Download "Check Point Harmony: новое семейство решений для защиты устройств сотрудников"
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FV0CXaM4FWc8%252Fmaxresdefault.webp&w=1139&q=75)
Please wait. We're preparing links for easy ad-free video watching and downloading.
Table of contents
Similar videos from our catalog
%3Aformat(webp)%2Fi.ytimg.com%252Fvi%252F4bkn5E1lito%252Fmaxresdefault.jpg&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FBHleeE4fPTs%252Fmaxresdefault.webp&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FBfbHCiB4UOs%252Fmaxresdefault.webp&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FIIHEcjr57f8%252Fmaxresdefault.webp&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FKquE7BzLwiA%252Fmaxresdefault.webp&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FSYhnv3Y4-fA%252Fmaxresdefault.webp&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FbtjSc2OSadk%252Fmaxresdefault.webp&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FloRFuWu5KD4%252Fmaxresdefault.webp&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi%252Ft9noFiGtpdQ%252Fmaxresdefault.jpg&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi%252FyCZ0DL_nLH4%252Fmaxresdefault.jpg&w=1139&q=75)
Video tags
Subtitles
Russian
00:00:10
good afternoon my name is Alexey00:00:12
Beloglazov company emergency point I answer00:00:14
for protection against cyber attacks today we00:00:19
let's talk about the solutions we call00:00:22
harmony harmony is a new family like00:00:26
already known new solutions that00:00:28
in chapat we offer for protection00:00:31
employees of modern realities and work00:00:34
remotely, in fact, not only00:00:37
for office workers this is also very00:00:39
useful of course we are all used to00:00:44
in more than a year00:00:45
connect to various applications and00:00:48
corporate services are not very good00:00:51
different devices like00:00:52
from home and from the office from desktop00:00:55
operating systems from mobile00:00:57
operating systems and attackers00:00:59
this is actively used00:01:01
they carry out various attacks00:01:04
just the number of ransomware and00:01:07
in principle, ransomware is essentially00:01:09
has increased over the past year00:01:12
trends and such that according to our00:01:15
reports and what00:01:16
published news and in order to00:01:19
basically you see00:01:20
since the second half of last year00:01:23
ransomware no longer just encrypts00:01:25
preliminary data about them is stolen and00:01:27
thus a second lever appears00:01:30
pressure on the organization of communication with this all00:01:33
more organization has to do00:01:35
pay the ransom the amount itself is average00:01:38
payments have increased significantly and with this00:01:41
we need to fight besides we naturally00:01:43
connect to various services00:01:46
we use our rosary somewhere00:01:49
second factor somewhere there is no second factor00:01:50
and the attackers are trying in every possible way to00:01:53
steal accounts in order to00:01:55
intercept this access, including from00:01:57
using spear phishing or mass00:02:00
phishing emails00:02:01
we see that among those brands under00:02:05
who is trying to disguise himself00:02:06
attackers are very common00:02:09
microsoft is it with 365 games pro00:02:12
we mail some other services well00:02:15
we must remember that00:02:17
and if he managed to steal from a powerful node00:02:20
an account, for example, a social network or some other00:02:23
streaming service like nad fix00:02:25
then again according to the role in this account00:02:28
very often can coincide with00:02:30
corporate therefore still need00:02:32
protect our users from phishing00:02:34
even if it doesn’t seem to concern00:02:37
corporate services and00:02:40
the number of cyber attacks themselves but00:02:42
is growing in our region in Russia in00:02:46
CIS we see that the number of attacks on00:02:49
the organization is on average significantly larger00:02:52
than the world average reaches about00:02:54
thousands of attacks per organization per week00:02:58
it's quite natural that00:03:00
most of them are successful00:03:02
prevented by our decisions about what00:03:04
we will continue to talk among00:03:07
various families became more active00:03:10
work of banking Trojans in recent years00:03:12
a few months still big00:03:15
bot activity and number00:03:17
ransomware, as I already said, has increased00:03:20
here on the graph you see about five00:03:22
percent before that we saw about00:03:25
one two percent, that is, growth00:03:27
decent enough and one is enough00:03:30
such penetration to cause trouble00:03:32
in the organization how do you know the families00:03:37
Trojan layout by joint efforts in that00:03:40
interpol number00:03:41
managed to neutralize his replacement00:03:44
did the malware come and how did they Frade?00:03:46
still in use three years00:03:49
other families appeared and00:03:52
accordingly, you need to fight them00:03:55
must be prevented00:03:56
it turns out that in today's00:03:59
In reality, the range of threats is quite large and00:04:03
the attack area is very large because00:04:06
these are different devices00:04:08
communications between these devices00:04:10
services of the organization and all this for00:04:12
outside the traditional perimeter and00:04:15
there are a lot of problems that need to be solved00:04:18
information officer decide00:04:19
security to solve these problems00:04:22
a huge number of different00:04:24
solutions00:04:25
We in the company strive for all this00:04:28
unify history somehow simplify00:04:32
bring it under a single denominator and we00:04:35
We offer a family of solutions harm and00:04:37
some just allows you to solve00:04:40
main cases00:04:42
like those we face today00:04:43
when organizing a truly safe00:04:46
people actually work remotely00:04:50
not only remotely but from the office too00:04:52
This concerns email security00:04:55
protection of the devices themselves00:04:58
employees and remote access and00:05:00
Internet access today I have my own00:05:03
presentation is not built around00:05:05
specific solutions and around use cases and00:05:08
accordingly we are specific00:05:10
let's talk and space is the first one like this00:05:13
of course to protect email00:05:16
because about seventy00:05:18
eighty percent of cyber attacks are00:05:21
start with getting to users00:05:23
phishing or malicious emails00:05:26
then the user opens something00:05:28
something doesn't always click00:05:31
training helps because00:05:33
the attackers are really very00:05:36
prepares these letters efficiently and00:05:38
again, traditional defense is also not00:05:41
always manages to filter and three00:05:44
video to respond to such attacks00:05:46
therefore there is a need for an overlay00:05:49
specialized protection00:05:50
which is the service harmony million office00:05:54
in case this office 365 it has00:05:59
native integration, that is, essentially00:06:01
the letter first reaches the office 306 500:06:04
passes inspection by antispam antivirus00:06:08
then it is redirected to our service00:06:11
inspect there and return back00:06:14
and if everything is fine with her except this and00:06:17
the same email protection service00:06:20
from the cloud00:06:22
naturally we have something similar00:06:24
solution based on local gateways00:06:26
checkpoint which becomes in the mode00:06:29
mail transfer agent local sandbox00:06:31
this is all outside the scope of today's webinar00:06:34
but nevertheless the technology seems like this00:06:37
here's protection00:06:38
email from the cloud she also00:06:41
possible in case of local00:06:43
microsoft excel email service00:06:46
And so on or in the case of, for example, a hybrid00:06:48
implementation of office 365 or jess you when00:06:52
Some mail servers are located00:06:55
the local part is present in the cloud with00:06:57
There are very different implementation schemes, but00:07:00
however, we manage to embed our00:07:03
service in order to fully00:07:05
filter incoming emails as a result00:07:09
we analyze the contents of these letters00:07:12
we sort each letter into pieces00:07:14
various indicators and build a model00:07:18
machine learning natural what if00:07:20
We know that there is some kind of link00:07:22
some file is already malicious that's all00:07:25
immediately goes into quarantine00:07:27
but in a controversial situation it is naturally very00:07:31
it is important to understand what kind of communication this is00:07:32
between whom and whom00:07:34
what phrases are found what graphics00:07:37
appears in the body of the letter and thanks00:07:41
this is how we manage to get high-quality00:07:43
our pilots show the exact verdict00:07:46
that the solution is found by many00:07:49
phishing emails that arrive00:07:51
for example through built-in office protection00:07:53
365 besides this of course we check00:07:56
nesting and the same applies here00:08:00
the most successful technologies00:08:02
implemented on our gateways00:08:03
local security has probably been around for years00:08:06
5 how could there be more00:08:09
this is working with a sandbox and here we have00:08:12
we have the opportunity initially00:08:15
provide to the user very quickly00:08:18
proactively cleared attachment that is, it00:08:21
receives a letter containing all attachments00:08:23
turned into secure documents and00:08:27
parallel00:08:28
These files are sent for analysis to00:08:31
sandboxes that will lead to a full-fledged00:08:33
dynamic analysis and find out00:08:35
original files are malicious00:08:37
or not if the user still needs00:08:40
original for example because we deleted00:08:43
we execute some macro from the body from00:08:46
body of the document and in this case00:08:49
user can request00:08:50
this original via the link in the same00:08:53
the letter itself from the mechanism we have debugged00:08:55
many happy customers over the years00:08:58
who have it all implemented like this00:09:01
way and this allows us to ensure00:09:03
the opportunity to work with people without losing00:09:08
productivity despite the fact that00:09:10
sandbox is in gap mode00:09:12
prevention itself solution00:09:16
the checkpoint sandbox is called oblast00:09:19
it has been tested repeatedly by us00:09:22
absolute trace until I'm with us00:09:25
labs existed last year00:09:27
unfortunately00:09:28
finished her work as an IT organization00:09:31
we hope that as it incarnates there will be00:09:34
the following similar tests00:09:36
but nevertheless we showed the best00:09:38
threat prevention level and00:09:40
indeed this is the solution for which00:09:42
you can rely on exactly the same00:09:44
sandboxes are also used in email pocket00:09:46
in office among advanced cases you can00:09:50
mark next if attachment00:09:53
for example password protected and password00:09:57
somehow indicated or sent via00:10:00
with or somehow else to the user what is ours00:10:03
they are not able to find a solution in this00:10:06
case there is a mechanism when the user00:10:09
receives the original letter but00:10:11
attachments removed00:10:13
and in the body of the letter there is a line that00:10:15
prompts the user to enter a password00:10:17
for investments the result is that00:10:21
user visits this portal for00:10:23
each of the attachments if there are several of them00:10:26
enters your password and then our service00:10:30
checks it can really open00:10:32
Now inspect this attachment00:10:35
all contents of this archive and beyond00:10:37
respectively00:10:39
give some verdict if these00:10:42
the attachments are malicious, they are sent to00:10:44
quarantine another story with links in00:10:48
the body of the letter naturally contains links00:10:52
checked by reputation and00:10:54
in the case of many file services we do this00:10:57
let's follow these links from00:10:59
Why do they need malicious files and check them?00:11:02
they are further in the sandbox accordingly00:11:03
We are blocking this letter but there is a mechanism00:11:06
rewriting links in this case00:11:09
the user initially receives a letter00:11:12
in which the link is not original00:11:14
which leads to our service and when00:11:17
a person clicks on this link then this00:11:20
the page or the file that00:11:22
it can also be downloaded from this link00:11:24
this is checked by our sandbox00:11:28
helps prevent infection already in00:11:32
moment of click especially since they happen00:11:35
attacks when similar content is available00:11:39
according to the link in the letter it is to the attackers00:11:42
is replaced, relatively speaking, at that moment00:11:45
when the letter was sent for example00:11:47
at night service protection he tried to pass00:11:51
and download and there was safe content in00:11:55
that moment when a person clicks in the morning00:11:57
following the link this content becomes00:11:59
Accordingly, such a service is dangerous00:12:02
allows us to really solve this00:12:04
problem and fully provide protection00:12:07
from the end user's point of view00:12:09
it all looks something like this00:12:13
there are letters that were protected with00:12:17
using our solution here00:12:19
there was some kind of malicious file00:12:21
blocked which passed through00:12:23
built-in protection in office 365 except00:12:27
this functionality is in the new service00:12:30
really new compared to00:12:31
with our local gateways we also00:12:34
we send these to users00:12:36
digests in which the user sees00:12:39
which letters were quarantined?00:12:42
has the ability if necessary00:12:45
for example, request to release some00:12:49
a specific letter if it seems to him that00:12:52
it was a false positive and so on00:12:55
administrators in the management interface00:12:58
works with similar ones accordingly00:13:01
with queries he sees statistics on threats00:13:04
for some time, for example, he00:13:08
configures the cat's security policy00:13:11
is capable of protecting against spam not from00:13:14
phishing and against any malicious00:13:17
positions of malicious links and further00:13:19
works with quarantine here00:13:22
opportunity to view just the request00:13:24
on the part of users in this case00:13:27
we see that it was a malicious letter00:13:29
there was an attachment you can see00:13:32
report from the sandbox and in this case it is00:13:36
quite a well-known malware by the way00:13:38
despite the fact that he is quite00:13:40
famous he still flew through00:13:42
built-in protection from 365 and you can00:13:45
see some other details on00:13:47
this incident and further administrator00:13:50
decides no, he refuses00:13:52
users will not release this00:13:55
quarantine malware by the quarantine itself00:13:58
you can also work here, you can also work here00:14:00
separately see events related00:14:02
for example with the situation when we00:14:07
The user is prompted to enter a password00:14:09
You can view the information separately00:14:11
associated, for example, with honey plants00:14:13
investments and so on, that is, like this00:14:16
a fairly simple service reminds that00:14:19
it integrates either natively00:14:22
using office 365 methods or via mx00:14:26
records the case when it's something else00:14:30
mail system including local00:14:33
and thus we are the first00:14:35
we are the entry point for the flow of letters00:14:37
We check completely, including00:14:40
We perform all basic antispam checks00:14:42
those who are not familiar with that portal on00:14:45
which I am now, let me remind you that00:14:48
checkpoint cloud services managed00:14:51
through the so-called infinite portal on00:14:54
which I am now present here we are00:14:57
we see there are different families00:14:59
solutions as you know all the hardware00:15:02
checkpoint gateway is now called00:15:04
quantum everything about cloud00:15:07
infrastructures and platforms and I saved it00:15:10
cloud harth and today we are talking00:15:13
about harmony00:15:14
if you're lost in these new ones00:15:16
titles we had at the beginning of this year00:15:18
rebranding here there is a wonderful one00:15:20
a checkbox that allows you to see how00:15:23
these solutions were called before00:15:25
for example harmony million office before00:15:27
it was called cloud harth right now but that version00:15:31
services which I am showing now00:15:33
its next version which is now00:15:35
available to which we are smoothly migrating00:15:38
during this year it is available here at00:15:41
this section check point labs harmony00:15:44
million office 20 colleagues if you have any problems00:15:48
questions write them in the cuando and I sections00:15:51
I will actually answer here first of all00:15:55
the case is email protection00:15:58
however, it is natural to this very00:16:01
email is not just people00:16:04
connect from a variety of locations00:16:06
devices and therefore the following from the case00:16:09
us is connected to the remote connection itself00:16:14
remote connection can be00:16:15
implemented in different ways, for example in00:16:18
throughout the past year our00:16:21
customers actively deployed repairs00:16:23
access let's drink to our gateways and with our00:16:27
NTP tapes00:16:28
but besides this there are, for example, situations00:16:30
when you or external contractors00:16:33
or part of internal employees including00:16:35
number of devops you need to allow access without00:16:40
client to specific resources or00:16:43
your data center or even in public00:16:46
in the clouds, for example, someone is sawing you00:16:49
some kind of application00:16:50
deployed some project somewhere in00:16:53
openwork or in google cloud and you need00:16:56
provide remote access there or00:16:59
you have desktop infrastructure00:17:01
and you provide access to it00:17:03
your data center has a lot of different00:17:05
situations00:17:08
the solution is without client access00:17:11
quite a simple solution because00:17:13
it does not require any installation00:17:15
client on the user side you00:17:18
just publish certain00:17:20
applications in the browser00:17:22
Naturally, the same thing can be done00:17:24
using local checkpoint gateways00:17:27
the solution is called mobile access play00:17:30
today I’m talking about a new service00:17:33
which allows you to do this through00:17:34
clouds in a simpler way and not walls00:17:38
not bear all the labor costs and00:17:41
capital costs for deployment00:17:43
this service is completely at home like this00:17:47
everything works in the end it turns out that it is00:17:50
some cloud service through which00:17:53
access is granted let's call it00:17:56
conditionally00:17:57
an access broker is a service00:18:00
harmony connect00:18:01
this harmony connect has special00:18:04
connectors00:18:05
which are installed locally in your00:18:09
data center or installed in your00:18:11
virtual data centers, including in00:18:14
public cloud connectors can be00:18:16
buy them as much as you want00:18:19
the main task is to be close to00:18:21
those resources and with those applications00:18:23
which you plan to publish these00:18:26
connectors are supplied as00:18:28
docker container a00:18:30
you can actually deploy it anywhere00:18:32
anyway, it eats very little resources further00:18:36
this is the very connector knocking on our door00:18:39
clouds, that is, these are outgoing connections00:18:42
you don't need to publish anything via00:18:43
destination over on some of your perries00:18:46
meter gateways and beyond users00:18:49
they go to certain portals where00:18:52
he published specific applications00:18:56
Each user has their own applications00:18:58
that's why it's called jeera traces00:19:00
network access00:19:01
we don't trust users in general and00:19:06
in general we do not allow them in completely00:19:08
we publish some IP subnet00:19:11
specific authorized users00:19:13
specific policy applications00:19:17
in case some user00:19:19
leaves the company or you change his mind00:19:21
publish a specific application to this00:19:23
cancel publication block account00:19:26
or something else and accordingly00:19:28
access is lost or entirely in the portal00:19:31
or fortunately those applications that00:19:33
no longer relevant for this00:19:34
user integration itself occurs00:19:37
including through integration to connect00:19:40
these provider models these provider models00:19:42
could be either a cloud dente provider00:19:44
or for example microsoft and dfs which00:19:47
your infrastructure will be expanded further00:19:51
By policy you determine who gets what00:19:55
what kind of access does this look like?00:19:57
everything is as follows let's move on00:20:00
just in armani applications00:20:02
connect and I’ll show you how it all looks00:20:05
harmony connect itself consists of00:20:08
several components00:20:10
several services have a service00:20:13
corporate applications that is00:20:15
remote access to applications is that00:20:17
what am I telling you now00:20:19
space also has this specific one00:20:21
and space filtering of Internet traffic to00:20:24
I'll be back to him a little later today00:20:27
accordingly here we have00:20:30
certain users certain00:20:33
sites are configured, you can configure them00:20:36
certain date centers in which we have00:20:39
there are corresponding applications00:20:41
and then according to politics you control00:20:45
who gets access where00:20:47
for example here I have there to the remote00:20:50
desktop to a specific group00:20:52
Dima users are allowed access and00:20:55
then these users are obtained through00:20:58
certain links00:20:59
access to internal resources here you00:21:02
you see gray api addresses00:21:04
yes from the point of view of the infrastructure itself00:21:07
it turns out it all looks like this00:21:09
way that you have these very00:21:11
connector containers which00:21:14
provides access well and in this00:21:16
case, I still have a test one here00:21:17
website spins through which00:21:21
more precisely, I will try to organize this00:21:23
the most access and then the final one00:21:26
user00:21:28
he receives a link to00:21:31
he begins to walk through a similar portal00:21:34
this application and open them at the same time00:21:37
it turns out that this one was originally00:21:41
internal portal00:21:42
this is just my test portal00:21:44
The deployment of help for docker is not very good00:21:48
basically what application00:21:49
use for Dima and the same00:21:52
the portal, as you can see, is spinning here in00:21:54
localhost the user gets to it00:21:57
access via external link after00:21:59
full authorization with this way00:22:02
we control who goes where00:22:04
tea has access through this one without00:22:06
client portal00:22:08
naturally it works on any00:22:09
operating system from the point of view00:22:12
you can publish the applications themselves00:22:17
to the portal and USSR dp and databases00:22:21
there are quite a lot of different types here00:22:24
applies to other application types00:22:26
for example 1s00:22:27
or something else like that is possible00:22:29
publish by wrapping in00:22:31
tunnel in this case when trying00:22:33
kidnappings to users of this application00:22:36
published will go up ssh tunnel00:22:38
which will extend his access to00:22:41
the published application is approximately00:22:44
what does it look like and what will you end up with?00:22:46
you get the opportunity accordingly00:22:50
monitor who and where where you are00:22:53
connected including you have00:22:57
information about visiting various00:23:00
resources and information, for example you00:23:04
you can watch the video recording of the session00:23:08
remote desktop that is, like00:23:11
people connected to a specific worker00:23:13
table and that they did the same thing on it00:23:15
You can do it for example for ssh, that is00:23:19
see what teams he drove00:23:22
command line administrators00:23:24
some of your server or00:23:26
network device00:23:28
This is what this service looks like00:23:31
quite simple, I repeat once again00:23:34
in essence, the whole integration consists of00:23:37
why are you throwing these very00:23:39
provide connectors00:23:43
authentication through integration00:23:44
bend with the provider and sign00:23:47
policies who should connect where?00:23:50
where not and the result is that00:23:53
you throw and thus access00:23:56
users with full control00:23:59
him and so we have a question if00:24:03
adaptive access mechanisms for children00:24:07
zero red forex with here the question is what00:24:11
is an adaptive mechanism because00:24:14
what in this case it turns out you00:24:16
politics00:24:18
answer please indicate which policy00:24:22
user groups which applications00:24:24
available and if, for example, a person00:24:28
moved from this user group00:24:30
to another user group and that's it00:24:34
actually he has this access00:24:36
disappears automatically00:24:38
published application automatically00:24:40
disappears and the second question is how long00:24:42
DPS records are stored honestly00:24:46
seems to have no restrictions00:24:49
Well, let me clarify, if anything happens, I’ll contact you00:24:54
I will inform you about the specific storage time00:24:57
a little bit later00:24:58
as far as I know and the limitation on00:25:00
this topic is not here like us00:25:03
we understand that this is without a client00:25:07
she carries the connection diagram00:25:09
a significant advantage is that you don’t need00:25:12
install no agents on00:25:14
terminal stations but it also carries within itself00:25:17
and the minus associated with the fact that it’s the same00:25:21
recording remote sessions and for example input00:25:25
keyboard data and everything else on00:25:27
you can be controlled by ryan who00:25:30
sits on this very machine00:25:32
so we smoothly move on to the next one00:25:35
drives the forest which actually concerns00:25:40
compliance checks and upon connection00:25:44
in Rome so happy drunk and in this00:25:47
case without a client it’s no longer the same00:25:49
accordingly you install the client00:25:52
to end workstations00:25:54
as part of this client who used to00:25:57
called samples to gain now00:25:59
called harmony and point00:26:00
present and axis repair or drunk00:26:03
which will be terminated on your00:26:05
security gateways, physical or00:26:08
your virtual data centers here00:26:13
There are also cyber defense engines about00:26:15
which we will talk about here too00:26:18
present00:26:19
compliance who can check00:26:21
compliance of this machine with the requirements00:26:23
organizations00:26:24
does it work there for example?00:26:26
any specific antivirus00:26:28
is it updated for domain machines00:26:31
you can check according to the sauce00:26:33
have all windows updates arrived and00:26:35
other than that, not some other additional ones00:26:38
options00:26:39
if the stations do not match00:26:41
requirements of corporate policy in00:26:44
agent00:26:45
this one here and point firewall it00:26:48
starts applying a separate list00:26:50
rules of the restricted category and00:26:52
accordingly, here is the rule in this list00:26:55
it can be written that it is possible00:26:57
connect to agent management server00:26:59
you can connect in the sandbox you can00:27:01
connect to the board server00:27:03
antiviruses can connect to the court00:27:05
but you can't connect to the system00:27:07
electronic document management for workers00:27:10
tables and somewhere else because00:27:11
unsafe results in00:27:14
organize both partial or complete00:27:17
isolation of this machine until00:27:21
actually it will not be given in00:27:23
order of course we all understand that00:27:26
compliance in itself is not a guarantee00:27:30
yes because even the second factor is00:27:34
not a guarantee00:27:35
because the presence of antivirus is available00:27:38
installed updates00:27:40
the presence of a second factor and absolutely not00:27:42
guarantee that this machine does not00:27:44
there is some zero-day malware running00:27:46
which is not detected by standard00:27:50
means that this second factor in00:27:53
in the form of an SMS in the form of some application00:27:56
on mobile phone00:27:58
that is not intercepted by attackers on this00:28:00
topic we had a lot of investigations into00:28:03
including in this case there in my opinion00:28:06
Iranian cyber group was engaged00:28:08
cyber espionage in general00:28:12
intercept text messages and factor q on00:28:15
mobile phone is standard00:28:17
function of any banking Trojan I tell you00:28:19
already today I talked about what00:28:21
the quantity is quite significant00:28:23
increases and it turns out that we are coming00:28:27
to the next one with the case, namely to the protection00:28:31
end devices of users00:28:33
no matter whether it's homemade or00:28:35
corporate computers in the office or00:28:38
Houses00:28:39
and let's talk about it accordingly00:28:43
At the same time, the question arose about harmony connection00:28:46
is it an agent or not an agent am I in one of00:28:51
I’ll tell you about previous use cases00:28:53
harmony connect repair access is without00:28:57
client access i.e. publications00:28:59
carried out through the service and00:29:01
the user gets access to00:29:03
applications in the browser also have00:29:06
harmonica thread with an agent who00:29:08
provides application filtering and00:29:11
sites00:29:12
we will talk about this today in the last00:29:14
from Casey in other words the answer to the question and00:29:18
yes no yes depending on what purpose it is00:29:21
there is a part of the pocket connect can go00:29:23
without agent part of harmony connect can00:29:25
go with a dependency agent00:29:28
specific you space a life I will return from00:29:31
case associated with the protection of the endpoints themselves00:29:34
devices again we understand that00:29:36
we need full-fledged cyber protection and for00:29:41
the last year is probably even more00:29:44
was one of the main cases when we00:29:47
really provided cyber protection00:29:50
not only on corporate devices00:29:52
corporate laptops office machines but00:29:55
and and and issued for example mobile00:29:58
devices00:29:59
but this also applies to personal devices00:30:01
users naturally that in this00:30:04
in case the policy simply won't00:30:07
so tough and she will be targeted00:30:09
more on cyber protection than on control00:30:12
what the user does on this00:30:14
device tasks that are posed in this00:30:19
case it is natural to reduce the area00:30:22
attacks especially if they are corporate00:30:24
computers here you will be able to00:30:26
what can you say no to?00:30:28
control connected external00:30:31
flash drive devices for some 3g modems00:30:34
you can encrypt your hard drive00:30:37
for example if you are corporate00:30:39
the computer was stolen or lost so that00:30:42
data from it has not leaked anywhere and00:30:44
of course that's all there is to it00:30:46
compliance update00:30:49
and regular antivirus protection00:30:52
and then comes a whole range of tasks00:30:54
protection against zero-day threats00:30:57
prevention but00:30:58
new again phishing new phishing00:31:02
sites and new malware specifically00:31:05
prevention in such a way that00:31:07
the attack has not started in principle and is not necessary00:31:09
there was nothing to investigate the damage was equal00:31:11
zero00:31:12
Naturally, in reality there is a part00:31:16
and so which will still begin, that is00:31:18
an attacker will be able to penetrate00:31:20
machine and in the archives with a password for me through00:31:23
mail, for example, and via instant messengers via00:31:27
flash drives and so on or, in principle, you00:31:29
repaired access I'm drunk on the car00:31:32
to your home computer00:31:34
she has been infected for a long time before, accordingly00:31:37
here you need to provide protection in the mode00:31:39
real time, that is, on the very00:31:41
machine to analyze everything that happens00:31:43
and in time to detect the attack and begin00:31:47
the whole range of activities related to00:31:49
isolation and treatment of this machine with00:31:52
investigation into this incident00:31:54
this is what we provide to our00:31:57
decision00:31:58
the solutions themselves for desktop operating rooms00:32:00
Harma systems no point previously known00:32:04
as sandblast agent for mobile00:32:06
operating systems harmony mobile earlier00:32:09
known as san blas mobile these00:32:11
I've been solving myself well for many years now00:32:13
they have been recommended in many places00:32:15
successfully implemented and continues00:32:18
provide tucks simply today00:32:20
in reality they become even more00:32:22
relevant solution in itself00:32:26
is either a replacement00:32:29
or it can coexist with00:32:31
we have traditional antivirus00:32:33
customers who are forced to use00:32:35
only certified antiviruses and00:32:38
in this case you just install00:32:41
our solution as go are in a00:32:45
generation antivirus but it does not conflict00:32:48
with a traditional antivirus that lives00:32:50
on your typewriter situations when00:32:52
to the customer00:32:54
the regulator's requirements are irrelevant00:32:57
has the ability to unify00:32:59
and in this case indeed00:33:00
existing antiviruses00:33:02
we can completely replace because00:33:04
we also have a corresponding engine00:33:08
the protection technologies themselves are00:33:12
provide such echeloned00:33:15
approach the thing is that each00:33:17
protection technology has its advantages00:33:19
and it has its limitations00:33:21
that is, for example, Monty explored it00:33:24
blocks exploiter00:33:25
but if the attacker does not use00:33:27
exploit use something else for example00:33:29
higher script is anti-exploit nothing00:33:32
will help so it turns out that we have00:33:35
there are a number of technologies that protect us00:33:38
at different stages of the attack we have00:33:42
technology is aimed exclusively at00:33:44
prevention so that in principle a00:33:47
it never started and anti explored00:33:49
this is a plugin in the browser that I will show00:33:52
which protects against phishing and downloading00:33:54
malicious files00:33:55
here we can, in principle, include00:33:58
preventing delivery of malware00:34:00
emails and phishing emails at the level00:34:02
postal service what I told you00:34:05
a little earlier the antivirus may00:34:07
block something else on approach00:34:10
Then there are situations when at the end00:34:14
station someone landed there00:34:17
potentially malicious file here it is00:34:19
lies on the disks it hasn't been opened yet00:34:22
here again an antivirus can save the day00:34:24
there is a set of static technology00:34:27
static analysis inspections which00:34:30
checks files based on content structure00:34:33
and also checks their reputation groin and show00:34:37
and check your reputation using the so-called00:34:39
phase hisham that is, phase hashed something00:34:44
is more general than just a hash, that is00:34:47
it does not work on a specific file00:34:50
coincidences occur with the whole family00:34:52
files and thanks to these technologies like00:34:55
with the help of machine learning and with00:34:57
using the hash phase we succeed00:35:00
block polymorphic malware00:35:03
files including up to 60 percent new00:35:09
executable files they are palm00:35:11
accordingly we successfully blocked00:35:13
and the advantage of these technologies is that they00:35:15
work in some microseconds like this00:35:18
way the user simply does not have time00:35:20
even open the file, but what if00:35:25
these are all previous technologies somehow00:35:27
In this way the attackers managed to bypass00:35:29
again the file itself that fell on00:35:32
hard drive it can go to00:35:34
sandbox which can be local00:35:37
Is it cloud based and if the user did not have time00:35:40
open the file before sandboxing00:35:42
gave a verdict just for example he downloaded00:35:45
but didn’t rush to open it right away, that is00:35:48
chance again that it’s a sandbox00:35:49
block the threat before00:35:52
the attack will begin or otherwise00:35:54
what about sandboxes what about other engines that00:35:58
protect the nose, permissible by behavior on00:36:01
the end station is protected from reverse00:36:05
server connection channels00:36:06
they can continue to attack the attacker00:36:09
discover that the station is already partially00:36:11
compromised, the attack is already underway and00:36:14
begin the process of blocking this attack00:36:17
investigation and treatment that is00:36:20
such shiloni ravana I am protection she00:36:22
allows us to really not00:36:25
worry that some one is magical00:36:28
technology to the attacker00:36:29
will be able to get around and the further the more00:36:32
We are starting to use such technologies00:36:35
but at the same time, of course, we do not forget that00:36:38
the station should work normally but not00:36:40
there must be some problem with00:36:41
performance in terms of00:36:44
protection in prevention mode like me00:36:48
already said a huge amount today00:36:51
people receive phishing links00:36:53
phishing emails phishing links themselves00:36:56
can arrive via messenger via00:36:59
personal mail QR code and so on therefore00:37:02
it doesn’t really matter how00:37:04
the user receives this link is important00:37:07
protect him while visiting this00:37:09
site and it works like this:00:37:12
naturally it costs me on my typewriter00:37:16
to our protection agent harmony and point00:37:21
as you can see it works for me on mac00:37:25
on the Big Sur operating system we also00:37:28
we plan for this year00:37:30
provide support for new chips00:37:32
apple m1 accounts for significantly00:37:35
rewrite the code so that everything is there00:37:37
worked well00:37:38
accordingly I have this one00:37:40
the most protection agent in which I have00:37:42
all engines are presented but except this00:37:46
right in my browser here00:37:48
there is a plugin that00:37:51
protects me when visiting various00:37:53
sites and at the moment when I click00:37:57
let's say in an input field on some site00:38:00
yes at this moment I actually have00:38:04
the contents of this page are checked00:38:07
just url00:38:08
because diorella might just be00:38:10
still unknown, otherwise I simply wouldn’t00:38:12
was able to visit this resource and then you00:38:15
you see information that this site00:38:17
recognized as phishing to you according to the fields00:38:19
inputs are blocked00:38:21
there are a huge number of such sites00:38:24
accordingly they live for several hours00:38:27
the attacker almost lashes out00:38:29
generates a huge amount of fishing00:38:32
these are the ones that are posted on hacked00:38:35
sites and not only on fake sites and00:38:37
accordingly here it is necessary00:38:40
really rely on machine00:38:42
training that works00:38:43
directly inside the browser00:38:45
this is the technology that00:38:48
really allows us00:38:50
prevent attempts from outside00:38:53
attackers steal our accounts00:38:56
steal some of our personal data00:38:58
given credit cards and so on and this00:39:01
technology works equally well00:39:04
almost with the same Koreans that on00:39:07
desktop browser and in this case we00:39:10
support chrome internet explorer 1100:39:14
microsoft edge firefox and also in this00:39:18
quarterly support for mac os safari00:39:21
will also be ensured and accordingly00:39:25
the same thing can be applied inside00:39:28
mobile browser00:39:29
if we look at what else next00:39:33
I can do this plugin00:39:36
intercept file00:39:38
also when the user tries something00:39:40
download these files accordingly00:39:43
are intercepted with this very plugin00:39:46
they go to the sandbox00:39:48
in parallel, you can provide purified00:39:51
copy of this file here we see that00:39:53
prefix clint debt was added00:39:56
ov's file turned into pdf00:39:58
this whole thing can be customized as you wish00:40:00
you want it, that is, it is not necessary00:40:02
use these policies by default00:40:04
can be done for different users00:40:06
differently for example for specialists and and00:40:09
charm of the HR department, they don’t care what00:40:12
look at the form of a resume, let it be for them00:40:14
conversion to pdf for some00:40:17
accounting departments, for example, if they receive flights00:40:22
some Shakespearean plaques00:40:24
here you can leave the original format00:40:26
and accordingly just kick him out00:40:30
all active content so that00:40:33
macros did not work, no active links00:40:35
there were no other built-in objects00:40:38
was the result of this emasculated file00:40:41
is it really safe further if00:40:43
the user needs to download the original and00:40:46
here is this plugin and in case you00:40:50
Russian-language operating system00:40:52
also convert you are translated into native00:40:55
the language is sufficiently supported here too00:40:57
a large number of languages00:40:59
accordingly, further the user can00:41:01
download the original by requesting it here00:41:04
through this plugin and further after00:41:07
How to finish a sandbox00:41:10
will finish emulating this file in its00:41:12
environment and will issue00:41:15
negative verdict that that file00:41:17
then it will be safe for you as a user00:41:19
provided automatically if still00:41:22
this file is malicious then the user00:41:24
will see a message stating that there is no access00:41:27
no we won't give it00:41:29
it's not safe let me answer a couple00:41:33
questions yes to a question on the client's topic and00:41:40
on the topic00:41:41
geographically dispersed00:41:44
infrastructures need to be connected00:41:46
users to a single entry point and so on00:41:48
further, yes, let me discuss this topic a little later00:41:51
I will also highlight one of the last and00:41:56
narrow from the entrance of our webinar concerns00:41:58
including its non-fiction00:42:00
Internet access and unification00:42:03
remote access accordingly I to00:42:05
I'll come back to this issue, let's go for now00:42:07
let's leave the questions to slippy ou ind point00:42:12
in fact the local server has00:42:16
control harmony and plenty there is appy00:42:19
appy for management in the cloud he is now00:42:24
is under development in00:42:25
We'll be releasing it soon too00:42:28
what is it needed for now?00:42:30
for example, in order for some00:42:32
import indicator for example for00:42:34
so that your playbooks through the suar00:42:37
system launch an investigation00:42:40
incident at the moment these tasks00:42:43
can be done via interface00:42:45
management but in the future of course we00:42:49
we strive to ensure that there is still00:42:51
and drunk, well, I have the remaining questions for him00:42:55
I'll be back a little later, here we see that00:42:57
this file was discovered after all00:43:00
sandbox as malicious is00:43:03
opportunity to view the corresponding00:43:04
report from the sandbox here are the matrices00:43:07
metro is presented here00:43:08
appropriate techniques and tactics00:43:10
which use malware, including00:43:13
for example here is a sandbox bypass technique00:43:16
trying to figure out exactly where he is00:43:18
virtual environment do nothing but00:43:20
he doesn't succeed, we are successful like that00:43:23
we beat off techniques and many other things00:43:27
which00:43:28
checks are performed by this malicious00:43:31
environment ours are virtual too00:43:33
are analyzed and lead to00:43:35
positive verdict like this00:43:37
this is how it all looks from the point of view00:43:40
browser protection00:43:43
it is clear that the attacks do not begin00:43:46
only through the browser and therefore the following00:43:49
the topic is one's own protection from some00:43:54
other types of attacks we have happening on00:43:58
the terminal station itself analysis and00:44:01
static and dynamic00:44:03
what that what00:44:05
all the activities that are here00:44:06
happens there are about 80000:44:09
behavioral rules of analysis00:44:12
they are as written for specific00:44:13
families or techniques and tactics mythro so00:44:16
and for some more general situations in00:44:19
including, for example, an attempt to steal for00:44:22
cached accounts in the system00:44:24
using different scripts here00:44:26
you see a piece of wood discovered00:44:29
attacks detected by our our agent00:44:32
who built this tree for00:44:34
investigation into this incident and here in00:44:36
in general there are some missing00:44:38
malicious files even that can00:44:40
it would be sent to the sandbox because00:44:42
used here exclusively00:44:43
instructions for the operating system itself00:44:46
besides this, of course, there are attackers00:44:48
use exploiter and here I have00:44:51
Let me also give you an example of such an attack00:44:54
I'll try to demonstrate this attack00:44:57
explay there Ms. Blue who uses00:45:01
vulnerability in the RTP service of such services00:45:05
quite a lot of natural things in his words00:45:07
we focus on services that can00:45:10
attend custom00:45:13
workstations but as such00:45:15
exceptions also added protection for00:45:18
dns and rtp and here instead of a blue screen00:45:22
death and execution of malicious code on00:45:26
with this machine we see what we have00:45:28
the anti-exploit engine has worked00:45:32
our event point is turned off here00:45:34
traditional protection was left here00:45:36
only protection from threats is left00:45:38
zero day and accordingly we can00:45:40
view information about the investigation00:45:43
of this incident, here is the report from00:45:46
we are automatically built by our agent and to00:45:49
questions there00:45:50
automated and dior a little more00:45:52
I'll be back later but you're looking at this here00:45:55
the attack was stopped on approach00:45:57
that is, 0 damage from this is blocked00:46:02
attacks and the tree of this incident she is very00:46:05
I didn't have time to do anything when I was little00:46:06
the attacker thus in general00:46:09
investigate here nothing everything is fine00:46:11
you can continue to work completely00:46:15
All that's left is to see who tried00:46:17
attack us00:46:18
and maybe somehow cover up some00:46:22
external holes for such attacks00:46:24
happened less yes that is exactly00:46:27
attack prevention mechanism00:46:29
Naturally, it’s not always possible00:46:32
exactly to prevent but according to tests00:46:35
with us labs00:46:37
this is the last test advanced and00:46:39
protection which was carried out in the past00:46:42
year just before the company us00:46:44
with labs safely why and he00:46:47
shows that among all solutions00:46:50
there were about 18 protected points00:46:53
we have the best blocking level00:46:56
not all genders are threatened00:46:59
did not hesitate to publish the results00:47:02
of your stubble so if you are here00:47:03
if you don't see someone you can00:47:06
ask the relevant vendor for one00:47:08
he probably has a report, he just doesn’t00:47:10
in public access nevertheless with us00:47:12
best result but ninety nine s00:47:15
extra percent is not yet one hundred percent to00:47:18
so in reality we still need00:47:22
we still need to add straw00:47:25
about actively lobbying for all events00:47:29
occurring at the terminal station for00:47:30
in order to further investigate these00:47:32
incidents, that is, we need a full-fledged00:47:35
and dear00:47:36
on point detection in response or ex00:47:38
dear, if you connect some more00:47:40
additional attack vectors00:47:42
Accordingly, she writes down the solution00:47:44
everything that happens on the car is00:47:46
also concerns the launch of various processes with00:47:48
settings and file operations network00:47:51
activity working with the registry various00:47:54
system calls what does00:47:56
windows log user and00:47:58
Naturally there is integration with Am See00:48:01
anti small script interface which00:48:03
allows us to go into more detail00:48:06
analyze what is happening through00:48:07
powershell00:48:08
but besides this we are adding more and more00:48:10
and more different sensors system in00:48:14
including, for example, taking screenshots00:48:16
body yong use of reference files00:48:19
some periodic windows tasks and00:48:22
so on to make it better and more00:48:26
fully analyze current events00:48:29
on the final machine00:48:31
and discover some more complex ones00:48:33
attacks accordingly further when any00:48:36
from our engines or00:48:38
third-party antivirus or specialist00:48:41
juice department which, for example, using00:48:45
red hunting found something in that one00:48:47
the moment when we have an incident00:48:50
it's time for00:48:53
investigation of the incident and most00:48:56
these incidents will be investigated00:48:59
manually average response time in juice00:49:02
usually calculated in hours simply because00:49:05
that there are many incidents, how many people there are few hands00:49:08
little every incident is required00:49:10
detailed analysis and manual00:49:11
response so we have this whole00:49:13
we strive to correct history we strive00:49:16
namely to automate the response and00:49:20
one of the simplest ways to do this00:49:23
demonstrate this is actually a defense00:49:27
from the same ransomware00:49:28
ransomware under because basically00:49:32
if you react manually, then this is already00:49:34
a little late by the time you00:49:37
open the management console and dior00:49:39
start wandering around different branches and00:49:41
send some files from quarantine00:49:43
will kill some processes00:49:46
too much damage done00:49:48
Naturally, from the ransomware themselves00:49:51
We have been defending ourselves for many years now00:49:54
even probably since 2016 and if not yet00:49:58
We used to have unter technology00:50:00
the ensemble will make up our intent and we00:50:04
it has been significantly improved since then00:50:06
finalized naturally it all started00:50:08
just from the analysis of some massive00:50:10
file operations00:50:11
Next we added the honey pot of files00:50:14
which were scattered throughout the system00:50:16
random file names random00:50:19
folders and accordingly this allows00:50:22
very quickly literally after three00:50:24
Maybe00:50:25
encrypted files discover that00:50:28
there is an attack naturally00:50:30
intruders are now starting to look00:50:32
presence of honey pot of yes and try00:50:34
to bypass them here it turns out that we00:50:37
you need to connect learning machines already00:50:39
some more complex algorithms00:50:42
and of course as an additional00:50:45
technology we also check the change00:50:48
file types and not just an extension00:50:51
because in many situations00:50:53
attackers encrypt files on00:50:55
the extension leaves the original ones just you00:50:57
you open it and the file is not behind the boxes00:50:59
opens accordingly we now00:51:02
recalculate these file types00:51:04
we use magics00:51:06
and this is also one of the technologies, and besides00:51:09
This is what many malware are trying to change00:51:11
master boot record they are trying00:51:13
will boot to the operating system and00:51:15
Encrypt the entire hard drive block by block00:51:17
accordingly, this is an operation on the same00:51:19
is interrupted in addition to this advanced00:51:21
activities that we can do here00:51:23
watch and I suggest you see how00:51:27
this is what it looks like in real time00:51:30
actually here we have a car for the cat00:51:36
where do I run the management server00:51:40
malware here I have a machine00:51:44
which gained access to the infrastructure00:51:47
and in the end it was possible here accordingly00:51:51
drop a malicious file here00:51:53
Naturally, this malicious file can be00:51:55
it would be very easy to block and with00:51:58
using not only the sandbox but also00:52:00
static analysis00:52:02
so that in principle this attack would work00:52:04
we had to massively exclude00:52:07
write but nevertheless here it is its own00:52:11
serves the purpose and our task here is to show00:52:14
how will this attack be repelled?00:52:17
already at the stage when it is launched, that is00:52:20
we are talking about kill chain here00:52:23
the next stage when the attacker00:52:26
is already trying to harm the locals00:52:29
let's see how this attack will be here00:52:31
to start what time do I think it is00:52:33
takes up and in the meantime let me try00:52:36
answer a number of questions that are here00:52:38
remain until the question is still sail00:52:43
certain access to this I will return00:52:45
let's see the rest of the questions yeah00:52:51
There are still questions regarding protection other than this00:52:55
Bye not yet very often they ask me00:52:57
how do we restore those00:53:00
files that the ransomware has already00:53:03
encrypted there are different approaches00:53:06
someone does it with the help of shadow00:53:09
copies but the approach is not very good because00:53:12
actually shadow copies of what you are00:53:14
first next to the first thing malicious00:53:16
today they delete someone sends a file and00:53:20
into some clouds00:53:21
for example microsoft and now sends00:53:24
file and one drive yes and that's fine00:53:26
not all categories of customers00:53:29
someone is using some network shares00:53:31
we make proactive backups00:53:33
which are stored directly on the machine itself00:53:36
they are stored on each disk partition in00:53:40
hidden folder and access to this folder00:53:42
we also actually protect with the help00:53:44
our decision, now we see that it’s big00:53:48
Some of the files were recovered00:53:51
here is our agent00:53:54
he not only discovered the attack but also00:53:56
responded and then it automatically00:54:00
this incident was investigated and it is not the same00:54:06
let's open the previous report now00:54:09
correct investigated this incident and00:54:12
accordingly, most of the questions00:54:14
who ask themselves00:54:16
specialists juice incident response to them00:54:19
already the answers are shown in this report first00:54:22
we see who this attack was launched under00:54:25
this user in this case is00:54:27
administrator we see that this happened remotely by00:54:30
RTP further you can basically look at00:54:33
what station did you connect to this one?00:54:35
the machine is already stopped and00:54:40
value respectively run and00:54:43
and do something urgently to put out the fire already00:54:46
not required and cured and she is 10000:54:48
percent here you can see the corresponding00:54:50
information and further damage can be assessed00:54:54
and naturally the important question is whether00:54:57
it's easy to false positive00:54:59
answer by looking at this picture we00:55:01
we see some techniques00:55:03
what types of behavior have you demonstrated?00:55:06
this attack is a ransomware he tried00:55:09
bypass the security measures he contacted00:55:11
to external management servers in general this00:55:13
Ryan and so on he pay attention00:55:16
did not have time to reach the distribution phase00:55:18
like a worm on neighboring machines that already00:55:21
Fine00:55:22
and here again here is information about00:55:25
some events that happened00:55:28
there is overall this picture tells us about00:55:30
that it really wasn't false00:55:33
triggering00:55:34
Well, by the way, here’s the address from which00:55:36
connected to this machine in order to00:55:39
to launch this attack00:55:41
further we see that the treatment00:55:44
was truly completed00:55:46
in this case we have a process tree00:55:49
not very big and therefore we ourselves00:55:51
processes that need to be mined00:55:53
not so much00:55:54
that is, the tree itself looks like this00:55:57
just two processes most00:55:59
operations performed by this main00:56:01
This process also includes working with the registry00:56:04
here you can see the details00:56:07
keys changed and so on and00:56:10
naturally bulk file operations00:56:12
other things but they happen very often00:56:17
situations when it's really a tree00:56:19
attacks can be significant and in this00:56:22
In case, hope that the specialist will give you juice00:56:25
will completely build this entire tree and00:56:27
I use both tear and completely00:56:30
analyze all events well00:56:31
at least naively here is the complete one00:56:34
the list of all processes looks like this00:56:37
that is, this is so colossal00:56:39
tree of course no one00:56:42
assumes that your specialists will00:56:45
spend hours walking around00:56:47
analyze each of these processes00:56:49
what does this particular process do and00:56:51
everything else the same picture can be00:56:54
look in terms of, for example, matrix00:56:56
mythro here you can see what00:56:59
techniques and tactics used00:57:01
for example, an attacker tried00:57:03
delay the launch and by the way please note00:57:06
attention here shows the technique and00:57:09
Mithra tactics which00:57:11
we discovered during the development of this00:57:15
incident during this attack very soon00:57:20
as we expect00:57:22
Coming out any day this week00:57:24
also maitri vallee de tire test00:57:26
results of checking our harmony and00:57:30
play and how well it shows00:57:32
different techniques and tactics but we are apart00:57:35
Among other things, we also show this00:57:37
techniques that are not in the matrix00:57:39
metro original00:57:40
but we think it’s important, for example here00:57:44
delay in execution which is somehow00:57:47
It’s a miracle it didn’t hit, it doesn’t fit under any00:57:49
one of the standard techniques00:57:51
accordingly we also think so00:57:53
important that's why we are some00:57:55
additional techniques and tactics that00:57:58
We are also important for the investigation00:58:00
add to this matrix in order to00:58:02
could have understood better how it all happened00:58:04
happened and naturally all this tree00:58:07
can also be viewed as a development with00:58:12
point of view by time until like what00:58:15
was happening at this moment00:58:17
our agent reacted, we managed to00:58:20
correlate events before the attack and00:58:22
from correlates all subsequent phases00:58:25
there is a convenient legend here which00:58:27
shows the relationships between different00:58:29
processes what each icon means00:58:31
very often these relationships are indirect00:58:34
there is not just a child parent00:58:36
process and for example code injection from00:58:39
process in process or start delayed00:58:41
via the author via windows task and so on00:58:44
further yes such things will come back to mine00:58:47
previous report actually here we are00:58:51
again we see the mythro matrix00:58:54
appropriate techniques and tactics in00:58:56
in particular here, for example, it’s just malware00:58:58
tried to delete windows shadow copies00:59:01
so that it cannot be restored00:59:03
files it did not help him and deleting it00:59:07
we also naturally interrupted and besides00:59:10
this can be seen from the point of view00:59:13
network activity here we see that00:59:15
this particular malware was controlled by00:59:17
Mace control center is already here00:59:20
reputation in the Russian Federation00:59:24
there are some other communications on them00:59:27
you can also watch here00:59:29
situations when, for example, malware tries00:59:31
spread within the company and you00:59:34
you see the corresponding gray IP addresses00:59:36
and the corresponding ports and then you00:59:41
you can track00:59:43
horizontal movements are already inside00:59:45
company and besides this we can also00:59:48
see all information00:59:51
indicators of compromise that were00:59:53
collected during this attack, she can also00:59:56
be useful for investigating this00:59:58
incident as an example01:00:02
demonstrations of why01:00:05
active response automatically01:00:08
the reaction is good, I’ll give you a couple01:00:10
examples01:00:11
malware here is a recent ransomware01:00:16
which is called ragnar if you01:00:20
our solution is enabled in detect mode01:00:22
that is, clean and dear, look what01:00:24
happens but without automatic01:00:26
response followed by manual01:00:28
react yes we get what we have01:00:31
really big damage01:00:33
the attack is actually progressing somehow01:00:35
further if we include our solution in01:00:38
prevention mode in this case in01:00:41
basically managed to block any01:00:44
he is not even alone in the actions of the attackers01:00:46
I didn’t have time to encrypt the file simply because01:00:49
that we caught him using one of the techniques01:00:52
when he tried for example again01:00:55
actively remove shadow simply save01:00:58
stopped this attack entirely before the phase01:01:00
encryption just didn’t work out and such01:01:03
there are actually a lot of examples01:01:05
this is Loki pets another such example01:01:09
here we found him at that moment01:01:11
when he tried to steal usa01:01:13
we see cached accounts here01:01:16
significant damage has been caused01:01:18
many files01:01:19
21 thousand files total 33 thousand s01:01:23
unnecessary corporate data01:01:25
encrypted if we are all01:01:28
we prevent the greatest number of these01:01:30
here are attempts to encrypt significantly01:01:33
is reduced and as a result naturally01:01:35
we succeed01:01:37
restore these files to original01:01:39
condition if we look there is big01:01:44
some of these files it may be01:01:46
restored at least that time01:01:49
which we launched ourselves01:01:51
let's look at 58 files out of 6301:01:55
restored to original condition01:01:58
files that are not recovered are01:02:01
temporary categories, that is, this folder01:02:03
appdata and often just ours they are under01:02:07
and our agent generates them anyway01:02:09
automatically there is no one meaning them01:02:11
restore but all personal data and01:02:14
corporate data of your employees01:02:16
everything returned to its original state01:02:19
Here are the main advantages of this01:02:22
solutions if you really trust01:02:24
automated response solution01:02:27
and thanks to this approach we get01:02:29
really high marks solution as01:02:32
and dear she ranks second among01:02:36
leaders after one of the clouds01:02:38
competitors who are not in our region01:02:40
especially presented and show the best01:02:44
security for its price among everything01:02:47
just thanks to automation01:02:51
let's see if there are any questions01:02:53
about this theme01:02:56
question when restoring file format01:02:59
does it really matter01:03:02
the thing is that it is initially configured01:03:04
policy in which you indicate that you01:03:08
want protection01:03:09
protect such and such file types, that is01:03:12
for example all audio documents01:03:13
some media formats and files and01:03:16
simpler, yes, that is, you just indicate01:03:18
file types and their maximum size01:03:22
our agent is actively leading further01:03:25
creates these backup copies they01:03:28
naturally old copies are overwritten01:03:29
new and at some point they will start01:03:33
they are used if really01:03:35
an attack occurred you do not need to indicate01:03:37
no folders, no need to specify the locations of these01:03:40
files, it doesn’t matter, it’s quite simple01:03:42
determine file types and maximum01:03:45
size and it can be01:03:46
some types of files that we are from01:03:48
boxes are not for01:03:49
for example file 1C Accounting Lik or01:03:52
some volumes not autocad01:03:55
some sapper that exists01:03:58
only in your organization01:04:00
it's still the same, you can protect the second one01:04:03
very important point I forgot to mention01:04:05
this is that the forensic database itself and it01:04:08
distributed and it is stored on each01:04:10
own cars, that is, it turns out that even01:04:14
if the machine is cut off from the Internet it01:04:17
she is cut off from the control server01:04:19
can still investigate on his own01:04:22
incidents cure the station and because01:04:24
these actual events they fly away into01:04:28
some kind of external storage, or rather they01:04:32
fly to the control server which01:04:35
can be local or in the cloud and01:04:37
after that you can with these already01:04:39
incidents to work as an officer01:04:42
security01:04:43
but the main idea here is how01:04:46
once again abs forgive me I'm expanding the tap01:04:51
back yes actually the main idea01:04:57
is that the agent01:04:59
independent that's why we call it01:05:01
autonomous and dear because he doesn't01:05:04
need to send some data to01:05:06
at some point01:05:07
clouds or some management server01:05:10
before the investigation begins01:05:12
incident and then after01:05:14
the incident has already been repelled here by the servants01:05:17
you can work here already, you can work from01:05:20
hunting environment databases which for example01:05:24
will show the events that happened01:05:26
here you can search by giant01:05:28
number of types of indicators you can01:05:32
fall into some specific01:05:34
events and can also be used01:05:39
pre-configured filters which for example01:05:42
track either indicators from recent01:05:45
since for example we have him in this01:05:47
case or sunburst or some01:05:51
techniques and tactics that are used01:05:53
attackers including possible01:05:55
start from the very beginning01:05:57
the mythro matrix itself from01:06:00
10 and techniques and tactics they are described for01:06:03
specific time and you can further choose01:06:06
let's say these are their requests01:06:10
use to watch01:06:12
relevant events and fail01:06:14
they have all this functionality there01:06:17
management but in order for all this01:06:19
it worked naturally the agent himself he should01:06:22
to be intelligent in order not to01:06:25
only manually wander through these events01:06:27
and do something there with your hands01:06:29
send to quarantine shooting gallery mine01:06:31
some processes so that everything01:06:34
this happened in real time01:06:36
time here we just use01:06:39
automation and it relies precisely on01:06:41
the work of the agent himself and so we talked01:06:45
about protection in point of hope for01:06:47
I answered the basic questions, let's01:06:50
Let's move on to the next next tasks01:06:52
I mentioned it several times today01:06:54
mobile devices are important here01:06:56
understand that these devices are exactly the same01:07:00
vulnerable, and according to the side dish, both we and01:07:04
we do confirm this in01:07:07
our various studies we01:07:09
We constantly discover new malware and01:07:12
google play we constantly publish01:07:14
information on new vulnerabilities, including01:07:16
on WhatsApp for example or on Tik Tak we01:07:19
we show that both are indeed01:07:21
operating system android and ios01:07:23
we have the same sound but a little different01:07:25
attacks for android are more typical01:07:28
malicious apps for ios more01:07:30
characteristic vulnerability and fishing though01:07:33
for android fishing exactly the same01:07:35
relevant until01:07:36
but nevertheless we stand in solidarity with discard01:07:38
nir that mobile control01:07:41
devices during the day01:07:44
this is not the same as cyber defense01:07:47
cyber defense it focuses around01:07:50
reputation and behavior analysis of specific01:07:53
mobile applications around verification01:07:55
configuration but not in terms of01:07:57
compliance from the point of view of cyber protection and01:08:00
around network traffic inspection, including01:08:03
This includes protection against phishing from01:08:05
bots from malicious sites from another01:08:10
hand indien01:08:11
he focuses on01:08:13
management of access control devices01:08:17
various data on this device to01:08:19
various corporate services in essence01:08:23
such a compatible mobile dlp and01:08:26
It's natural to choose between these01:08:29
solutions do not need to be used and01:08:31
both01:08:32
and practice shows that it is quite01:08:34
you can successfully use01:08:36
only on corporate devices but also01:08:38
user's available devices and01:08:41
here we have naturally01:08:45
confirmation if we look at01:08:48
mythro matrix for mobile systems01:08:51
mdm closes very little equipment here01:08:54
tactician and accordingly all the same01:08:57
full protection is required01:08:59
full protection looks like this01:09:03
protection agent harmony mobile01:09:06
or used to call blast mobile itself01:09:08
which is installed on every01:09:10
mobile devices and it checks01:09:12
status various settings what01:09:15
which applications are installed?01:09:18
there are no official sources if01:09:21
this new application is not official01:09:23
sources there we pull them up for01:09:25
inspections in our cloud and naturally he01:09:30
also checks network activity01:09:33
I will talk about this today one of01:09:36
main use cases and from01:09:38
cases in remote access situations01:09:41
if you are on a mobile device01:09:44
access to corporate01:09:46
attachment at least to email in01:09:49
in this case we have scripts01:09:51
container capsule workspace used01:09:53
for this, in principle it could be anyone01:09:55
from em d em off that are present on01:09:57
market at the moment when we infect01:10:00
this device is here here is a test virus01:10:02
we supplied which was discovered by our01:10:05
solution if the user does not delete it01:10:08
then the mode automatically turns on01:10:11
conditional access01:10:13
that is, the user is limited01:10:15
access to corporate data01:10:16
automatically or by means of our01:10:19
capsules or by means of politics here01:10:22
these same MDM solutions, including us01:10:25
we can block network access01:10:27
on the mobile device itself01:10:28
filter traffic outgoing from it01:10:31
occurs due to inspection of this01:10:34
traffic directly on the device itself we01:10:36
we turn off the traffic of all applications01:10:38
including mobile browser through our01:10:41
applications on the same device01:10:43
so it turns out that we01:10:45
maintain privacy you like01:10:48
administrator can't track who01:10:50
visit sites with strawberries or something01:10:52
other unwanted website for you01:10:54
as long as these sites explicitly01:10:57
you won't block01:10:59
if you block them everything you can with01:11:01
monitor all threats accordingly01:11:03
which was prevented from the point01:11:06
What does it all look like from management's perspective?01:11:09
let me be here01:11:11
jumped oh here I jumped here01:11:16
different pace naturally infinite portal01:11:19
supports thresh and mansi for everyone01:11:22
customers or partners who01:11:24
provide mass sleep services01:11:26
have several different talents and01:11:28
accordingly here we can look01:11:30
how directly configured01:11:32
the harmony mobile policy is being implemented with01:11:35
from the point of view of politics itself we are here01:11:39
we apply certain things we check01:11:42
specific state settings01:11:44
operating system and if it01:11:47
condition does not meet requirements01:11:50
we remove the high risk factor to increase01:11:54
risk for this device in terms of01:11:57
applications any malicious application01:11:59
automatically leads to high risk01:12:02
a number of other applications by category01:12:04
this risk can be changed from the point of view01:12:08
network protection is possible01:12:10
it is possible to decrypt SSR01:12:12
block fishing and everything else in01:12:15
including zero-day fishing01:12:19
ability to apply and lie filtering01:12:21
and add to white black lists01:12:24
some categories of sites and applications01:12:28
block malicious downloads01:12:31
some suspicious files and01:12:33
profiles and it is also possible01:12:35
protect dns that is, we double-check01:12:39
all requests Dr.01:12:40
s and accordingly we block again01:12:43
access to some control server01:12:46
there are intruders again01:12:48
the ability to check for example what01:12:50
the user connected to some kind of wi01:12:52
wi points that pretend to be your wi01:12:55
fi point was actually not such01:12:57
is accordingly we can too01:13:00
see this activity as a result01:13:03
conditional access policy is applied01:13:05
and you as an information officer01:13:07
security you begin to see like this01:13:10
here are the logs in which you can see various01:13:13
actions that were performed in01:13:16
particularly from the point of view01:13:18
let's say applications we can see01:13:22
when the application was installed when01:13:24
deleted including whether it was deleted01:13:26
really harmful or01:13:27
unwanted applications yes from the point01:13:30
view of network activity we can01:13:32
see for example https websites01:13:36
dedicated but precisely blocked and01:13:38
or permitted01:13:40
and according to the policy with confirmation from01:13:43
user everything else is what01:13:46
visited by users is not displayed01:13:49
in the logs, that is, so you don't01:13:51
you can monitor your users and01:13:53
thanks to such privacy your01:13:57
users don't mind that you01:13:58
keep their devices safe01:14:02
further you can analyze the behavior01:14:05
various applications that they themselves01:14:09
imagine let's see a few01:14:11
really malicious applications like01:14:13
it looks like it's here01:14:15
district for which again01:14:18
risk factor is shown are shown01:14:21
description and again for different profiles01:14:24
which apply to different groups01:14:26
devices is possible somewhere01:14:29
force something to be allowed somewhere01:14:30
forcibly prohibit that is, it is possible01:14:33
it really works here01:14:35
categories and for specific01:14:36
applications and here there are tactical techniques01:14:39
mythro which demonstrate this01:14:42
specific mobile application during01:14:44
his analysis here we can look at them01:14:47
this technique is specifically for mobile games01:14:50
they differ significantly in technology01:14:52
tactics typical for tabletop01:14:54
operating systems and besides that you01:14:58
you can also upload your own01:15:00
applications that you have developed for01:15:03
analysis in this service and for this01:15:07
there is also this and there is a possibility with your hands01:15:10
download that is you can build this01:15:12
service your d all cops01:15:14
for mobile development in order to01:15:17
make sure that what you developed is not01:15:20
contains, for example, vulnerable or01:15:21
some malicious components and01:15:23
libraries before you develop it01:15:26
to your users' device01:15:28
so it turns out that we01:15:31
scripts together with the container or with01:15:34
somehow em dm am using harmony01:15:37
mobile we close the really big one01:15:39
some of mythro's techniques and tactics for01:15:43
for the attack to be unsuccessful is enough01:15:45
block her somewhere, anywhere until01:15:48
accordingly we really01:15:49
full protection and solution provided01:15:52
she shows herself well she's pretty01:15:55
These sell well here in01:15:58
Europe abroad and in terms of01:16:01
technical01:16:02
we do block most of it01:16:04
threats almost one hundred percent compared to01:16:07
closest competitors this is one of01:16:10
independent one of the independent tests and01:16:14
finally the last case for today01:16:18
concerns Internet access control01:16:21
users let me wake up one of mine here01:16:25
virtual machines with which I will01:16:28
show this very access so01:16:32
look we discussed in one of01:16:35
previous cases remote access to01:16:39
resources in your data center, that is01:16:41
here it can be organized without01:16:44
client image via either local01:16:48
checkpoint gateway or service pocket01:16:50
connect and it can be organized01:16:52
client method when installed01:16:54
harmony and point which includes01:16:57
just like that with the saint and he terminate on01:17:00
some gateways of your data centers this01:17:03
story remote access history01:17:06
which we will look at now concerns01:17:08
namely Internet access control, that is01:17:11
if your employees run away01:17:14
houses and all sorts of remote locations and they01:17:19
took corporate laptops with us01:17:21
for example corporate mobiles01:17:23
devices and what you want for them01:17:25
provide exactly the same inspection01:17:27
Internet traffic on the perimeter as if01:17:29
If only they were sitting in your office01:17:32
saying two two alternatives two ways01:17:35
first traditional01:17:37
this is to turn off all the traffic of these01:17:40
users through your gateway farm01:17:43
security in the data center, yes, that is, not01:17:46
use gossip on Lenka everything01:17:48
go to the data center and there01:17:50
apply the same policy01:17:52
There are pros and cons to this solution01:17:55
among the minuses is that this farm is for you01:17:59
must be supported it must be01:18:01
quite productive cash01:18:03
drunk support and trophy01:18:04
take notes and this is not always01:18:06
economically feasible as01:18:09
alternatives you can do this01:18:13
inspection not at your gateways but somehow01:18:15
otherwise here's how else there are two here01:18:18
way01:18:21
method number 1 is to filter the web01:18:25
traffic directly01:18:27
device, that is, what I already have today01:18:30
showed in terms of mobile devices we01:18:32
here we see what we are doing now ural01:18:34
filtering directly in the mobile browser yes01:18:37
and if we visit some01:18:40
safe sites01:18:41
then this is also blocked at the level01:18:44
desktop operating system this01:18:46
the inspection is carried out by our own01:18:50
browser plugin that is available for01:18:52
browsers shown here if it is not01:18:56
browser then you can use for example01:18:58
application control block part01:19:01
some applications but this is quite01:19:03
such a labor-intensive task, then here it is rather01:19:06
it's about filtering01:19:08
traffic in the browser01:19:10
if you want to do filtering like this01:19:13
you are used to that is the gateway to you in a way01:19:17
yes, that is, use a full01:19:19
applications control and and roll01:19:22
filtering at the same level01:19:24
politicians are like at a feast of meter firewalls01:19:26
This is where a new concept comes to the rescue01:19:29
suck the sequel access service edge which01:19:33
in general it looks very simple you01:19:36
turn off your users' traffic01:19:38
not to the gateway farm in your data center01:19:42
and somewhere in the cloud there is a deployed farm01:19:45
accordingly we have a checkpoint01:19:48
many locations through which traffic01:19:51
those users will be routed01:19:53
there are two ways to inspect01:19:55
connections in your pocket connection is the second01:19:59
part is obtained from this harmony service01:20:01
connect internet access01:20:03
here is the opportunity to provide the site01:20:05
communication site as shown in this01:20:07
picture01:20:08
that is, for example, you have a lot of mini01:20:11
offices where they are not very expensive01:20:13
some kind of smart boxes01:20:15
router and some simple firewall checks01:20:17
or01:20:18
from the sofa device for example in the IMF case01:20:21
cloud or something similar and you don’t have it either01:20:26
opportunities everywhere at all these points01:20:29
expand full on Ginny solved01:20:31
firewall for example and checkpoint to use01:20:33
full-fledged policy locally in this01:20:36
case you from each such point01:20:38
install01:20:39
and [ __ ] tunnel 2 and [ __ ] tunnel up to 201:20:44
essentially virtual checkpoint gateways01:20:47
deployed in some01:20:49
data center01:20:50
these date centers can be chosen01:20:53
locations where you will turn01:20:55
this traffic is still there01:20:57
exactly the same policy applies01:20:59
which you would tune on your perries01:21:01
meter gateways at the user level01:21:03
ural application user groups01:21:05
filtering etc. blocking threats01:21:08
and plays anti bot antivirus and sandbox01:21:12
alternative option when it comes to01:21:15
about a home computer it looks like this i.e.01:21:18
here I have a computer on which I have01:21:21
there is already one more agent, that is, I have01:21:25
stands here01:21:26
harmony and point here it is01:21:29
and harmony in point I have here01:21:32
is engaged in cyber protection of this device01:21:34
it filters web traffic almost nothing01:21:37
filters and I actually have01:21:40
a separate agent called01:21:43
harmony connect I already have it01:21:46
are stopping my users' traffic from01:21:50
this particular machine through some01:21:52
cloud gateway yes and if we are here01:21:56
Let's see where he takes me01:22:00
wraps in this case then I was wrong01:22:10
a little site to them they are very similar to01:22:13
we see that in this case it is01:22:15
Great Britain01:22:16
one of the advantages of this out of the gate01:22:19
naturally is the fact that01:22:21
some resources are blocked in01:22:24
in our country they are beginning to be available01:22:27
Almost01:22:29
here something went wrong for me though01:22:33
the idea should be so possible something I01:22:37
didn't tighten it up01:22:38
and besides, naturally I have to01:22:43
there should be malware blocking01:22:50
and blocking some unwanted01:22:52
resources let's see how much it is01:22:55
will work01:23:08
on blocked let's try again01:23:11
since no, with this everything needs a little01:23:22
tighten up the policy but in general in principle01:23:24
this technology allows you also01:23:27
and protect yourself from a situation when some01:23:29
resources they are not available on the table01:23:33
connections, for example, with the fact that they were activated01:23:36
some kind of blockage with the principle you01:23:39
block unwanted resources and01:23:41
block01:23:43
access is allowed to some categories01:23:46
sites exactly the same way you would do it01:23:51
at the security gateway level and01:23:54
accordingly in this case you01:23:57
a policy is applied that looks like01:23:59
just like it looks on your gateway01:24:02
security let's go back to now01:24:04
I'll show you my tennant and this case01:24:13
back in the pocket connect here we are01:24:16
we are already talking about these two01:24:18
component is a site site and work with01:24:22
client case website client website01:24:25
no need to put it because you have a bunch01:24:27
it turns out your device is on some01:24:31
object to contact and [ __ ] there with here01:24:34
with this cloud service in case01:24:36
these are remote home computers01:24:38
some or corporate laptops01:24:40
there already communication occurs through01:24:43
this special agent harmonica is not01:24:46
and as a result you apply this very01:24:48
politics how it looks on yours01:24:52
I'll send you out of the perimeter for safety, that is01:24:54
block a specific application or01:24:55
site categories can also be01:24:58
control downloading and not sending01:25:00
like some type of content that is01:25:03
this mini del pi is here too01:25:04
be present and of course all this01:25:07
the story is being realized, including01:25:09
inspection of the USSR can apply the full01:25:13
inspection in this case our agent he01:25:16
will spill certificates into trusted ones01:25:18
protected machine and you can01:25:21
fully filter everything01:25:23
resources and intercept all malicious01:25:26
files and block them as usual but also01:25:29
then you actually get access to01:25:32
lagam and01:25:35
different calculations in this system here01:25:39
I have no logs yet my this agent is he01:25:43
connected to another awning accordingly01:25:45
you can watch it too, so let's do it01:25:48
Let's see what questions there are on this topic01:25:51
let me return to the question on the topic01:25:57
actually distributed access01:25:59
it turns out we have the following space01:26:02
news is when you are without a client01:26:05
how you give access to corporate01:26:07
applications in your data center01:26:09
physical or virtual or public01:26:12
in the clouds this thing is there when we01:26:15
published on the Internet portal here01:26:17
such a portal these applications01:26:19
second story you redirect01:26:21
traffic of your office menus via cloud01:26:24
gateway to inspect how01:26:26
on the local gateway but don't buy it01:26:29
you buy this business as a service, that is01:26:31
internet access filtering as a service and01:26:34
there really are 2 and [ __ ] tunnels up01:26:37
two gateways for fault tolerance in01:26:40
one of the data centers and third01:26:42
history this installation of agents on01:26:44
final machines that will perform01:26:47
more precisely they will do this very filtration01:26:50
divert traffic to the same01:26:53
farm for what happened there01:26:56
filtration here is basically the sketch and which I01:26:59
I really wanted to show them today01:27:02
a lot and this is an incomplete list01:27:03
As you can see, the harmony solution is more precisely a whole01:27:07
the harmony family of solutions closes01:27:09
a large number of situations and if you have01:27:12
Are there any specific dice of yours?01:27:14
case and we are happy to be with you01:27:16
let's talk and select the architecture01:27:18
which one is right for you besides this01:27:22
Naturally, we must remember that all these01:27:24
solutions can be purchased as01:27:26
separately by subscription by quantity01:27:29
protected devices or by number01:27:31
protected users or have a common01:27:34
armani total subscriptions01:27:35
which is beneficial if you need both01:27:38
at least 3 of the solutions that I01:27:41
showed it today and I would like the last one01:27:45
to dot the i's a little01:27:47
tell us what happened to us01:27:51
rebranding sandblast agents harmony and01:27:53
point and some new ones have appeared01:27:55
subscription there are a lot of questions01:27:57
around how it's all now01:28:00
licensed in short it turns out01:28:03
we have an agent that includes01:28:05
traditional protection and and dear but not01:28:09
includes sandbox01:28:10
it's called harmony in point basic this01:28:13
the simplest license included01:28:15
cloud management and cloud more precisely and01:28:20
there is no sandbox here in this case01:28:22
there are 201:28:25
the second mechanism is harmony and point01:28:29
advance it already includes sandbox01:28:32
and this is the most typical subscription that01:28:35
we have been selling for many years01:28:38
years ago it was called impudence than here01:28:40
vans is now harmony in point advance01:28:42
it includes a full-fledged cyber01:28:44
protection cloud management cloud01:28:47
the sandbox is naturally local01:28:50
management and local sandbox is01:28:52
just options that can be purchased and01:28:55
we will also help you with siding01:28:59
There's a new option just a little bit01:29:03
revised with hard encryption01:29:05
disk01:29:06
but without a plugin in the browser and finally there is01:29:10
What about a regular custom client of harmony?01:29:14
in plain complete which earlier01:29:16
was called the authorities kent complete which01:29:18
includes all technologies at the level01:29:21
points, that is, there are all sorts of different ones01:29:24
bangla01:29:25
again, the solution allows you to combine01:29:28
one management server or local01:29:30
that the cloud can combine different options01:29:34
subscriptions that is, you can for example01:29:36
some stations where you just need01:29:39
protect yourself from phishing ransomware and01:29:41
some kind of exit window there is a sandbox01:29:44
it's expensive for them to buy you buy01:29:46
basic option for other machines in the office01:29:50
you buy two important machines in the office and01:29:53
for example working people01:29:56
remotely you buy a complete package because01:29:58
it also includes hard encryption01:30:00
disk that is a guarantee against theft01:30:02
data if dice if this laptop01:30:04
for example lost or stolen, even you01:30:07
combine different options01:30:09
subscriptions and you get quality01:30:12
solution that solves your problems by01:30:14
quite reasonable price and let me remind you that there is01:30:18
harmony total option which includes01:30:20
additionally as rasasi including protection01:30:23
mail and including mobile protection01:30:26
devices for the same user well01:30:29
That's it for all my colleagues today01:30:32
thank you very much for your time01:30:35
I really galloped today01:30:37
across Europe for a fairly large01:30:39
number of solutions01:30:41
edius of cases that we have01:30:44
in our family harmony naturally comes from01:30:47
these cases may raise more questions and01:30:50
some specific technologies01:30:53
the attacker's asset may be greater01:30:55
I will be glad to see you separately with each01:30:58
chat and delve into some of the01:31:00
these directions thank you for your attention01:31:03
We will send you a video recording of the presentation01:31:06
and we will also send examples of harmony reports01:31:09
and point so you can watch them01:31:11
wander through them with your own eyes and01:31:13
study thank you good bye01:31:16
dayDescription:
2020 год трансформировал многие бизнес-процессы. Сотрудники привыкли работать откуда угодно, с любых устройств (корпоративных и личных) и получать доступ к корпоративным приложениям в ЦОД и облаке. Злоумышленники продолжают пользоваться ситуацией. Растет количество фишинга, кражи учеток и данных, распространение вредоносов, включая шпионское и вымогательское ПО. Опросы в 2021 году показывают, что большинство организаций продолжат совмещать работу в офисе и дома даже после пандемии Covid-19. «Удаленка» с нами всерьез и надолго, а значит, нужно обеспечивать комплексную киберзащиту в изменившихся условиях, нужно отходить от «времянок» в сторону полноценных решений и сервисов. В ходе вебинара мы рассмотрим следующие практические кейсы и соответствующие решения семейства Harmony: • Защищенный доступ в Интернет для филиалов и удаленных пользователей как сервис – Harmony Connect (Internet Access) • Удаленный доступ к корпоративным приложениям для сотрудников и партнеров как сервис – Harmony Connect (Remote Access) • Комплексная защита корпоративных и личных рабочих станций – Harmony Endpoint • Комплексная защита корпоративных и личных мобильных устройств • Harmony Mobile • Защита эл. почты (включая локальную и Office 365) из облака – Harmony Email & Office Спикер - Алексей Белоглазов 00:00 Введение 05:46 Кейс 1 Защита облачной/локальной эл. почты как сервис Harmony Email & Office 15:59 Кейс 2 Простой удаленный доступ в браузере (без клиента) Harmony Connect Remote Access 25:33 Кейс 3 Безопасный удаленный доступ с VPN и Compliance Harmony Endpoint 28:26 Кейс 4 Комплексная защита устройств пользователей Harmony Endpoint 1:06:49 Harmony Mobile 1:16:13 Кейс 5 Безопасный доступ в интернет из дома и филиалов Harmony Connect Internet Access 1:27:21 Лицензирование
Preparing download options
* — If the video is playing in a new tab, go to it, then right-click on the video and select "Save video as..."
** — Link intended for online playback in specialized players
Questions about downloading video
How can I download "Check Point Harmony: новое семейство решений для защиты устройств сотрудников" video?
http://unidownloader.com/ website is the best way to download a video or a separate audio track if you want to do without installing programs and extensions.
The UDL Helper extension is a convenient button that is seamlessly integrated into YouTube, Instagram and OK.ru sites for fast content download.
UDL Client program (for Windows) is the most powerful solution that supports more than 900 websites, social networks and video hosting sites, as well as any video quality that is available in the source.
UDL Lite is a really convenient way to access a website from your mobile device. With its help, you can easily download videos directly to your smartphone.
Which format of "Check Point Harmony: новое семейство решений для защиты устройств сотрудников" video should I choose?
The best quality formats are FullHD (1080p), 2K (1440p), 4K (2160p) and 8K (4320p). The higher the resolution of your screen, the higher the video quality should be. However, there are other factors to consider: download speed, amount of free space, and device performance during playback.
Why does my computer freeze when loading a "Check Point Harmony: новое семейство решений для защиты устройств сотрудников" video?
The browser/computer should not freeze completely! If this happens, please report it with a link to the video. Sometimes videos cannot be downloaded directly in a suitable format, so we have added the ability to convert the file to the desired format. In some cases, this process may actively use computer resources.
How can I download "Check Point Harmony: новое семейство решений для защиты устройств сотрудников" video to my phone?
You can download a video to your smartphone using the website or the PWA application UDL Lite. It is also possible to send a download link via QR code using the UDL Helper extension.
How can I download an audio track (music) to MP3 "Check Point Harmony: новое семейство решений для защиты устройств сотрудников"?
The most convenient way is to use the UDL Client program, which supports converting video to MP3 format. In some cases, MP3 can also be downloaded through the UDL Helper extension.
How can I save a frame from a video "Check Point Harmony: новое семейство решений для защиты устройств сотрудников"?
This feature is available in the UDL Helper extension. Make sure that "Show the video snapshot button" is checked in the settings. A camera icon should appear in the lower right corner of the player to the left of the "Settings" icon. When you click on it, the current frame from the video will be saved to your computer in JPEG format.
What's the price of all this stuff?
It costs nothing. Our services are absolutely free for all users. There are no PRO subscriptions, no restrictions on the number or maximum length of downloaded videos.