.
Fileless  貊 覦讌 蠍磯レ 轟
 覈 譬襯  ろ襴渚 讌(Mimicat)
 覈 覯 PowerShell 讌 (覯 2 )
 覈 譴  ろ襴渚, System.Management.Automation.dll
襦  覈 覦覯 語 覦覯 
- 29
Complete Endpoint Protection
Cybereason NGAV  Fileless  貊 覦讌 - 
- 30
れ Fileless 螻糾鴬 讌
れ企 PowerShell,
 危語 PowerShell...
Complete Endpoint Protection
-  蟲-
Cybereason Platform Architecture
Complete Endpoint Protection
Cybereason Platform Architecture   蟲
Sensor
Detection Servers
User Interface
Registration Server
(Option)
WebApp Server
Global Threat
Intel Server
Update Server
Private Threat
Intel Server
螻螳  Cloud
 On-Promise
螻旧 Cloud
 Sensor
れ 語ろ語 覿  襦蠏
讌  Detection Server蟆 .
 Registration Server
Sensor襯 Detection Server .
 Detection Server
(Malops & Malwares) 讌 覦 譟一.
 Update Server
覲伎 豺 覦 一危.
 Global Threat Intel Server
 Private Threat Intel Server
燕, IP, 覃 煙 螻
 WebApp Server
 覲  覦 蟯襴襯   誤壱伎
- 32
Complete Endpoint Protection
Cybereason Sensor Architecture   蟲
Detection
Logic
Update
Anti-Malware Engine
On Access Scan
Sensor Services
, 襦語 覦 蠍壱 覲伎
蟯 企欧 煙 
一危磯ゼ 讌.
 一危磯ゼ 覿 覦 讌襯
 Detection Server襦
. Anti-Malware
Service 焔
讌/覿 覲企ゼ 覦
Detection Server襦 .
ろ 殊 ろ覃
ろ 覦讌 殊企螳 
 蟆   讌
覿襯 蟆一 Execution
Prevention Service襯 語!
Detection Server
Anti-Malware
Driver
Anti-Malware
Service
EDR
Execution Prevention
Driver
File Access from Disk
Kernel  User 
Sensor
 殊 焔蟇磯
襦語り ろ 殊
′語 り 覃 Anti-
Malware Engine 語
On Access Scan !
Execution Prevention
Service
Artificial Intelligence
Scanner
Application Control
Scanner
Anti-Ransomware
Service
- 33
Complete Endpoint Protection
Cybereason  Sensor  豢螳 蠍磯  覦 誤 蟯襴
- 34
れ 譟郁唄 蟆朱
 伎
豕豐 語ろ  
(蠍磯,  語ろ  )
讌蟯 誤
殊
Complete Endpoint Protection
Cybereason Sensor  讌 伎 豌伎
Windows Mac Linux
 Windows XP SP3 (limited support)
 Windows Vista (limited support)
 Windows 7 SP1
 Windows 8
 Windows 8.1
 Windows 10
 Windows Server 2003 (limited support)
 Windows Server 2008 (limited support)
 Windows Server 2008 R2
 Windows Server 2012
 Windows Server 2012 R2
 Windows Server 2016
 OS X Yosemite (10.10)
 OS X El Capitan (10.11)
 OS X Sierra (10.12)
 OS High Sierra (10.13)
 CentOS 6 and 7
 Red Hat Enterprise Linux 6 and 7
 Oracle Linux 6 and 7
 Ubuntu 14 LTS and 16 LTS
 Amazon Linux AMI 2017.03
 Amazon Linux AMI 2016.09
 Amazon Linux AMI 2016.03
 Amazon Linux AMI 2015.09
 Amazon Linux AMI 2015.03
- 35
Complete Endpoint Protection
Cybereason Sensor  OS覲  覦 譟一 蠍磯
蠍磯 Windows XP SP3
Server 2003
Windows Vista
Server 2008
Windows 7 SP1
8, 8.1, 10
Server 2008 R2
Server 2012
Server 2012 R2
Server 2016
Mac Linux
讌ろ碁Μ 
Remove Registry
  
襦語 譴讌
Kill Process
    
/襦語 蟆襴
Quarantine Process
    
Autorun 
Delete Autorun
  
ろ 覦讌
Prevent Execution

語ろ 蟆襴
Isolate Machine
   
Suspend / unsuspend
Ransomware

Malware Alert 蟯襴 
- 36
Complete Endpoint Protection
Cybereason Sensor  れ 蟲  覦 襴 
覈 蟲
CPU Dual Core 2Ghz core i3 伎
Memory 1GB 伎
Disk 150 MB 伎
Network Connection Ethernet  Wi-Fi
覈 蟲
CPU Dual Core 2Ghz core i3 伎
Memory 2GB 伎
Disk 1.5 GB 伎
Network Connection Ethernet  Wi-Fi
 No NGAV  NGAV Enabled ( Windows only )
 5% 危 CPU 襯!
 語ろ  5M ~ 10M data
 No Crashes!
 No user impact!
誤  ろ語 (Mbps)
100 0.23 Mbps
1000 2.26 Mbps
10K 23 Mbps
50K 114 Mbps
100K 229 Mbps
 Network 
- 37
Complete Endpoint Protection
Cybereason 譯殊  
 Detection
螳讌 讌 覦覯  : 豕 TI  れ  讌, 蠍磯讌(Behavior Detection) 螻糾鴬  讌(TTC 蠍磯 讌)
豌伎 蠍磯 讌, れ螳  豌 語ろ 企欧 蟯覿, 一   螻,
 螻豺襦 讌 企伎 ろ襯 豕襦 觜讌 襴ろ 譴,
讌 螻覿   朱 狩  覦,
れ 讌ロ 讌 蠍磯朱 覲伎 覿螳 螻糾鴬 讌 螳 螳,
螻糾鴬 讌  覦 覲襦 In-depth 讌 蠍磯 (誤磯 旧ろ襦, 企朱煙 牛 螻糾鴬焔)
Custom TI,
 Investigation
讌 Alert  觜襯  覦   谿覲 讌蟯 覲 螻(煙語, 覓伎語, 豢螳 覿 讌煙  覲)
覿螳 襴  譯 豕 覲 螻(覈 郁 覲 螻),
 覲伎  IT襭 焔 Alert   覿 覦 ,
れ螳 Global TI ,
 Response
蟆讌 覈 語ろ 螳 覲 覦 譴 伎 蟯襴,
 Alert 覦 (狩   Alert  蠏碁9螻  覯 企Ν朱 譟一(Single Click Response)),
EDR蠍磯レ Hash蠍磯 Black List  讌(App Control-轟 語ろ  豌 ),
 讌 豌襴(Whist List)襦 螻螳覲 豕 ,
 Hunting
企襴讀   襭 覦 Alert語 Baseline 覿,  螻糾鴬 襦  覿, 觜讌 覲 貉れろ 貎朱Μ 覦一 ろ,
TTC(tactics, techniques and procedures蠍磯 覿,
 Integration
Custom TI, AD, UEBA, SIEM煙 3rd party 襭螻 磯 讌 覦 
- 38
Complete Endpoint Protection
Q & A
Thank you!
讌 24/7 覈磯 牛 Cybereason
豌 IT 蟆曙  覯渚 語 蠍磯レ 螻牛覩襦
語讌 "讌蠍 螻糾鴬 覦螻 給蟾?
朱 讌覓語 牛  給.

More Related Content

What's hot (20)

IBM 覲伎襭 襴讌襴誤_覲企慨 豺伎螻
IBM 覲伎襭 襴讌襴誤_覲企慨 豺伎螻
APT Case Study
APT Case Study
Youngjun Chang
覲伎 リ骸 覦
覲伎 リ骸 覦
Youngjun Chang
Monitoring solution for all action in enterprises
Monitoring solution for all action in enterprises
lunchNtouch
Netsec-kr 2013 覦襭 - 煙 覿 蠍一 (蟾螳)
Netsec-kr 2013 覦襭 - 煙 覿 蠍一 (蟾螳)
Korea University
求梶釈п釈求堰п午釈п 求釈a メ
求梶釈п釈求堰п午釈п 求釈a メ
貊 覲伎
貊 覲伎
Youngjun Chang
2013 一覲伎 螻給_()覿_sua_豕譬
2013 一覲伎 螻給_()覿_sua_豕譬
Lee Chanwoo
NETSCOUT Arbor Edge Defense
NETSCOUT Arbor Edge Defense
Jay Hong
Softcon hack your_service
Softcon hack your_service
HeoGyu
誤一 螳 (Sophos Intercept X)
誤一 螳 (Sophos Intercept X)
Gunjung Lee
Indusrial cyber security v3.0 螳
Indusrial cyber security v3.0 螳
Harry Sohn
2010 覦蠍 覲伎 リ骸 譯殊 覲伎
2010 覦蠍 覲伎 リ骸 譯殊 覲伎
Youngjun Chang
企殊磯 觜るゼ 伎 APT
企殊磯 觜るゼ 伎 APT
Youngjun Chang
vs 10
vs 10
Sik Kim
[覦 '15.11.27]覲企慨 覓瑚 蠍 new(豕譬_暑蓋)
[覦 '15.11.27]覲企慨 覓瑚 蠍 new(豕譬_暑蓋)
james yoo
1. 2009 覦蠍 覲伎
1. 2009 覦蠍 覲伎
Youngjun Chang
Apt(advanced persistent threat) 螻糾鴬 覦
Apt(advanced persistent threat) 螻糾鴬 覦
Youngjun Chang
Korean information security practices 覲伎 語蟲
Korean information security practices 覲伎 語蟲
Bill Hagestad II
M-Trends 2015: 豕殊 覲 蟯
M-Trends 2015: 豕殊 覲 蟯
FireEye, Inc.
IBM 覲伎襭 襴讌襴誤_覲企慨 豺伎螻
IBM 覲伎襭 襴讌襴誤_覲企慨 豺伎螻
Monitoring solution for all action in enterprises
Monitoring solution for all action in enterprises
lunchNtouch
Netsec-kr 2013 覦襭 - 煙 覿 蠍一 (蟾螳)
Netsec-kr 2013 覦襭 - 煙 覿 蠍一 (蟾螳)
Korea University
求梶釈п釈求堰п午釈п 求釈a メ
求梶釈п釈求堰п午釈п 求釈a メ
2013 一覲伎 螻給_()覿_sua_豕譬
2013 一覲伎 螻給_()覿_sua_豕譬
Lee Chanwoo
NETSCOUT Arbor Edge Defense
NETSCOUT Arbor Edge Defense
Jay Hong
Softcon hack your_service
Softcon hack your_service
HeoGyu
誤一 螳 (Sophos Intercept X)
誤一 螳 (Sophos Intercept X)
Gunjung Lee
Indusrial cyber security v3.0 螳
Indusrial cyber security v3.0 螳
Harry Sohn
2010 覦蠍 覲伎 リ骸 譯殊 覲伎
2010 覦蠍 覲伎 リ骸 譯殊 覲伎
Youngjun Chang
企殊磯 觜るゼ 伎 APT
企殊磯 觜るゼ 伎 APT
Youngjun Chang
vs 10
vs 10
Sik Kim
[覦 '15.11.27]覲企慨 覓瑚 蠍 new(豕譬_暑蓋)
[覦 '15.11.27]覲企慨 覓瑚 蠍 new(豕譬_暑蓋)
james yoo
1. 2009 覦蠍 覲伎
1. 2009 覦蠍 覲伎
Youngjun Chang
Apt(advanced persistent threat) 螻糾鴬 覦
Apt(advanced persistent threat) 螻糾鴬 覦
Youngjun Chang
Korean information security practices 覲伎 語蟲
Korean information security practices 覲伎 語蟲
Bill Hagestad II
M-Trends 2015: 豕殊 覲 蟯
M-Trends 2015: 豕殊 覲 蟯
FireEye, Inc.

Similar to Cybereason v2.10 (20)

谿暑30譯朱 蠍磯 isaca korea conference track4 伎穐(20160826)_語_豕譬
谿暑30譯朱 蠍磯 isaca korea conference track4 伎穐(20160826)_語_豕譬
Lee Chanwoo
谿暑30譯朱 蠍磯 isaca korea conference track4 伎穐(20160826)_覦_final
谿暑30譯朱 蠍磯 isaca korea conference track4 伎穐(20160826)_覦_final
Lee Chanwoo
蠍 覦 襭_襴ろ
蠍 覦 襭_襴ろ
PAUL OH
AWS Summit Seoul 2023 | 讌ロ 朱覿 讌 蟆瑚? 麹 蟆瑚?
AWS Summit Seoul 2023 | 讌ロ 朱覿 讌 蟆瑚? 麹 蟆瑚?
Amazon Web Services Korea
2014 pc覦覯
2014 pc覦覯
脚襴
讌瑚(Digital Guardian)
讌瑚(Digital Guardian)
silverfox2580
Radware Attack Mitigation Solution
Radware Attack Mitigation Solution
radwarekorea
Cyberark (企) PAM IDENTITY 襭 : 蠏殊, 語蟯襴, 蟠, 蟆蟯襴
Cyberark (企) PAM IDENTITY 襭 : 蠏殊, 語蟯襴, 蟠, 蟆蟯襴
脚襴
れ 螻糾鴬 譴 蟇語 豌 覲伎
れ 螻糾鴬 譴 蟇語 豌 覲伎
CiscoKorea
ESM (牛覲伎蟯襴)
ESM (牛覲伎蟯襴)
脚襴
App check pro_譴_z
App check pro_譴_z
脚襴
net helper7 牛 _
net helper7 牛 _
脚襴
企誤一喝豺企る蠏.沿糸韓
企誤一喝豺企る蠏.沿糸韓
脚襴
企 伎 ZERO 轟 一危磯ゼ 讌る 覯渚 覦, RansomZERO襦 蟇煙 語
企 伎 ZERO 轟 一危磯ゼ 讌る 覯渚 覦, RansomZERO襦 蟇煙 語
脚襴
(Ransomware) AWS 企殊磯 覲伎 - (AWS 襭讀ろ) :: 豪 覲伎 觜
(Ransomware) AWS 企殊磯 覲伎 - (AWS 襭讀ろ) :: 豪 覲伎 觜
Amazon Web Services Korea
2014 ps
2014 ps
脚襴
Secure Virtual Private Cloud(VPC)襯 覲伎 螳 觜螳 - 蟆曙 覿, 磯 貊襴 :: AWS ...
Secure Virtual Private Cloud(VPC)襯 覲伎 螳 觜螳 - 蟆曙 覿, 磯 貊襴 :: AWS ...
Amazon Web Services Korea
企 覲伎 危 Intro to korean cyber security
企 覲伎 危 Intro to korean cyber security
Bill Hagestad II
DLP 覲伎豢覦讌襭 ESM 覲伎蟯襴
DLP 覲伎豢覦讌襭 ESM 覲伎蟯襴
脚襴
2016 覲伎襭
2016 覲伎襭
脚襴
谿暑30譯朱 蠍磯 isaca korea conference track4 伎穐(20160826)_語_豕譬
谿暑30譯朱 蠍磯 isaca korea conference track4 伎穐(20160826)_語_豕譬
Lee Chanwoo
谿暑30譯朱 蠍磯 isaca korea conference track4 伎穐(20160826)_覦_final
谿暑30譯朱 蠍磯 isaca korea conference track4 伎穐(20160826)_覦_final
Lee Chanwoo
蠍 覦 襭_襴ろ
蠍 覦 襭_襴ろ
PAUL OH
AWS Summit Seoul 2023 | 讌ロ 朱覿 讌 蟆瑚? 麹 蟆瑚?
AWS Summit Seoul 2023 | 讌ロ 朱覿 讌 蟆瑚? 麹 蟆瑚?
Amazon Web Services Korea
2014 pc覦覯
2014 pc覦覯
脚襴
讌瑚(Digital Guardian)
讌瑚(Digital Guardian)
silverfox2580
Radware Attack Mitigation Solution
Radware Attack Mitigation Solution
radwarekorea
Cyberark (企) PAM IDENTITY 襭 : 蠏殊, 語蟯襴, 蟠, 蟆蟯襴
Cyberark (企) PAM IDENTITY 襭 : 蠏殊, 語蟯襴, 蟠, 蟆蟯襴
脚襴
れ 螻糾鴬 譴 蟇語 豌 覲伎
れ 螻糾鴬 譴 蟇語 豌 覲伎
CiscoKorea
ESM (牛覲伎蟯襴)
ESM (牛覲伎蟯襴)
脚襴
App check pro_譴_z
App check pro_譴_z
脚襴
net helper7 牛 _
net helper7 牛 _
脚襴
企誤一喝豺企る蠏.沿糸韓
企誤一喝豺企る蠏.沿糸韓
脚襴
企 伎 ZERO 轟 一危磯ゼ 讌る 覯渚 覦, RansomZERO襦 蟇煙 語
企 伎 ZERO 轟 一危磯ゼ 讌る 覯渚 覦, RansomZERO襦 蟇煙 語
脚襴
(Ransomware) AWS 企殊磯 覲伎 - (AWS 襭讀ろ) :: 豪 覲伎 觜
(Ransomware) AWS 企殊磯 覲伎 - (AWS 襭讀ろ) :: 豪 覲伎 觜
Amazon Web Services Korea
2014 ps
2014 ps
脚襴
Secure Virtual Private Cloud(VPC)襯 覲伎 螳 觜螳 - 蟆曙 覿, 磯 貊襴 :: AWS ...
Secure Virtual Private Cloud(VPC)襯 覲伎 螳 觜螳 - 蟆曙 覿, 磯 貊襴 :: AWS ...
Amazon Web Services Korea
企 覲伎 危 Intro to korean cyber security
企 覲伎 危 Intro to korean cyber security
Bill Hagestad II
DLP 覲伎豢覦讌襭 ESM 覲伎蟯襴
DLP 覲伎豢覦讌襭 ESM 覲伎蟯襴
脚襴
2016 覲伎襭
2016 覲伎襭
脚襴
Ad

Cybereason v2.10

  • 1. Complete Endpoint Protection Cybereason Complete Endpoint Protection EDR + NGAV
  • 2. Complete Endpoint Protection July 6, 2017: One of the largest health, hygiene, and home products manufacturers announced a $129 million decline in yearly forecast. August 16, 2017: The world's largest container shipping company had a $300 million impact on Q3 results, after halting worldwide operations. August 2, 2017: The second largest confectionary manufacturer in the world lost $150 million in quarterly sales and had incremental expenses of $7.1 million from one attack. August 3, 2017: A company that is home to several of the world's largest skin care brands delayed $41 million of second-quarter sales, after 10 days of shipping and production delays . July 28, 2017: One of the top 5 largest pharmaceutical companies in the world had operations and drug production disabled for more than a month after a cyber attack. September 7, 2017: One of the three major consumer credit reporting agencies experienced a breach, compromising the personal information of as many as half of all American adults July 17, 2017: The worlds 3rd largest shipping company announced a cyberattack in filing with the U.S. Securities and Exchange Commission. Estimated impact is in the hundreds of millions of dollars. July 21, 2017: Computer Software company announced its revenue for Q3 will be down as much as $20 million from original expectations. In addition, their stock price has steadily declined sine the cyber attack. 覦覲給 螻も - 2
  • 3. Complete Endpoint Protection EDR 螻 襷 From RealSecu, 2018-01-24, 2018綛 EDR 覲伎, 覺覦 覿 誤碁 ロ 襷 る 讌れ 豢蟲伎 碁 讌 豢. 蟆郁記 蠏瑚崖 蟆 螻 讌れ 給. Kevin Mandia, Founder of Mandiant 譟磯螳 襷 蠍一れ 覦煙 蟇 覃豢 蟆企 螻旧 覯 讓曙朱 覦レ 蟆. 蠏碁Μ螻 蠏 觜襴襯 襦 誤 襭れ 豈 蟆. Chris Sherman, Forrester Research 誤 伎 讌 覈磯 覲伎 螻 伎譯. 讌襷 讌朱 覈磯 り 企 譬 蟆螻 蟆 蟲覿讌 覈詩覃 覓企 る 蟇 螻螳 蟾給. 蠏碁Μ螻 豌企ゼ 覲 伎 蠏碁 蟆一 企Υ る 蟆. 蠏碁 螳煙 螳譟磯螻, 蟆曙讌 覲伎 襷 蟯螻 朱 蠏語 磯 覦煙襷朱 る 蟆 螳譟磯 蟆伎. 讌れ 糾 Josh Applebaum - 3
  • 4. Complete Endpoint Protection EDR - 4 Features Buyers Guide E Endpoint Endpoint SW agent れ れ machine 讌螳? 蟆暑 SW agent (CPU, Memory, Disk..) 豢 伎 豕 覦 讌 牛 Agent (NG AV, EDR..) D Detection Prevention 糾骸 / 壱 讌 谿(Prevention) 讌螳? (Behavior) 蠍磯 覿 螻牛螳? R Response れ螳 / 襦 譟一(Investigation) / 蠏殊 覿 (Root cause) 覿 覓語 ? 一危 覿 蠍一 (, ), 企殊磯 / 蟲豢 襦語 suspend, kill delete, quarantine, acquisition Machine 蟆襴 API 磯
  • 5. Complete Endpoint Protection EDR 蟲襷 伎 - 5 8% 16% 15% 15% 14% 12% 10% 10% 蠏螳 蟇磯 EDR 襭 蟯 譯殊 伎 覓伎蟾? (豌 旧 = 339) 一危 覲危 覦 豢 覦讌襯 企 讌螳 覦 襷 觜 覈磯 . 螻(Incident) 譟一 蟯 螳螻 煙 螳 り 覩酔給. 螻(Incident) 覦 豌願襯 螳蠍 轟 螻糾鴬 豌伎 危危る 豌 覈譯手鍵 螳煙 . 螻(Incident) 讌 蟇碁Μ 螳 螳 り 覩酔給.蠍一ヾ 誤 覲危 (EPP) 蟲一 覲伎り 覩酔給. 螻 螳 譟一 覲伎 豺企 螻蠍一, EDR 襭 (Mitigation)蠍磯 給. 覲伎螻螳 伎 EDR 豢讌 . 覿 襷 螻旧螳 . 蠏 覿覿 襷 襴 覩衰 給. 豢豌 : Enterprise Strategy Group, 2017 覿 螻旧 蠍一ヾ 覦煙 螻 企 螳 譟一 螳
  • 6. Complete Endpoint Protection : Spark Capital, CRV, Lockheed Martin, Softbank, Wells Fargo 400螳 伎 朱一 伎る殊 蟲一 豌覲 覿 (Unit 8200) 豢 25襷 伎 誤語 螻螳 襦 覲伎ろ 覲語 | 企 | 貎 | 磯 | ABOUT US - 6
  • 7. Complete Endpoint Protection Comprehensive Security: Enterprise Attack Protection - 7
  • 8. Complete Endpoint Protection Cybereason Product 蟲 Cybereason EDR 誤語 覃覲企ゼ 讌 企 螻糾鴬 讌襯 蟯覿 覦 襾語朱 れ螳朱 讌螻 企 覲伎 . Cybereason NGAV れ讌 貊, れ 貊, , Fileless(PowerShell) 貊 覈 譬襯 貊襯 谿 谿碁 磯企 + Cybereason Services 覓語 讌螻 蠍一 螳讌 覲伎 覿螳 螻螳讌(旧) - 8 Detection れ螳 讌 Prevention 煙 ろ覦讌 Remediation 讀螳 Investigation 所 ル 豢譟一 企 螻糾鴬 NGAV 豺 覦讌 EDR 豺 讌 覦 豺 豺
  • 9. Complete Endpoint Protection Cybereason Layer of Protection 1. NGAV Anti-Malware - 蠏碁豎 蠍磯 2. NGAV Anti-Malware - 襾語 蠍磯 3. 覿 - Anti-Ransomware - Fileless 覲危 4. EDR Pre-Execution Dynamic Post-Infection Cybereason 誤碁ゼ 覲危誤蠍 螻覲襦 覲危碁逢 螻. 螳 螻 襦 るジ 覃 蟯 覲伎 螻. 覯 語ろ( 伎狩-覈)襦 EDR+NGAV . - 9
  • 10. Complete Endpoint Protection Cybereason EDR 轟 讌蠍 螻糾鴬 覦螻 給蟾? EDR(Endpoint Detection and Response):誤 讌 覦
  • 11. Complete Endpoint Protection Cybereason EDR 螳 讌譴 螻糾鴬 讌蟯朱 螳. 螳 豢 "Cybereason EDR 螻糾鴬螳 螻螳 ろ語 蟆曙 螻 讌 螳襯 覈磯螻 AI 讌 牛 覲企ゼ 覿 れ螳朱 企 螻糾鴬 讌. 螳讌 螻糾鴬 碁 覲企ゼ 蠍 所 蟯襴 覃伎朱 蟆 螻糾鴬 豌 讀 螳螻 蟆 豌襴 企 覲伎 (EDR : Endpoint Detection and Response) 螻. - 11 螳煙 , 豢伎 蟆讀 覿螳 覿譟 企欧 れ 企れ 讌 覓 襴 覿 螳 覦 蠍一 れ 覓語
  • 12. Complete Endpoint Protection Cybereason EDR 蟲譟 - 12 覈 ろ 殊 EndPoint 一危磯ゼ 讌 襦語, レ, 覃覈襴, 讌ろ碁Μ, 蠍壱 殊企 覲襯 蠍磯. 襦語れ 讌, 蟆襴 讌ろ碁Μ れ 譟一. 語, 襾語, 覿 れ 誤磯 蟲 Cybereason , 語螻 朱 螻糾鴬朱 郁屋 蟆 "Malop : Malicious Operation朱 螳讌.. 螻糾鴬 碁 覲企ゼ 蠍 所 蟯襴 覃伎朱 螻糾鴬 豌 讌 螳 螻牛 覿螳螳 碁 蟆 蠏覈螻 豕 願屋 覦 螻ろ蟆 . Cloud 覦 On-premise 覦 覈 讌
  • 13. Complete Endpoint Protection Cybereason EDR 麹 蠍磯 碁覈襴 覿 - 13 80,000 RECORDS PER SECOND VS. 8,000,000 RECORDS PER SECOND GEN 2 SECURITY SOLUTIONS GEN 3 CYBEREASON
  • 14. Complete Endpoint Protection Cybereason EDR Built-in 讌 覈 - 豌伎 - 14 Infiltration (豺) 螻糾鴬螳 豺蠍 れ蟇磯 れ讌 覃, 覃 , Zero-day 旧ろ襦 讌 Privilege Escalation (蟠) 螻糾鴬 谿剰鍵 蟠轟企 覯 蠏殊 襦語 譟一 C & C 企 襴れ 碁 螻糾鴬 C&C 旧 讌(DGA) Data Exfiltration (覲伎豢) 一危磯ゼ 碁襦 豢 企 ろ語 螻糾鴬襯 螳 覲 Lateral Movement (豸°危) 蠍一ヾ 覲伎 襭 讌 讌 覈詩 螻糾鴬 蟇一 覦 覦 讌 Ransomware 誤煙 覲 れ 覃(TI) & れ讌 覃 讌 襷 一危 譟郁 蟯 蟯 覿 Fileless 覃 螻糾鴬 讌 (PowserShell) 蠍磯 覿 ろ & 螻狩 豕 襭磯 豕 覿 Zero 覃誤磯 谿覲
  • 15. Complete Endpoint Protection Cybereason EDR 覿讌(Hunting Engine) - 15 EndPoint Facts Evidence Suspicions Malop Hunting Engine(觜一危) Malop 企欧 覲 ル碁´蟇磯 覲豺 Facts 豢豢 れ螳 覃 一危 讌 (ろ語 , 襦語る) IP, 覃碁 覲 觜蟲 れ螳 れ姶 覿 螳レ Evidence 豢豢(螻豺 )
  • 16. Complete Endpoint Protection Cybereason EDR 譯殊 蠍磯 襷 誤碁 れ螳 覈磯 螳 蠍一 覲伎 れ 誤語 貊 螳 覦 螻糾鴬 讌螻 覯襯 誤螻 蟆 蟆 殊 . Cybereason EDR 襷 誤 蟆曙 れ螳朱 覈磯螻 螻糾鴬 譟郁鍵 ろ. Windows, Mac OS, Linux 覯襯 覈 覈磯 覲伎 豈 螳蟲 覈 誤碁ゼ 螳螻 蠏碁れ 讌, 覲, 讀 危 螻, 螳 , 蟆暑 狩企ゼ 蟆 襭 蟲. Cybereason EDR れ 蟆曙 螳, 螻糾鴬 豌 螳螻 弰. 覈 誤語 襯 蠍 所 螳 企 螻糾鴬 覦覯 蟲覓 伎螻 朱, 誤語 襯 蟆曙 覲伎 誤 谿場覲願鍵 企旧給. Cybereason EDR 螻糾鴬 讌襯 覿 覦 螻糾鴬 覦覯 煙 覿 牛 讌譴 螻糾鴬 讌蟯朱 螳 蟆 給. Cybereason れ螳 螻糾鴬 讌 覦 弰 讌, 覯渚 語 覦 螻糾鴬 蟾 危企ゼ 螻. - 16
  • 17. Complete Endpoint Protection Cybereason EDR 谿覲 覦 螻 襾語 譬 螻糾鴬 讌 豐 800襷覯 伎 觜一危 覿 蟲一 覲伎 譴 企 螻糾鴬 豌願 讌 覿 牛 れ讌 . れ螳朱 企 螻糾鴬 豌 . 伎る殊 蟲一 豌覲 覿 豢 誤磯ゼ 讌. 讌 螻糾鴬 讌蟯朱 螳 る 豢豢 郁屋 朱 螻糾鴬 ろ襴襦 螳. 螻糾鴬 蠏朱蓋 , , 旧, レ 覦 蠍郁鍵 襯 螻企 朱 伎 覲伎 覓企ゼ 譴願 螳 豢. Cybereason 谿覲 Cybereason 螻 覦壱, 襴 豕 螻糾鴬 豌 讀 螳 蠍 蟯襴 覃 れ螳 螳讌 覦 - 17 豢 伎, 誤 豕 覿 牛 れ讌 .
  • 18. Complete Endpoint Protection Cybereason EDR 譯殊 蠍磯 Dashboard 螻糾鴬 螻覲 讌 豐蠍郁 蟠 C&C 一危一豢 螳 蠏覈(覯觚 蠍) 螳 蟆所骸 螳(覯觚 ) 螻糾鴬 糾 螳覲 糾 讌 讌蟯 れ螳 覲企 螻糾鴬 螻 螻 覩殊鴬蟆 襦 螳企. - 18
  • 19. Complete Endpoint Protection Cybereason EDR 譯殊 蠍磯 Malop 螻糾鴬 蠏朱蓋 螳朱 襷 覲 螻糾鴬 螻() 狩 螻糾鴬 蠏碁9 ろ螻 螻糾鴬 覈襦 誤螻 觜襯願 蟆 . - 19
  • 20. Complete Endpoint Protection Cybereason EDR 譯殊 蠍磯 Malop 碁 伎 覯 企Ν朱 覦襦 譟一 讌 蠏朱蓋 語 レ 覦 蠍郁鍵 覲 蟯 旧 覿 蟲 螻糾鴬 殊 覿/讌 蟆郁骸 蠏碁渚 螳螳 碁 覈 企Ν 誤 覲企ゼ 襴企れ 襦 譟壱 覦 . - 20
  • 21. Complete Endpoint Protection Cybereason EDR 譯殊 蠍磯 覦 譟一 螳覲 覲旧 誤語 覯 企Ν朱 ろ語 誤碁ゼ 蟆襴 (旧 讌) 襦語 譴讌(Kill Process) 蟆襴(Quarantine Process) 讌ろ碁Μ (Remove Registry) 襦語 ろ 覦讌(Prevention) - 21
  • 22. Complete Endpoint Protection Cybereason EDR 譯殊 蠍磯 覿 覿 譟郁唄 貎朱Μ , 譯 貎朱Μ 蠍磯 Cybereason 螻牛 れ 譟郁唄譴 譟郁唄 牛 伎 譟壱. 譟郁唄 朱 ロ螻 譟壱 螳 RestAPI 螻旧朱 貎朱Μ 語 牛 蟆郁骸 蠍磯 讌. - 22
  • 23. Complete Endpoint Protection Cybereason EDR 譯殊 蠍磯 File 蟆 豌 誤語 蟆 - 23 蟠覲 蠏, 蟆 蠍磯 襦蟾, 朱 朱覓語(*)蠍磯 蟆, Offline 殊 3 , 3手 伎 覲願, 朱/語ろ語企/蟆暑/伎/ 覦 讌 覲, れ企 襴 譟壱
  • 24. Complete Endpoint Protection Cybereason NGAV 谿碁 磯企 - 24
  • 25. Complete Endpoint Protection Cybereason NGAV 谿碁 磯企 れ讌 貊, れ 貊, , PowerShell(Fileless) 貊 蠍一 揃 譟一 襷れ 襷 譬襯 讌襷, 讌蠍蟾讌 蠏碁 覈 磯企 襭 譟伎 讌 給. 誤語 覦企ゼ 螻ろ 襷れ 襷 譬襯 る 蟆 蟾螻 覈 貊襯 讌 襭 蟆伎 . Cybereason 谿碁 磯企(NGAV) 覈 貊 磯企 襭 EDR螻 伎 (殊) 螻牛. 蠍一ヾ れ 貊 覦 れ讌 襦 貊 煙 覩語一 覦讌螻 伎 覿 煙 螻. - 25
  • 26. Complete Endpoint Protection Cybereason NGAV 4螳讌 譯殊 轟 れ讌 Malware: 瑚概讌(襾語) : 覿 Fileless : 覿 れ Malware: 覦企 NGAV 譯殊蠍磯 瑚概讌(AI) れ讌 襦蠏碁 覦讌 襾語 螻襴讀(AI) 牛 覦企 (蠏碁豎) 螳讌 れ讌 貊襯 豕螻 讌襯螻 螳 ろ襯襦 螳讌/谿. 覦讌 覿 牛 殊 誤蠍 , Fileless , MBR 蠍磯 企ゼ 讌 揃 谿. PowerShell ろ襴渚(Fileless) 覦讌 Powershell OS 蠏 蟲襯 Fileless 貊 螻糾鴬 讌/谿. れ 貊 蟆 企 れ 貊 蠍一ヾ 覦企 (蠏碁豎) 伎 朱 讌/谿. - 26
  • 27. Complete Endpoint Protection Cybereason NGAV 煙 れ 覦讌 覲伎 企轟 覿伎 譴譯朱 讌 覦 譟一 Need your attention NGAV螳 讌讌襷 朱 豺襭/覦 Malware襯 覲伎譴. 豢螳 覿(Investigation) 牛 譟一 蠍磯 讌. Completed NGAV螳 豺襭 覦蟇磯 襭襦 Malware 覈襦 . - 27
  • 28. Complete Endpoint Protection Cybereason NGAV 覦讌 Deception(覩碁) 蠍磯 螳讌 襷蠍一 覩碁 殊 蟆螻 蠏 覩碁 殊 誤 蟆 碁Μ蟇壱 螳讌. れ蟇磯 れ讌 螳讌 覿 牛 螳讌 Cybereason 郁規 30,000蟇伎 伎 襦襯 覿 42螳 蟲一朱 覿襯 轟 螳讌. - 讌 蠏碁企 ろ語襯 牛 狩 伎 れ讌 企 螳讌 覦 譴讌 れ 覦 れ讌 企ゼ 螳讌 覦覯朱 螳讌 - 28
  • 29. Complete Endpoint Protection Cybereason NGAV Fileless 貊 覦讌 豕蠏 Fileless 貊 螻糾鴬 讀螳螻 SANS 2017 Threat Landscape Survey 磯ゴ覃, 蠍一 3 覿 1 Fileless 螻糾鴬 讌覃危螻 る 蟆郁骸 給. 蠍一ヾ 貊 螻糾鴬螻朱 襴, 企 螻糾鴬螳 貉危一 語企ゼ れ 螳 給. Windows 伎ル 朱 襦蠏碁 覦 IT 蟲, 麹 PowerShell 螻 給. Fileless Malware螳 れ 覦企襴螳 螻 蠍磯蓋朱 襤壱 蠏 蟲襯 螻 蠍 覓語 螳讌螻 覦讌 蟆 麹 企旧給. Cybereason Fileless 貊 覦讌 蠍磯レ 襴? ろ襴渚碁 覈 譴 覲企 蟆 Powershell 讌 ろ 貊 覈 覲願鍵 襦語 譴 訖襷 蟾 貊 譴 覿 給. Fileless 貊 覦讌 蠍磯レ 轟 覈 譬襯 ろ襴渚 讌(Mimicat) 覈 覯 PowerShell 讌 (覯 2 ) 覈 譴 ろ襴渚, System.Management.Automation.dll 襦 覈 覦覯 語 覦覯 - 29
  • 30. Complete Endpoint Protection Cybereason NGAV Fileless 貊 覦讌 - - 30 れ Fileless 螻糾鴬 讌 れ企 PowerShell, 危語 PowerShell...
  • 31. Complete Endpoint Protection - 蟲- Cybereason Platform Architecture
  • 32. Complete Endpoint Protection Cybereason Platform Architecture 蟲 Sensor Detection Servers User Interface Registration Server (Option) WebApp Server Global Threat Intel Server Update Server Private Threat Intel Server 螻螳 Cloud On-Promise 螻旧 Cloud Sensor れ 語ろ語 覿 襦蠏 讌 Detection Server蟆 . Registration Server Sensor襯 Detection Server . Detection Server (Malops & Malwares) 讌 覦 譟一. Update Server 覲伎 豺 覦 一危. Global Threat Intel Server Private Threat Intel Server 燕, IP, 覃 煙 螻 WebApp Server 覲 覦 蟯襴襯 誤壱伎 - 32
  • 33. Complete Endpoint Protection Cybereason Sensor Architecture 蟲 Detection Logic Update Anti-Malware Engine On Access Scan Sensor Services , 襦語 覦 蠍壱 覲伎 蟯 企欧 煙 一危磯ゼ 讌. 一危磯ゼ 覿 覦 讌襯 Detection Server襦 . Anti-Malware Service 焔 讌/覿 覲企ゼ 覦 Detection Server襦 . ろ 殊 ろ覃 ろ 覦讌 殊企螳 蟆 讌 覿襯 蟆一 Execution Prevention Service襯 語! Detection Server Anti-Malware Driver Anti-Malware Service EDR Execution Prevention Driver File Access from Disk Kernel User Sensor 殊 焔蟇磯 襦語り ろ 殊 ′語 り 覃 Anti- Malware Engine 語 On Access Scan ! Execution Prevention Service Artificial Intelligence Scanner Application Control Scanner Anti-Ransomware Service - 33
  • 34. Complete Endpoint Protection Cybereason Sensor 豢螳 蠍磯 覦 誤 蟯襴 - 34 れ 譟郁唄 蟆朱 伎 豕豐 語ろ (蠍磯, 語ろ ) 讌蟯 誤 殊
  • 35. Complete Endpoint Protection Cybereason Sensor 讌 伎 豌伎 Windows Mac Linux Windows XP SP3 (limited support) Windows Vista (limited support) Windows 7 SP1 Windows 8 Windows 8.1 Windows 10 Windows Server 2003 (limited support) Windows Server 2008 (limited support) Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 OS X Yosemite (10.10) OS X El Capitan (10.11) OS X Sierra (10.12) OS High Sierra (10.13) CentOS 6 and 7 Red Hat Enterprise Linux 6 and 7 Oracle Linux 6 and 7 Ubuntu 14 LTS and 16 LTS Amazon Linux AMI 2017.03 Amazon Linux AMI 2016.09 Amazon Linux AMI 2016.03 Amazon Linux AMI 2015.09 Amazon Linux AMI 2015.03 - 35
  • 36. Complete Endpoint Protection Cybereason Sensor OS覲 覦 譟一 蠍磯 蠍磯 Windows XP SP3 Server 2003 Windows Vista Server 2008 Windows 7 SP1 8, 8.1, 10 Server 2008 R2 Server 2012 Server 2012 R2 Server 2016 Mac Linux 讌ろ碁Μ Remove Registry 襦語 譴讌 Kill Process /襦語 蟆襴 Quarantine Process Autorun Delete Autorun ろ 覦讌 Prevent Execution 語ろ 蟆襴 Isolate Machine Suspend / unsuspend Ransomware Malware Alert 蟯襴 - 36
  • 37. Complete Endpoint Protection Cybereason Sensor れ 蟲 覦 襴 覈 蟲 CPU Dual Core 2Ghz core i3 伎 Memory 1GB 伎 Disk 150 MB 伎 Network Connection Ethernet Wi-Fi 覈 蟲 CPU Dual Core 2Ghz core i3 伎 Memory 2GB 伎 Disk 1.5 GB 伎 Network Connection Ethernet Wi-Fi No NGAV NGAV Enabled ( Windows only ) 5% 危 CPU 襯! 語ろ 5M ~ 10M data No Crashes! No user impact! 誤 ろ語 (Mbps) 100 0.23 Mbps 1000 2.26 Mbps 10K 23 Mbps 50K 114 Mbps 100K 229 Mbps Network - 37
  • 38. Complete Endpoint Protection Cybereason 譯殊 Detection 螳讌 讌 覦覯 : 豕 TI れ 讌, 蠍磯讌(Behavior Detection) 螻糾鴬 讌(TTC 蠍磯 讌) 豌伎 蠍磯 讌, れ螳 豌 語ろ 企欧 蟯覿, 一 螻, 螻豺襦 讌 企伎 ろ襯 豕襦 觜讌 襴ろ 譴, 讌 螻覿 朱 狩 覦, れ 讌ロ 讌 蠍磯朱 覲伎 覿螳 螻糾鴬 讌 螳 螳, 螻糾鴬 讌 覦 覲襦 In-depth 讌 蠍磯 (誤磯 旧ろ襦, 企朱煙 牛 螻糾鴬焔) Custom TI, Investigation 讌 Alert 觜襯 覦 谿覲 讌蟯 覲 螻(煙語, 覓伎語, 豢螳 覿 讌煙 覲) 覿螳 襴 譯 豕 覲 螻(覈 郁 覲 螻), 覲伎 IT襭 焔 Alert 覿 覦 , れ螳 Global TI , Response 蟆讌 覈 語ろ 螳 覲 覦 譴 伎 蟯襴, Alert 覦 (狩 Alert 蠏碁9螻 覯 企Ν朱 譟一(Single Click Response)), EDR蠍磯レ Hash蠍磯 Black List 讌(App Control-轟 語ろ 豌 ), 讌 豌襴(Whist List)襦 螻螳覲 豕 , Hunting 企襴讀 襭 覦 Alert語 Baseline 覿, 螻糾鴬 襦 覿, 觜讌 覲 貉れろ 貎朱Μ 覦一 ろ, TTC(tactics, techniques and procedures蠍磯 覿, Integration Custom TI, AD, UEBA, SIEM煙 3rd party 襭螻 磯 讌 覦 - 38
  • 39. Complete Endpoint Protection Q & A Thank you! 讌 24/7 覈磯 牛 Cybereason 豌 IT 蟆曙 覯渚 語 蠍磯レ 螻牛覩襦 語讌 "讌蠍 螻糾鴬 覦螻 給蟾? 朱 讌覓語 牛 給.