35 slides from Check Point Software Technologies's investor presentation, Jan 28, 2020
Slide 1: Securing Office 365 for State and Local Government
Securing Office 365 for State and Local Government MICHAEL OSTERMAN MICHAEL LANDEWE Principal Analyst Cofounder Osterman Research, Inc. AVANAN, Inc. ©2020 Osterman Research, Inc.
Slide 2: About Osterman
ABOUT OSTERMAN Focused on the messaging, Web and collaboration industries. Practice areas include archiving, security, encryption, content management, etc. Strong emphasis on primary research conducted with decision makers and influencers. Founded in 2001. Based near Bellevue, Washington. ©2020 Oste
Slide 3: About Avanan
ABOUT AVANAN A single application for threat protection, investigation and remediation for the entire O365 suite. Best Email Security Software of 2019 as reviewed by customers One-click API install. AI trained for the suite to learn from users Catches what ATP security misses
Slide 4: Key Issues
KEY ISSUES • Ransomware, other forms of malware, phishing, business email compromise, data breaches, accidents, malicious insiders and other security problems are bad and getting worse • Meanwhile, the business world is migrating email to Office 365 • Security problems don’t go away with Office 365.
Slide 5: Government
GOVERNMENT • Government is an especially lucrative target for cyber criminals. • Governments have an enormous volume of valuable information. • Funding is often insufficient. • There is generally a low level of cyber security readiness • Many are moving to the cloud, often without a proper security
Slide 6: Office and G Suite Email statistics
OFFICE 365 and G SUITE EMAIL 91% 200 million of cyberattacks Office 365 email inboxes start with email adding 4m per month 60% 2x the target increase in phishing Office 365 has 2x the attacks in 2019 attack rate versus G Suite
Slide 7: Some Examples and Lessons Learned
SOME EXAMPLES AND LESSONS LEARNED • Lake City, Florida • Disconnecting computer systems, even within minutes, won’t prevent a ransomware infection. • Georgia Administrative Office of the Courts • Governments often must resort to manual processes for weeks or months after an attack. • Ocala, Florida
Slide 8: Threat Dynamics
THREAT DYNAMICS • Many municipal and state governments will continue to represent robust targets for cyber criminals • Ransomware provides a great return-on- investment for cyber criminals • We are migrating from ransomware to destructware ©2020 Osterman Research, Inc.
Slide 9: Key Points
KEY POINTS • Reduce the attack surface: the migration to Office 365 and other cloud services means that cyber criminals are going more after desktops, not servers or backend infrastructure. • The problem is not just phishing – bad actors want to take over your accounts. • Because governments often r
Slide 10: Analysis of Exchange Online Protection (EOP)
ANALYSIS How OF EXCHANGE Phishing Bypasses ONLINE PROTECTION (EOP) Office 365 Whitelisted Phishing Phish Marked as Clean • Spam Confidence Level (SCL) Phishing Attacks • Phishing Confidence Level (PCL) Phish Marked as Spam Blocked 25% 5% 9 5 0 -1 21% 49% Probable phishing SPAM Whitelist (trusted) QU
Slide 11: Malware Attachments in Decline
MALWARE ATTACHMENTS IN DECLINE Phishing Attacks Using Phishing Attacks Using Malware Attachments Malware Attachments 4% 51% 2019 2020 All Other Forms of Phishing All Other Forms of Phishing (URL, BEC, Fileshare, etc.) (URL, BEC, Fileshare, etc.) Source: Avanan ATP Report: n=30M
Slide 12: Microsoft's Claim for ATP Security
MICROSOFT’S CLAIM FOR ATP SECURITY Microsoft claims that ATP has the lowest miss rate in the industry. Almost Zero?
Slide 13: How Did They Measure?
HOW DID THEY MEASURE? ? Competitors’ Microsoft Security Email Gateway (EOP/ATP)
Slide 14: Measuring Office 365 ATP's Miss Rate
MEASURING OFFICE 365 ATP’s MISS RATE Microsoft Security EOP | ATP 2 leading Real-time threat Multiple anomaly sandbox feeds and URL and AI machine emulation analysis engines learning engines engines Manual false- positive analysis
Slide 15: Testing Microsoft ATP's Miss Rate
TESTING MICROSOFT ATP’s MISS RATE Microsoft’s Claim
Slide 16: ATP's Miss Rate vs Targeted Attacks
ATP’s MISS RATE vs TARGETED ATTACKS Microsoft’s Claim
Slide 17: How Often Are You Targeted?
HOW OFTEN ARE YOU TARGETED? Percent of inboxes receiving malicious email over 2-week period. Sample of municipal/state governments.
Slide 18: Key Points
KEY POINTS • Microsoft is both the target AND the vector. • Focus on more than just cyber protections. • Consider a layered cyber security approach on top of SaaS solutions with purpose-built products. • Because government entities will whitelist other governments, volunteer fire departments, food b
Slide 19: What Is a Targeted Attack?
WHAT IS A TARGETED ATTACK? TARGETING OFFICE 365 TARGETING YOUR ORG • Seen across multiple organizations • Customized for your organization • From same source(s) or of a single attack method • From same source(s) or of a single attack method • Utilizes an Office 365 vulnerability • Utilizes an Office
Slide 20: Office 365-Targeted Attack
OFFICE 365-TARGETED ATTACK Link to Microsoft Sway Document k Lin us io lic Ma
Slide 21: Organization-Targeted Attack
ORGANIZATION-TARGETED ATTACK 7.3% of most users will click1 3% of users will click after training1 18% Link to Office 365 Login of trained users click on mobile1 1 Verizon 2019 Data Breach Investigations Report *Names edited from original
Slide 22: Things to Consider
THINGS TO CONSIDER • Focus heavily on anti-phishing solutions. • You can save money by using lower level Office 365 plans plus third-party security and other tools. • Third-party security solutions can offer better value. • Understand your vulnerabilities. • Implement the right cloud security servic
Slide 23: EOP vs ATP
EOP vs ATP 2 WEEKS OF PHISHING AT MIDSIZE MUNICIPAL GOVERNMENT
Slide 24: ATP Miss Rate
ATP MISS RATE 2 WEEKS OF PHISHING AT MIDSIZE MUNICIPAL GOVERNMENT
Slide 25: False Positives, Whitelists, Vulnerability
FALSE POSITIVES → WHITELISTS → VULNERABILITY 7.8% of municipal phishing attacks were from whitelisted domains. (compare to 4.9% global average.) Microsoft’s Whitelists Your Whitelists ● Internal Attacks from Compromised Accounts ● Whitelisted Domains ● Microsoft Trust of Microsoft Services ● Whiteli
Slide 26: Things to Consider
THINGS TO CONSIDER • Gain visibility into cloud services usage and threats • Implement ransomware-resistant backup services • Endpoint protection is key • We live in a Microsoft-centric world: consider solutions to address that issue • Learn from government colleagues • Focus on the cyber security s
Slide 27: Summary
SUMMARY Assess cyber security readiness, threats and areas of concern. Phishing attempts, unpatched systems, and missing security solutions are likely to feature highly for most government entities. Prioritize threat areas and take action. Investigate solutions that offer cyber defenses beyond a sin
Slide 28: Security for Email and Collaboration in the Cloud
Security for Email and Collaboration in the Cloud
Slide 29: Layering Email Security in Office 365
Layering Email Security in Office 365 Avanan features patented technology that subsumes ATP, SEG, and CESS – via API pre-inbox post-delivery Secure Default Advancedü Post- Protection Advanced Threat Click-time Email Security Threat ü Inline EmailDelivery Protection Protection Gateway (EOP) Protectio
Slide 30: Avanan Security Events dashboard
AVANAN Security events Last12months —v @ MALWARE - 5% remediated @ — PHISHING -80% remediated =~» @SHADOW IT - 0% approved & SDLP 19% remediated % — @ANOMALIES- 0% remediated dylanp@avanan.com Adin i" 54 051 36 o7 26 026 31 @ 19PENDING 5 05 TOTAL PENDING TOTAL PENDING TOTAL PENDING ToTAL @ 6 LEAKED
Slide 31: Avanan Policy
AVANAN POLICY dylanp@avanan.com 7 New Policy Rule - Office 365 Mail Threat Detection ‘Admin Rule Name Mode Users receive the emails only after found clean by security apps. Office 365 Mail Threat Detection Protect (inline) ~ |< Malicious emails are quarantined automatically. Scanning can sometime ta
Slide 32: Avanan anti-phishing email profile
P Avanen x + = ox € © © avanandemo3.avanan.net/r nl#l/profile/office365_email: 76b946Fa: xy Of8\|@: Apps [I] Avenan [J], Sales Engineering office365 - Quarant. Gmail -admin@av.. P Avanan (1) Other bookmarks NAN (a) Message - "0365 Internal Email Error’ Email Profile Security Stack cisbrecht@avanan.c
Slide 33: Driving Down the Cost and Improving Security in Office 365
Driving Down the Cost and Improving Security in Office 365 • Office 365 Plan E5 is the “full meal deal” from Microsoft. $35 • Office 365 Plan E3 is significantly less expensive, but $9 not include ATP. $4 $20 $20 $20 • However, Plan E3 in combination with Avanan Advanced Anti-Phishing is 31% less ex
Slide 34: For More Info
FOR MORE INFO Osterman Research, Inc. +1 206 683 5683 +1 206 905 1010 info@ostermanresearch.com www.ostermanresearch.com ostermanresearch.blog @mosterman ©2020 Osterman Research, Inc.
Slide 35: Protect Office 365 from the Inside
Protect Office 365 from the Inside A single interface for threat monitoring, investigation and remediation for the entire O365 suite Architecture Built for the Cloud Deploys in Minutes, Not Months Best Email Security Secures the Entire Software of 2019 as reviewed by customers Cloud Try it for 14 Da