虛擬化防毒-sve超輕量級代理sophos for virtual environments-customer deck

Sophos虛擬化安全解決方案NicolLiu｜柳慶亮SalesEngineer April

2017會議議程關(guān)于SophosSophosforVirtualEnvironments同步安全介紹勒索惡意程序的立體化防護(hù)方案關(guān)于SOPHOS1985成立牛津,英國$534.9M2015年?duì)I收2,700員工(大約)200,000+客戶100M+最終使用者HQ阿賓頓,英國90+%業(yè)界最佳續(xù)約率20,000+渠道合作伙伴OEM合作伙伴：主要研發(fā)中心辦公室全球主要的辦公室SanFranciscoBayAreaVancouver

CanadaBostonMAAbingdonUKBudapestHungarySingaporeSydneyAustraliaManilaPhilippinesTokyoJapanLinzAustriaKarlsruheGermanyWiesbadenGermanyDortmundGermany59542066186351581134899761101323263OthersTheWorld2,752TotalSophosEmployeesParisFrance51AhmedabadIndia

653DubaiUAE

11TaiwanTaipei8BeijingChina20完善的保護(hù):用戶

與網(wǎng)絡(luò)SophosCentralEnduserNetworkNext-GenFirewall/UTMWebSecurityEmailSecurityWirelessSecuritySafeGuardEncryptionMobile

ControlNext-GenEndpointProtectionServerSecurity端點(diǎn)安全(PC/Mac)下一代端點(diǎn)安全預(yù)防、偵查、調(diào)查和補(bǔ)救移動終端安全智能手機(jī)和平板電腦就像另一種終端服務(wù)器安全

為服務(wù)器環(huán)境（物理的或虛擬的）而優(yōu)化的保護(hù)︰快速、有效、可控?cái)?shù)據(jù)保護(hù)簡單易用的加密是防止數(shù)據(jù)丟失防御的一個非常有效的最后防線下一代防火墻

優(yōu)異的企業(yè)防火墻性能、安全性和控制.Web安全先進(jìn)的保護(hù)、監(jiān)控和高效、可視化、實(shí)惠且簡單。.郵件安全電子郵件威脅和網(wǎng)絡(luò)釣魚攻擊不會有任何機(jī)會。.無線安全簡單、安全的Wi-Fi連接。.

同步安全和戰(zhàn)略SophosCentralCloudIntelligenceSophosLabsAnalytics|AnalyzedataacrossallofSophos’productstocreatesimple,actionableinsightsandautomaticresolutions|24x7x365,multi-continentoperation|URLDatabase|MalwareIdentities|FileLook-up|Genotypes|Reputation|BehaviouralRules|APTRulesApps|Anti-Spam|DataControl|SophosID|Patches|Vulnerabilities|Sandboxing|APIEverywhereAdminSelfServicePartner|ManageAllSophosProducts|UserCustomizableAlerts|ManagementofCustomerInstallationsEndpoint/Next-GenEndpointMobileServerEncryptionUTM/Next-GenFirewallWirelessEmailWebInCloudOnPrem6SophosLabs–通過云端來保護(hù)您時時防護(hù)變的更加簡單SophosLabs

主動保護(hù)惡意病毒網(wǎng)站分類主動防護(hù)規(guī)測名譽(yù)數(shù)據(jù)惡意

網(wǎng)址垃圾郵件敏感數(shù)據(jù)類形應(yīng)用程序分類設(shè)備控制移動設(shè)備應(yīng)用過濾匿名代理應(yīng)用樸丁網(wǎng)絡(luò)服務(wù)設(shè)備WebEmailNext

GenFWWebAppFWWifiSmartphone/

TabletWorkstation/

LaptopData相關(guān)情報(bào)名譽(yù)數(shù)據(jù)內(nèi)容分類FileWebEmail業(yè)界唯一一家在端點(diǎn)防護(hù)、UTM、移動數(shù)據(jù)保護(hù)都在領(lǐng)導(dǎo)象限的廠商GartnerMagicQuadrant

防火墻GartnerMagicQuadrant

移動數(shù)據(jù)保護(hù)MagicQuadrantforMobileDataProtection,JohnGirard,8October2015MAGICQUADRANT端點(diǎn)防護(hù)MagicQuadrantforEndpointProtectionPlatforms,EricOuellet,IanMcShane,AvivahLitan30January,2017防火墻、端點(diǎn)、移動數(shù)據(jù)保護(hù)業(yè)界認(rèn)可的領(lǐng)導(dǎo)品牌PRESENTin1ofthese

GartnerMagicQuadrantsLEADERin1oftheseGartnerMagicQuadrantsLEADERin2oftheseGartnerMagicQuadrantsLEADERin

all3oftheseGartnerMagicQuadrantsNotes:1.Figuresrefertofiscalyear2015.Fiscalyear-endMarch312.InFebruary2015,FrontRangeandLumensionannouncedtheywouldmergeandformHEATSoftware,backedbyClearlakeCapitalGroupEndpoint,UTMandEncryptionRepresent[73]%ofSophosBillings(1)(2)端點(diǎn)和網(wǎng)絡(luò)的平衡發(fā)展端點(diǎn)網(wǎng)絡(luò)其他品牌比較MidMarketCentricNetworkLeaderEndpointLeaderSyncSecurityChannelFirst關(guān)注中型市場網(wǎng)絡(luò)領(lǐng)導(dǎo)者端點(diǎn)領(lǐng)導(dǎo)者同步安全渠道優(yōu)先MidMarketCentricNetworkLeaderEndpointLeaderSyncSecurityChannelFirstMidMarketCentricNetworkLeaderEndpointLeaderSyncSecurityChannelFirstMidMarketCentricNetworkLeaderEndpointLeaderSyncSecurityChannelFirstMidMarketCentricNetworkLeaderEndpointLeaderSyncSecurityChannelFirstMidMarketCentricNetworkLeaderEndpointLeaderSyncSecurityChannelFirstMidMarketCentricNetworkLeaderEndpointLeaderSyncSecurityChannelFirstMidMarketCentricNetworkLeaderEndpointLeaderSyncSecurityChannelFirstMidMarketCentricNetworkLeaderEndpointLeaderSyncSecurityChannelFirstSophosOEMPartnersOEMsolutionstrustedbyworld-leadingITbrands

12ZerodayMalwareURLClassificationIP/File

ReputationCloudLookupsSpamIntelligenceApplication

CategoriesWiderangeofIndustryApplicationsLiveProtectionbySophosLabsSDKsWhite-labelThreatIntelligenceSlideOwner:NiravMahidaProtectingCompaniesWorldwide13我們的客戶介紹

SophosforVirtualEnvironments服務(wù)器保護(hù)戰(zhàn)略O(shè)ptimizeperformanceLightweightagentPerformanceiskeyAgentless/LightagentOn-demandresourcesUsagebasedlicensingPHYSICALVIRTUALIaaSOptimizedforperformanceMTDServerSpectrumADDINGNEXTGENPROTECTIONAnti-

malwareTODAYMTDCryptoguardLockdown16兩種方法保護(hù)虛擬機(jī)VE全服務(wù)器/終端全代理在每個客戶端超輕量級瘦客戶端代理，通過集中SVM（Sophos安全主機(jī)）進(jìn)行集中保護(hù)SOPHOSFORVIRTUALENVIRONMENTSApproachtoselectdependsonrequirementsandtheroleofthevirtualmachinesBothoptionsareincludedinallSophosServerProtectionlicenses–enablesflexibility保護(hù)虛擬機(jī)的兩種方法

全代理

Sophos虛擬環(huán)境SVE資料消耗每個代理VM安裝了防病毒引擎;每個VM都需要處理器，內(nèi)存，存儲空間，可能會降低VM的資源利用率。檢查被卸載到中央安全VM。每個虛擬機(jī)不需要自己的引擎;這減少了開銷，允許更大的VM密度掃描風(fēng)爆多個VM同時進(jìn)行的定期或按需掃描可能會導(dǎo)致“掃描風(fēng)暴”，從而增加資源使用并降低系統(tǒng)性能按需調(diào)度和自動錯開掃描多個VM虛擬機(jī)，減少資源消耗更新風(fēng)暴由于同步更新的安全軟件的定義文件和安全軟件本身，產(chǎn)生更新風(fēng)暴，會可能導(dǎo)致過度使用資源。定義的更新只發(fā)生在SVM安全虛擬機(jī)上，客戶代理不需要定義更新陳舊的黃金鏡像主映像可能是以前幾個星期或幾個月創(chuàng)建的，這意味著代理可能需要大量更新才能成為當(dāng)前;日常工作中，VDI部署尤其普遍。off-box離線方法意味著客戶端代理不需要頻繁更新?？蛻舳舜砜梢约映芍饔诚?，而無需在每次啟動時更新自己保護(hù)虛擬機(jī)的兩種方法EnhancedprotectionfeaturesincludingServerLockdown,MTD,CryptoGuardHigherresourceoverheadsrelativetovirtualization-specificsolutionExampleuse:Endpointswithhigh-valuedataandsubjecttomultipleattackvectorsAnti-malwareincludingLiveProtectionlookups,withautomatedthreatclean-upLowerresourceoverheads;enableshigherVMdensityRelieffromscanstormsandupdatestormsExampleuse:EndpointswithrestrictedaccesstolowervaluedataandexposedtofewerattackvectorsSOPHOSFORVIRTUALENVIRONMENTSFullServer/EndpointagentdeployedoneachguestVMUltra-thinguestagent

withcentralized

threatprotection

SophosforVirtualEnvironments:簡介20ScanningloadisremovedfromguestVMsandmovedtoadedicatedSophosSecurityVirtualMachine(SVM)極輕量代理:onguestVMsinterrogatesfilesagainstexclusionsandscanningrulesandsendstotheSVMforinspectionInspectionoccursacrossthenetwork,whetherinternallyinthehostmachineorthephysicalnetwork;advancedcachingreducesoverheadMulti-platform:supportsVMwarevSphereandMicrosoftHyper-Venvironments;supportsWindowsworkstationsandWindowsServerguestVMsChoiceofmanagement:ChooseeitherSophosCentral(cloud-based)orSophosEnterpriseConsole(on-premises)Off-boxsolution

LowerresourceoverheadonGuestVMsMulti-platform

VMwarevSphereandMicrosoftHyper-VThreatProtection

Anti-malwarewithLiveProtectionandfullautomatedclean-upSecurityMadeSimple

EasydeploymentandsimplelicensingGartner,TheFeasibilityofHost-BasedControlsandtheEvolutionofServerSecurity,April2016,JoergFritschTheideaofinterceptingfilesystemeventsata(kernel)driverlevelandsendingthemtoacentralAVscanningenginehasbeenadoptedbymanyvendors.Thisprovidesthebenefitofcentralizedhypervisoragnosticscanning.““SophosLiveProtection實(shí)時防范未知的威脅管理控制臺

SophosforVirtualEnvironments:架構(gòu)SophosforVirtualEnvironments:支持的平臺HYPERVISORSGUESTVIRTUALMACHINESVMwarevSphere(ESXi):5.5U3,6.0U2,6.5MicrosoftHyper-V2012R2(2016comingsoon!)ServersWindowsServer2016(Anniversary)WindowsServer2012R2WindowsServer2012WindowsServer2008R2SP1WorkstationsWindows10(Anniversary)Windows8.1Windows7SP1ProfessionalSophosforVirtualEnvironments:部署1DownloadInstaller

ChooseESXiorHyper-Vinstaller,availableinMySophosorSophosCentral2InstallSecurityVMonthehost

FollowtheStep-by-stepwizardtodeploythededicatedSophosSecurityVM(SVM)3Deploythinagents

RollouttheSophosguestagenttoVMs

e.g.usingWindowsGroupPolicyThat’sit!

Noadditionalthird-partyappliancestoinstallandmanageSophosforVirtualEnvironments:管理SophosCentral

ManageallyourproductsfromasingleinterfaceChoiceofManagementSophosCentral

(cloud-based)SophosEnterpriseConsole(on-premises)SophosforVirtualEnvironments:許可AlicenseisrequiredforeachGuestVirtualMachineLicensetypedependsonserver/workstationOSandchoiceofmanagementplatformThededicatedSophosSecurityVMdoesnotrequirealicenseServerGuestVMsWorkstationGuestVMs(VDI)SophosCentral

(cloud-basedmanagement)CentralServerProtectionStandard

(Part:SVRCLOUDSTD)

OR

CentralServerProtectionAdvanced

(Part:SVRCLOUDADV)

CentralEndpoint

Standard

(Part:CES)

OR

CentralEndpointAdvanced(Part:CEA)SophosEnterpriseConsole

(on-premisesmanagement)ServerProtectionforVirtualization,WindowsandLinux(Part:SVRWLV)

OR

ServerProtectionEnterprise(Part:SAVSVR)

SophosforVDI(Part:VDI)Licenseflexibility–mixandmatchfullagentandSophosforVirtualEnvironmentsdeploymentswiththesameSophosServerProtectionlicense總結(jié)27Off-boxsolution

LowerresourceoverheadonGuestVMsMulti-platform

VMwarevSphereandMicrosoftHyper-VThreatProtection

Anti-malwarewithLiveProtectionandautomatedthreatclean-upSecurityMadeSimple

EasydeploymentandsimplelicensingDesignedspecificallyforvirtualenvironmentsAlternativetofull-agentdeploymentNothird-partyappliancesrequiredMixandmatchfullagentandoff-boxdeploymentswithflexiblelicensingConsistentprotectionandpolicyacrossmixedenvironmentsLiveProtectioncloud-basedlookupsdetectpreviouslyunknownthreatsAdvancedponentthreatclean-upincluded物理服務(wù)器區(qū)Unix

,Linux虛擬服務(wù)器區(qū)：Vmware,Hyper-V統(tǒng)一管理平臺：統(tǒng)一管理Linux，Windows,UnixVMwarevSphere生產(chǎn)區(qū)1生產(chǎn)區(qū)1生產(chǎn)區(qū)1物理服務(wù)器區(qū)設(shè)計(jì)服務(wù)器…虛擬服務(wù)器區(qū)群物理服務(wù)器區(qū)群管理中心SEC服務(wù)器保護(hù)客戶收益每個物理主機(jī)容納的虛擬機(jī)提升30+%；不再有掃描風(fēng)暴，也不存在防病毒占用過高的計(jì)算機(jī)資源問題;消除了“防御盲點(diǎn)”，全自動保護(hù)虛擬機(jī)，降低管理復(fù)雜度；虛擬機(jī)不再需要安裝虛擬化軟件，也不需要再維護(hù)復(fù)雜的防病毒客戶端，即可擁有同等級別的高級威脅防護(hù)。

SynchronizedSecurity

RevolutionizingAdvancedThreatProtection

創(chuàng)新性的下一代威脅防御系統(tǒng)攻擊比防御更復(fù)雜攻擊面指數(shù)更加大越來越多的攻擊，越來越復(fù)雜30Laptops/DesktopsPhones/TabletsVirtualservers/desktopsCloudservers/storageIoT聯(lián)合犯罪工具ZerodayexploitsMemoryresidentPolymorphic/metamorphicMultilevelbotnets同步安全和戰(zhàn)略SophosCentralCloudIntelligenceSophosLabsAnalytics|AnalyzedataacrossallofSophos’productstocreatesimple,actionableinsightsandautomaticresolutions|24x7x365,multi-continentoperation|URLDatabase|MalwareIdentities|FileLook-up|Genotypes|Reputation|BehaviouralRules|APTRulesApps|Anti-Spam|DataControl|SophosID|Patches|Vulnerabilities|Sandboxing|APIEverywhereAdminSelfServicePartner|ManageAllSophosProducts|UserCustomizableAlerts|ManagementofCustomerInstallationsEndpoint/Next-GenEndpointMobileServerEncryptionUTM/Next-GenFirewallWirelessEmailWebInCloudOnPrem31用戶部署SecurityHeartbeat?XGFirewallSophosCentralXGFirewallEndpointsAverage154Typical1-2AverageCompanySize387Employees同步安全最好的安全系統(tǒng)，使您的防御比攻擊更協(xié)調(diào)。

33自動事件響應(yīng)無與倫比的保護(hù)違反預(yù)防減少違約的影響簡化IT管理實(shí)時洞察與控制無與倫比的保護(hù)下一代終端保護(hù)Script-basedMalwareMalicious

URLsPhishing

AttacksRemovable

Media.exe

MalwareNon-.exeMalwareUnauthorized

AppsExploits.doc

.xls.pdf35SynchronizedSecurityDeviceAnd

AppControlReputation

SecuritySignatures

GenesExploitPreventionBehavioral

DetectionsMemory

ScanningCryptoGuardSophosCentralMgmt.pre---><--post-Machine

LearningRootCauseAnalysisMaliciousTraffic

DetectionWebProtectionEmailProtectionSandboxingApplicationProtectionUseridentityEncryptedTraffic

InspectionAdvancedThreat

ProtectionIPSSynchronizedSecurityDeviceAnd

AppControlReputation

SecuritySignatures

GenesExploitPreventionBehavio