All Rights Reserved2
SonicWALL Strengths
SonicWALL is in a leadership position across our key markets andgaining share.
SonicWALL has a growing, global install base of over 1 million customers
Our value is very hard to copy in the marketplace.1. Excellent partnership with CDW to support our customers2. Broad solution set for a wide range of customer needs3. Unique deep packet inspection technology4. Services model for dynamic security, productivity and support
All Rights Reserved5
Today’s Reality
1. Organizations and people are dependant on technology2. Attacks are now both obscured and actionable3. Time from vulnerability to exploit is shorter
Perpetuated by:Outdated technologyContinual security
changesLimited controlHuman factors
The new attackers:Cybercrime Organizations Mafia OrganizationsProfessional HackersCompany insiders
All Rights Reserved7
Why Would Anyone Target Me?
“I don’t run a web-site or any services”“I only use my computer for work/email/browsing”“I don’t store sensitive information on my computer”“I have a personal firewall and AV software”
True – very few individuals are selected as targets, but anyone unprotected can be caught in the widely cast netOnly with understanding of the scope and severity of the threat can we dispel the dangerous misconception of invisibility
All Rights Reserved8
The Attack: Deception
Leveraging TrustSending IM and email to buddy/contact lists from infected machines since the recipient knows/trusts the sender
Escalating the “Authenticity” of the FraudProfessionally designed phishesMulti-layered attacks, such as the recent Allied Irish Bank scam
Following the MassesGoing where the people are, leveraging the inherent trust of the portal. In 2006:
Wikipedia - http://www.heise.de/english/newsticker/news/80417MySpace - http://seclists.org/fulldisclosure/2006/Nov/0275.html
All Rights Reserved9
“http://142.176.247.82/SigninP1212...”Phishers Turn Pro
Really professional phish
Source: SonicWALL SMART Lab
All Rights Reserved10
Phishing: The Con Must Convince
“Undetectable” Allied Irish Bank scam uses a layered attack: Uses previously installed malware to conceal the fraudWhen a user browses to AIB, the virus activates and superimposes itself over the real page
All Rights Reserved11
The human factor cannot be ignored:
30% to 40% of employee Internet use is not work related*
37% of the US population use IM*
55% of online users have been infected with spyware*
Instant messaging security threats double every 6 months*
*Intl Data Corp * http://www.postordre.org/be-cm/files/402/EMOTA+Newsletter++Issue+082006.htm *Bigfoot Interactive *Gartner
21%
4%
10%
14%
16%
29%
44%
47%
54%
0% 10% 20% 30% 40% 50% 60%
None
Hacking Tools
Illegal Software
DVDs
P2P File Sharing
MP3s
Streaming Media
Games
Personal IM
Non-work related activities
Bottom line: Network misuse provide the fuel for today’s
organized crime and workplace productivity issues
Why? Human Behavior Contributes
All Rights Reserved12
MyTob Worm
Discovered on: Variant returned again January 2007W32.Mytob.@mm is a mass-mailing worm that propagates via network shares and through email Opens a back door into the affected computerSelf protects by redirecting AV updates to local computer
All Rights Reserved13
Step 1: Arrives as an email or buffer overflow
Server ZoneUser Zone
Copies itself as %System%\msnmsgs.exeAdds the value: “MSN” = “msnmsgs.exe”to registry:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunHKEY_CURRENT_USER\Software\Microsoft\OLEHKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Control\Lsa
W32.Mytob@mm runs every time Windows starts
All Rights Reserved16
Step 3: Logs in to an IRC channel
Server ZoneUser Zone
Connects to an IRC channel on the irc.blackcarder.net domain on TCP port 6667 Advertises host PC IP addresslistens for commands that allow the remote attacker to perform the following actions:
Download filesExecute files Delete files Update itself Get uptime information
IRC Server
All Rights Reserved17
Step 4: Generate potential targets and attack
Server ZoneUser Zone
Generates random IP addresses
Exploits the RPC/DCOM vulnerabilityAllows the program to gain full access and execute any code on a target machine by sending a malformed packet to the DCOM service
Exploits the Windows LSASS vulnerabilityThis is a buffer overflow that allows remote code execution and enables a malicious user to gain full control of the affected system
Random IPs
All Rights Reserved18
Step 5: Uses its own SMTP server to send itself
Server ZoneUser Zone
Searches for email addresses on local computer.wab.adb.tbb.dbx
From: “Spoofed”Subject:
hello hi error status
Find Email Addresses
.aspphp.sht.htm
Mail Transaction Failed Mail Delivery System SERVER REPORT (No Subject) (random alphabets)
All Rights Reserved20
The Four Key Efficiency Elements for Business
Data
Technology, Applications & Users
BusinessCommunication Company
Networks
Organizations have evolved and are dependent on technology and access to information
Organizations have less resources to work with
High price of security problems, downtime and productivity loss
Addressing the four technology forces are critical for success
All Rights Reserved21
“46% of security officers spend more than a third of their day understanding security threats”
“For 52% of the networks the perimeter is the only defense”
“38% of small and medium enterprises (SMEs) do not have enough IT staff”**
“32% of SMEs say a security strategy takes too much time to implement”**
“58% of SMEs say the network is too expensive to maintain properly”*
“Instant messengers and peer-to-peer applications were used in 7 of the top 10 Internet threats”***
Business Pain Points & Requirements
Worry-Free Use
LoweredCost
Securing Assets
Limited resources
Limited CurrentSolution
Lower complexity & managementManagementReporting
Lower total cost of ownershipProductivity Control
Intelligent, adaptable solution Network Intelligence
Automated, zero user interventionDynamicArchitecture
SonicWALL Unified Threat ManagementRequire Security for TodaySecurity
Integration
SMEs want reliable business communications and lower total cost of ownership
Pain Solution Requirements
*Preventsys ** Yankee Group ***Symantec
All Rights Reserved23
Corporate Network Protection & Mobility
Corporate Networks
Secure Remote Connectivity with “Clean
VPN”
Secure Remote Connectivity with “Clean
VPN”
High-Speed Unified Threat Management Protection
and Prevention
High-Speed Unified Threat Management Protection
and Prevention
Wireless and Wired Services, Content Filtering
and Application Control
Wireless and Wired Services, Content Filtering
and Application Control
Client & Server Protection and Network Access Control Enforcement
Client & Server Protection and Network Access Control Enforcement
SonicWALL Network Security solutions are designed for maximum protection, performance & efficiency and dynamic service capabilities
Secure Virtual Private Network
Protected Traffic
Remote Connectivity
Security Client Enforcement
All Rights Reserved24
Better Protection & PerformanceSolutions Are Not Created Equal
Current FirewallsPort blocking TCP/IP RulesIP RoutingLink Layer
Routers Firewalls Cisco/Fortinet SonicWALLUTM
Intelligent UTM ProtectionScan Unlimited Sized Files & UsersBlock Applications such as SkypeOutbound Spyware ControlContent Filtering/Control & PhishingStream-based file support“Clean VPN” – Protection for VPN Users
Atta
ck S
ophi
stic
atio
n Typical UTM Protection
Limited scanning for Viruses/Worms/TrojansInbound Spyware protectionSNTP, HTTP, IMAP supportContent Filtering
Network ThreatsSimple DoS Attack IP SpoofSmurf Attack
“Highest Risk” ThreatsRootkitsHidden malware in large filesSpyware communication outboundPhishing attacksViruses transmitted to network drivesSkype/Instant Messenger threats
Typical ThreatsDownloaded or emailed VirusesEasy to acquire SpywareMisuse of network resources
SonicWA
LL U
nified Threat Managem
ent
Deeper Inspection & Greater Performance
SonicWALL 130MbpsSonicWALL 130MbpsSS
All Rights Reserved25
SonicWALL UTM Solutions Connectivity
Secure connectivityAccess to resourcesWireless mobilityNetwork availability
Security IntegrationComplete ProtectionExternal PreventionInternal Network Security“Clean VPN”
Intelligence & OptimizationOne point of network controlContent & application filtering Business application prioritization Ease of deployment & management
Management and Reporting
SonicWALL Unified Threat Management Platform
Dynamically Updated Architecture
Security Integration
Productivity Control
Network Intelligence
Client Identity/Integrity
Management and Reporting
SonicWALL Unified Threat Management Platform
Dynamically Updated Architecture
Security Integration
Productivity Control
Network Intelligence
Client Identity/Integrity
Dedicated Content Security
WirelessSmall officeMedium/Large Business
All Rights Reserved26
The New TZ 190
Combine a PC card from your wireless carrier with the SonicWALL TZ 190
to create an instant secure broadband network anywhere
New
All Rights Reserved27
Remote Access Solutions
UnrestrictedUnrestrictedUnrestrictedConcurrent user license
2005010Recommended number of concurrent users
Mid-to-large enterprises with 500 or more employees
Mid size organizations with 500 or fewer employees
Small organizations with 50 or fewer employees
Target Customer
SSL-VPN 4000SSL-VPN 2000SSL-VPN 200
New