sunhux
asked on
Recommend sandbox (for emails & site browsing) products tt gives almost realtime results
Currently our Proofpoint can take from a few minutes to 3 hours before it detects new
emails containing certain attachments & links (ie new threats) are 'malicious' or spam.
To claw back malicious emails 2-3 hours later is rather late. Wud rather have late delivery.
Our Bluecoat MAA that protects against malicious downloading (or malicious sites) can
take up to several minute : just encountered one case yesterday where malicious .eot
files were downloaded by several users before it blocked users from downloading.
This Bluecoat MAA is supposed to protect against 0-day and unknown threats as well
but we have got quite a few infections/downloads in the past: possibly its 'sandboxing'
is not real-time / fast enough.
I'm hesistant to deploy endpoint IPS (HIPS) on workstations at this moment so skip
this for the time being as HIPS can impact legit services/apps if not tested thoroughly
while network based tools like MAA (& Trendmicro Discovery) are less disruptive.
Besides educating users (which we have done quite a lot), I'm looking for sandboxing
products that could perform much faster : I read one academic article that products
that implement 'prefetching' using multi layer of caches are much faster. If they use
SSD, wud it be faster?
In particular against ransomware as one highly successful one as extracted below:
Sky News Technology Correspondent Tom Cheshire described the attack as "unprecedented". The ransomware appears to use NSA 0-day ETERNALBLUE and DOUBLEPULSAR exploits which were made public earlier this year by a group calling itself the Shadow Brokers.
Looks like initial infection vector is a phishing/macro email.
According to CrowdStrike's vice president of intelligence Adam Meyers, the initial spread of WannaCry is coming through spam, in which fake invoices, job offers and other lures are being sent out to random email addresses. Within the emails is a .zip file, and once clicked that initiates the WannaCry infection.
But the most concerning aspect of WannaCry is its use of the worm-like EternalBlue exploit. "This is a weapon of mass destruction, a WMD of ransomware. Once it gets into an unpatched PC it spreads like wildfire," he told Forbes. "It's going through financials, energy companies, healthcare. It's widespread."
Given the malware is scanning the entire internet for vulnerable machines, and as many as 150,000 were deemed open to the Windows vulnerability as of earlier this month, WannaCry ransomware explosion is only expected to get worse over the weekend.
If you can apply this patch immediately.
In the mean time, harden yourselves against this threat and ensure that all systems are fully patched with the "MS17-010" security update (link below) and remind all staff to Think Before They Click when they receive any out of the ordinary emails. https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
emails containing certain attachments & links (ie new threats) are 'malicious' or spam.
To claw back malicious emails 2-3 hours later is rather late. Wud rather have late delivery.
Our Bluecoat MAA that protects against malicious downloading (or malicious sites) can
take up to several minute : just encountered one case yesterday where malicious .eot
files were downloaded by several users before it blocked users from downloading.
This Bluecoat MAA is supposed to protect against 0-day and unknown threats as well
but we have got quite a few infections/downloads in the past: possibly its 'sandboxing'
is not real-time / fast enough.
I'm hesistant to deploy endpoint IPS (HIPS) on workstations at this moment so skip
this for the time being as HIPS can impact legit services/apps if not tested thoroughly
while network based tools like MAA (& Trendmicro Discovery) are less disruptive.
Besides educating users (which we have done quite a lot), I'm looking for sandboxing
products that could perform much faster : I read one academic article that products
that implement 'prefetching' using multi layer of caches are much faster. If they use
SSD, wud it be faster?
In particular against ransomware as one highly successful one as extracted below:
Sky News Technology Correspondent Tom Cheshire described the attack as "unprecedented". The ransomware appears to use NSA 0-day ETERNALBLUE and DOUBLEPULSAR exploits which were made public earlier this year by a group calling itself the Shadow Brokers.
Looks like initial infection vector is a phishing/macro email.
According to CrowdStrike's vice president of intelligence Adam Meyers, the initial spread of WannaCry is coming through spam, in which fake invoices, job offers and other lures are being sent out to random email addresses. Within the emails is a .zip file, and once clicked that initiates the WannaCry infection.
But the most concerning aspect of WannaCry is its use of the worm-like EternalBlue exploit. "This is a weapon of mass destruction, a WMD of ransomware. Once it gets into an unpatched PC it spreads like wildfire," he told Forbes. "It's going through financials, energy companies, healthcare. It's widespread."
Given the malware is scanning the entire internet for vulnerable machines, and as many as 150,000 were deemed open to the Windows vulnerability as of earlier this month, WannaCry ransomware explosion is only expected to get worse over the weekend.
If you can apply this patch immediately.
In the mean time, harden yourselves against this threat and ensure that all systems are fully patched with the "MS17-010" security update (link below) and remind all staff to Think Before They Click when they receive any out of the ordinary emails. https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Your feedback or closure is awaited.
Sunhux, why abandon this?
ASKER
least) before we can fully test & deploy