A Quick Tour of Ceedo Safe Browsing and Remote Access Protection

(contractors, offshore, BYOC) When connecting to or from unsafe locations, the end-point\data center is exposed. Organizational Resources Data theft Machine hijacking Ransomware (Cryptolocker) Compromised infrastructure Privacy (session leftovers) etc. Corporate Desktop Unmanaged PC (contractors, offshore, BYOC)

Conceptually… If you could some how create a barrier – an abstraction layer – in the PC stack, you could: Applications Hard Disk Another HDD Operating System Desktop Environment Applications Desktop Environment Operating System Hard Disk Defend the OS and Apps

Abstraction Layer = Virtualization

Ceedo’s virtualization engines - overview Disk virtualization Ceedo has an internal VHD-based virtual disk-mounting system Disks are mounted through internal OS<->disk interface Disks can be mounted with no mount point and into RAM Create child disks, merge disks, etc. Hard Disk Operating System Desktop Environment Applications VHD Process virtualization Process-centric isolation Every operation a specified process tries to execute is manipulated and redirected Virtualization is inherited by child processes For instance, if a virtualized browser opens PDF Reader, the PDF reader will be virtualized too Hard Disk VHD Operating System Desktop Environment Applications

How do we isolate windows components? Think of regular firewalls: Internet\network firewalls allow companies to decide which applications can have incoming or outgoing connections to the network depending on rules Now think of PCs: Our Kernel Firewall allows companies to decide which applications can have access to the OS and other apps! Completely isolating apps depending on rules

Remote Access Protection and Safe Browsing Hard Disk VHD Operating System Desktop Environment Applications Remote Access Protection and Safe Browsing connecting to or from unsafe locations

Isolation – from the inside out Traditional anti malware solutions are mostly based on signature recognition and heuristics. This means that if the attack vector is new or smart enough – you are exposed. Isolation protects the machine by blocking any untrusted software or infected web pages from touching the machine (MITM/MITB). Window title 3/14/2011 3:00PM

Isolation – from the outside in Traditional remote computing relay mostly on communication-centric measures (tunnels, 2FA, etc.). But if the client is compromised, nothing is secure. Isolation prevents the compromised machine from accessing any data generated during a remote session. Window title 3/14/2011 3:00PM

Ceedo’s extra security and privacy tools Nothing is written to the machine and all generated data can be removed entirely at the end of the session. To add an extra layer of protection, the “bubble” runs from a hidden location stored inside an encrypted container. And to seal the environment we also deal with environment permissions (AC), process enforcement, and more…

What we do – in process isolation context Run isolated applications (installed to the host or encapsulated) Protected from the client and protecting the client Leave zero-footprint and/or keep data encrypted Remove all session data after shutdown, or store it in encrypted containers Allowing safe browsing and secure computing To and from unsecure locations keeping privacy and safety

How we do it Isolate processes by redirecting all R/W functions For instance: app writes document to C:\, we divert it to X:\ Capture all R/W data in a hidden disposable VHD volume Optional load VHD as RAM-disk and/or with zero-mount point Leverage native NTFS permissions (AC) Launch processes with “Run-As” using separate user account

Components in process isolation context VHD based isolated environment (optional: with encapsulated applications) Application launcher (host/encapsulated) Kernel “firewall” – intercept and divert R/W operations form virtualized processes Virtual user with separate elevation and NTFS security configurations. Kernel functions “firewall”

Components in process isolation context VHDs and data can be stored inside encrypted containers locked to a specific machine. Environment can force processes to terminate based on MD5 and Certificate Thumbnail (black\whitelist) All components undergo integrity check to protect against tampering Remote wipe\deactivation Kernel functions “firewall”

Thank You www.ceedo.com