STORYBOAR
Total Data Protection
Outside the Firewall
total data
protection
CONFIDENTIAL

Agenda
1. Cloud and mobile require new security strategy
2. Overview of CASB architecture
3. How malware infects O365?
4. Attack stages of Advanced Persistent Threat?
5. AI-based approach to Advanced Threat protection
6. O365 Advanced Threat Protection
7. Use cases protected by CASBs
8. Q & A

The Perfect Storm
exponential growth in malware samples and cloud app adoption
source: https://www.okta.com/blog/2015/05/okta-the-perfect-complement-to-google-for-wsource: https://www.av-test.org/en/statistics/malware/

cloud & mobile drive data outside the firewall...
...leaving traditional security technologies ineffective
Problem

CASB Security
a data-centric approach
the new data reality requires a new security
architecture
■ cross-device, cross-platform data protection
■ granular controls for protecting data at rest and
in motion
■ contextual access control
■ detailed logging for compliance and audit

How Malware Infects O365
6

Attack stages of Advanced Persistent Threat
CASBs offer holistic protection
Delivery
• URL filtering: Block malicious sites and links
Exploitation
• Identify and block exploits
Installation
• Block known and zero-day malware
• Block unwanted file types (e.g: executables)
Command&
Control
• Block malware domains
• Deny access to compromised Users and devices
Actions on
Objectives
• Prevent malware spread
• Prevent data exfiltration by enforcing DLP and access control policies
CASB persistent threat detection and prevention capabilities

Poll:
How are you protecting
your O365 instances
from malware attacks?
1. Deployed 3rd party AV
2. O365 advanced threat protection
3. CASB/proxy-based solutions
4. No malware protection
5. Did not deploy O365

O365 Advanced Threat Protection (ATP)
reactive, slow, limited
Sandbox-based detection adds significant
latency
E5 is required for ATP.
75% more expensive than E3.
Requires a minimum deployment of 500 seats
Protected by AV engines built on legacy
detection technologies, such as signature and
heuristics, that are reactive

MALWARE’S VICIOUS
INFINITE LOOP
 Malware mutations are the norm
 Malware authors use polymorphism,
obfuscation and automation to create
390,000 new malicious programs per day
 AV engines can’t keep up
 Using signatures, whitelists,
rules/heuristics or execution to detect
malicious behavior doesn’t scale
 Detection misses lead to…
 Incident response
 Increased hunting
 More cleanup & re-imaging
 More risk

HUMANS ARE A FINITE RESOURCE
It’s a question of scale, speed, breadth, and correlation.
Which approach meets the modern challenge?
• Linear ability to combat attacks
• Human correlated feature sets
• Algorithmic ability to combat attacks
• Machine correlated feature sets make
connections that humans can’t see

Leverage the power of
machines,not humans, to
dissect malware’s DNA.
Artificial intelligence then
determines if the code is
safe to run.
Never have an unknown file
threat because the AI
prediction doesn’t change.
AI IS NOTAI-BASED APPROACH IS
Rely on AI
and ML
Analyze Malware
at the DNA-level
Advanced Threat
Prevention
Minimal
Updates
PredictiveAutonomous
Decision
Rely on Human
Classifications
Require Constant
Updates
Behavioral
Analysis
Require On-Premise
Infrastructure
Wait for Threats
to Execute
Signatures
Micro-
Virtualization
Heuristics
Sandboxing

WHAT’S SO SPECIAL ABOUT PREDICTING ATTACKS?
Predictive analysis provides highly effective detection and prevention of never before
seen threats
GLASSRAT
• Undetected for Years
• Human Discovered Nov
23, 2015
Cylance –
Blocked as of April 2014:
18 months prior to human
discovery
ZCRYPTOR
• Spear-Phishing
• Human Discovered April
2016
Cylance –
Blocked as of Oct 2015:
6 months prior to human
discovery
SAURON/STRIDER/
REMSEC
• Espionage Backdoor
dating back to 2011.
Human Discovered
August 2016
Cylance –
Blocked as of Jan 2015:
18 months prior to human
discovery
GOLDENEYE
RANSOMWARE
• Weaponized Excel and
PDF Files
Cylance –
Blocked as of Oct 2015:
14 months prior to human
discovery
GOLDENEYE
RANSOMWARE
• Weaponized Excel and
PDF Files
Cylance –
Blocked as of Oct 2015:
14 months prior to human
discovery
WANNACRY/
WANNACRYPT
• New ransomware variant
exploiting MS
vulnerability
Cylance –
Blocked as of Jan 2015:
17 months prior to
discovery

Business Areas
Endpoint Security
Consulting Services
OEM / Technology Partnerships
Unprecedented Market Acceptance
1,089% Year-Over-Year Growth
1,000+ Clients
4 Million+ Endpoints
BUSINESS SNAPSHOT
V E R T I C A L
M A R K E T
A G N O S T I C
“
”
Cylance is easily the
fastest-growing EPP
startup in the last ten
years…

Use Cases
15

Use Case 1:
real-time malware protection
■ block malware before it reaches cloud app
■ leverage proxies to control access to any
app from any device
■ quick detection with low-latency
■ whitelisting mechanism for false-positives

Use Case 2:
protect managed devices
■ block malware before it reaches end-point
■ prevent sync clients from downloading
malicious content
■ Layered anti-malware strategy

Use Case 3:
protect unmanaged devices
■ protect unmanaged with no or poor EPP
solutions
■ enable access to enterprise apps on
BYOD
■ block malware on unmanaged devices
spreading to cloud apps

Use Case 4:
prevent spread of malware via interconnected cloud apps
■ It is common to connect cloud apps to
other apps (i.e: O365 and Box)
■ Interconnected cloud services provide new
paths for malicious files to make their way
into cloud services and devices
■ Delete or quarantine files that are deemed
malicious

Poll: What is your
primary O365 use case
that needs malware
protection?
1. Protect unmanaged devices
(PC/Mac)
2. Protect managed / corporate-
owned devices
3. Protect mobile devices
(iOS/Android)
4. Prevent spread of malware via
interconnected cloud services

STORYBOAR
omni citadel harbor
data protection on
any device
high-performance
advanced DLP
patented cloud
encryption
only bitglass
agentless, cloud-based solution
deploys in minutes
threat
known- and unknown-
malware
protection

STORYBOAR
total data
protection