1. ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals What’s Hiding on Your Network? Kevin Jones

2. 2 2©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Monkey See, Monkey Do

3. 3 3©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Monkey see, Monkey do, Monkey sell Black hole exploit kit

4. 4 4©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | A PC for hire on most any fortune 500 network?

5. 5 5©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Woopsie “I made it about halfway through the list of companies in the Fortune 100 with names beginning in “C” when I found a hit: A hacked RDP server at Internet address space assigned to networking giant Cisco Systems Inc. The machine was a Windows Server 2003 system in San Jose, Calif., being sold for $4.55 (see screenshot below). You’ll never guess the credentials assigned to this box: Username: “Cisco,”; password: “Cisco”. Small wonder that it was available for sale via this service. A contact at Cisco’s security team confirmed that the hacked RDP server was inside of Cisco’s network; the source said that it was a “bad lab machine,” but declined to offer more details”

6. 6 6©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | 2012: the year of hacktivism Arab Spring Political freedom Foxcon Working conditions Justice Department Anti-corruption Vatican Unhealthy transmitters UN ITU Internet deep packet inspection

7. 7 7©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | DDOS the Picket Line of the Future?

8. 8 8©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Looking back and forward Main security threats & risks Security architecture Recommendations 2012 2013 and beyond

9. 9 9©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Constantly changing environment Just as water retains no constant shape, so in warfare there are no constant conditions - Sun Tzu, The Art of War “ ”

10. 10 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Exploiting Zero-day vulnerabilities [Protected] Non-confidential content New vulnerabilities Countless new variants An average of 70,000 to 100,000 new malware samples are created and distributed each day

11. 11 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Real World Data

12. 12 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Threat Emulation Statistics Site Number of files emulated last 7 days Number of files emulated last 30 days Comments US Consumer Toys & Goods 6469812177923 New Detections in the last 7 days IL Law Services2210528742 New Detections in the last 7 days US Regional Bank18435037250550 New Detections in the last 7 days US Regional Bank1915936868 US Major Pharma79704154471 963 New Detections in the last 7 days. Same email was sent numerous times IL Online Gaming233523 Europe Major Bank 39095708348 New Detections in the last 7 days US Business Services56566 591 New Detections in the last 7 days. New installation US Electric Utility5494275929

13. 13 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | The Check Point Security Report 2013 About the research Key findings Security strategy Summary

14. 14 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Multiple sources of data SensorNet 3D Reports Threat Cloud

15. 15 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | A comprehensive survey 888companies 1,494gateways 120,000Monitoring hours 112,000,000security events

16. 16 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | A comprehensive survey % of companies Americas EMEA APAC Industrial Finance Government Telco Consulting Other By geographyBy sector

17. 17 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | The Check Point Security Report 2013 About the research Key findings Security strategy Summary

18. 18 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | We will talk about 3 issues Threats to the organization Risky enterprise applications Data loss incidents in the network

19. 19 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Anything for a Buck HACKED

20. 20 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | This does not affect me, right?

21. 21 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | The majority of companies are infected 63% 100% = 888 companies of the organizations in the research were infected with bots

22. 22 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Once in … always on Communicating with command & control every 21 minutes

23. 23 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals |

24. 24 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Exploit kits are easy to buy Rental costs One day – 50$ Up to 1 month – 500$ 3 month – 700$ Rental costs One day – 50$ Up to 1 month – 500$ 3 month – 700$ Available online

25. 25 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | But there is more than Bots, right? Malware INSIDE How does malware get to my network?

26. 26 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals |

27. 27 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Going to the wrong places…

28. 28 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Downloading malware all the time 53% of organizations saw malware downloads

29. 29 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Most attacks originate in the US Top malware locations, % US 71% Canada 8% Czech Rep 2% Slovakia 2% France 2% UK 2% Germany 2% Israel 3% Turkey 3% China 3%

30. 30 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Anatomy of an attack Recon Exploit Toolkit Backdoor Damage 4 3 2 1 BOT Virus RAT

31. 31 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | We will talk about 3 issues Threats to the organization Risky enterprise applications Data loss incidents in the network

32. 32 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | No longer a game

33. 33 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | What are risky applications? Bypassing security or hiding identity Do harm without the user knowing it P2P file sharing Anonymizers File sharing / storage Social networks

34. 34 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Risky applications Anonymizers

35. 35 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | What is an anonymizer? UserProxySite

36. 36 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | History of Anonymizers Began as “The Onion Router” Officially sponsored by the US Navy 80% of 2012 budget from US Government Used widely during Arab Spring

37. 37 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Anonymizers inside the corporation 47% of organizations had users of Anonymizers (80% were not aware that their employees use Anonymizers) 100% = 888 companies

38. 38 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Risky applications P2P file sharing

39. 39 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | The Risk of P2P Applications Downloading the latest “Walking Dead” episode right now Pirated content liability Malware downloads “Back door” network access

40. 40 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | P2P inside the corporation 61% of organizations had a P2P file sharing app in use 100% = 888 companies

41. 41 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Case example: P2P 3,800 personal details shared on P2P 95,000 personal details shared on P2P Fines for information disclosers

42. 42 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | We will talk about 3 issues Threats to the organization Risky enterprise applications Data loss incidents in the network

43. 43 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | How common is it? 54% of organizations experienced data loss

44. 44 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Many types of data leaked 24% Source Code 7% Email marked as confidential 14% Password protected file 29% Credit card information 13% Salary compensation information 7% Bank accounts numbers 6% Business data record 21% Other

45. 45 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | PCI compliance can be improved36% Of financial organizations sent credit card data outside the organization

46. 46 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Case examples: oops, wrong address 11 emails for a lawyer to the wrong address Worker fired for sending sensitive information to the wrong people GPAs of all students leaked to hundreds of unintended recipients Accidentally leaked 4,000 student social security numbers Oct 2012 Oct 2012 Apr 2012 Apr 2012

47. 47 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | We have all had this problem Error 552: sorry, that message exceeds my maximum message size limit Dropbox? YouSendIt? Windows Live?

48. 48 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Storing and Sharing applications 80% of organizations use file storage and sharing applications 100% = 888 companies

49. 49 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Top sharing and storage apps % of organizations But sharing is not always caring…

50. 50 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | The Check Point Security Report 2013 About the research Key findings Security strategy Summary

51. 51 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | We talked about three issues Threats to the organization Risky enterprise applications Data loss incidents in the network

52. 52 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Addressing external threats FW AV IPS Anti Bot Anti-Spam Emulation

53. 53 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Enabling secure application use URLF Antivirus Application Control Endpoint

54. 54 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Preventing data loss Doc Sec DLP Data End Point Application Control User check

55. 55 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | infected with bots Remember……. Threats to the organization Risky enterprise applications Data loss incidents in the network used Anonymizers had a data loss event 63%47%54%

56. 56 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | The Check Point Security Report 2013 About the research Key findings Security strategy Summary

57. 57 ©2010 Check Point Software Technologies Ltd. | [Restricted] ONLY for designated groups and individuals | Thank You!