24 slides from Check Point Software Technologies's technical presentation, Apr 25, 2019
Slide 1: Web Seminar, Thursday 25 April 2019
Web Seminar Thursday, 25 April 2019
Slide 2: Office 365 vs G Suite: Which Is More Secure?
kk kkk OFFICES65 VS GSUITE WHICH IS MORE SECURE? e Submit Questions — Q&A Tab anytime e Slides & recording available after the webinar e Sign-up for Reports, Updates and Attack Briefs GLOBAL Pp | GLOBAL fa ©| PHISH | REPORT @ AVANAN
Slide 3: Presenter: White-Hat Hacker, Avanan Co-Founder
White-Hat Hacker Avanan Co-Founder Lead Security Analyst Forensic Research Vulnerability Analysis Customer Engineering Liaison 3
Slide 4: Features, Catch rates, Enforcement, Conclusions
1. Features 2. Catch rates 3. Enforcement Conclusions 4
Slide 5: Features
AVANAN 5
Slide 6: Security feature comparison: sandbox, URL rewriting, antivirus
Sandbox URL Rewriting Antivirus MFA Authentication Anti-spam protection Custom spam workflows Uses URL blacklists Anti-phishing protection Custom phishing workflows Reporting and logging 6
Slide 7: Mail-flow controls and encryption features
Mail-Flow Controls Supports Exchange Hybrid Disable POP and IMAP Message Encryption Message Archiving Image-Text Extraction (OCR) File Sharing External Access Controls E-Discovery and DLP 7
Slide 8: Multifactor Authentication (MFA) Options
Multifactor Authentication (MFA) Options Phone call, SMS text Mobile app notification, Verification Authenticator app Backup codes Security Keys Application Passwords Admin Delete App Passwords Password Expiration Default Password Protection ● ● ● ● ● 8
Slide 9: Granular access policies and new capabilities
Required License Managed Devices Specific Device OS Device Encryption Required Specific Networks Specific Countries Custom Controls Granular policies New capabilities 9
Slide 10: App Intelligence Tools and App Vetting Process
App Intelligence Tools App Vetting Process 10
Slide 11: Shared responsibility and SLA limitations
Microsoft is not responsible for any incidents that It is your responsibility to enforce the appropriate result from your unauthorized action or lack of action movement and access to this data at the level of your when required, or from your employees, agents, application. This includes preventing y
Slide 12: Comparing compliance across platforms
Comparing compliance across platforms* Compliance Protocols 6 @ © bPcil\ Information Controls Nati hivi tenti d litigation hold. Google Vault. ative arehiving, retention ane! litigation he “Limited Retention Rules and Reporting”** Data Residency Offers in-Geo local data residency, DR Offers US, EU d
Slide 13: Catch Rates
Catch Rates AVANAN
Slide 14: Wait 20 min for results
Wait 20 min for results 1st Check: 20 minutes. 2nd Check: 2 hours 14
Slide 15: Exchange Online Protection and ATP block rates
Exchange Online Protection (EOP) 92.3% Blocked Default 99.2% Advanced Threat Protection (ATP) 94.8% Blocked 92.3% 94.8% 99.2% 15
Slide 16: Default vs ATP catch rates after 2 hours
Default: 66.3% Default 93.6% ATP Enabled: 74.6% after 2 hours 66.3% 20 mins 2 hours 66.3% 74.6% 93.6% 16
Slide 17: Enforcement Approaches
Enforcement Approaches AVANAN
Slide 18: Enforcement approach comparison
Browser-level parsing Approach Lets user make the final decision Keeps admins in the loop Content Reconstruction Content Reconstruction Blocks active content like links and images Blocks active content like links and images Enforcement Moves phishing emails to Junk folder Blocks phishing emails Quar
Slide 19: Attachment enforcement approaches
Approach Deliverability-minded: Scans inline quickly Security-minded: Extends inline scanning time and pulls threats from inbox post-delivery Blocks email Replaces attachment with .txt file Enforcement Removes attachment Removes attachment Disables attachment download Disables attachment download .t
Slide 20: OneDrive locks malware vs G Suite blocks downloads
Asynchronous background scan Every file is scanned Warns user and locks file Keeps user informed if not scanned Warns upon download Warns upon download Blocks download when shared by link Blocks actions like open, share, rename, and move Forces scan at time of download Vulnerable: Malware syncs with
Slide 21: Malware vulnerabilities: web vs desktop client
Malware vulnerabilities: web vs desktop client a | ‘es | — Qu + xo = M Gmail Q Search mail : © # sBvan@ «508 @0 bw: lew > og Hieron I eee @BU aH 8 OF ~) & Moveto fe) rae This is a message from a Microsoft account that is not an ec B authorized sender oe Michael Landewe Biinbox - cat_ali@avanan.com 3
Slide 22: Conclusions
Conclusions AVANAN 22
Slide 23: Approaching enterprise security: conclusions
Approaching enterprise security: conclusions Humans are the weak point Misconfigurations, password expiration, tempting links to click on (not to mention extortion, spear phishing) Office 365 is highly targeted Malware written explicitly to bypass security. Historically true, still the case. Made dr
Slide 24: Educational webinars, zero-day briefs, vulnerability analysis
● Educational webinars monthly ● Briefs on zero-day attacks ● Complimentary vulnerability analysis for qualified organizations 24