Presented by Benny Czarny, OPSWAT CEO, at INSS Workshop 2013

1. Securing data workflow to and from organizations
Benny Czarny
CEO OPSWAT,Inc.

2. Introduction to OPSWAT
 Founded 2002
 Based in San Francisco
 Employees, contractors and interns: 115
 Over 50 OEM customers
 Over 500 direct customers
 100+ certified technical partners
 1000+ certified applications

3. OPSWAT Technologies
Secure Manage Control
Company Development tools
 OESIS®, AppRemover and Secure Virtual Desktop
 Secure Data workflow
 Metascan and Metadefender
 Automated Testing platform and Cloud Sandboxing
 Nexperior
 Device manageability and security
 GEARS Cloud

4. SSL VPN and NAC
Some Customers by Vertical
Network
Compliance and
Vulnerability
Assessment
Support Tools Government
Managed
Services
Antivirus Vendors

5. How to secure the data workflow ?
What type of threats are we up against ?
How many threats are we up against ?
What are the capabilities of the security solutions ?
Questionsto ask ourselves

6. What type of threats are we up against?
 Computer Viruses are an NP-complete problem
 NP complete problems cannot be solved in an easy to
measure time in any known way
http://www.dmst.aueb.gr/dds/pubs/jrnl/2002-ieeetit-
npvirus/html/npvirus.pdf

7. What type of threats are we up against?
 Ways to solve NP complete problems include
 Approximation: -an "almost" optimal solution.
 Randomization: allow the algorithm to fail with some small probability.
 Heuristic: An algorithm that works "reasonably well".

8. What type of threats are we up against?
 Known threats
 Unknown threats

9. How many threats are we up against ?

10. How many threats are we up against?
Source: McAfee
Source: Av-Test.org
Differencesin reporting the total amount of threats

11. How many threats are we up against?
Source: McAfee
Source: Av-Test.org
Differencesin detection rates for new malware

12. What are the capabilities of the security solutions?
Measuring the quality of antimalware engines
How can we measure the quality of antivirus engines
 Detection coverage
 Response time
 Operating system compatibility
 Amount of False positives
 Certification by

13. What are the capabilities of the security solutions?
November 2010 February 2011 August 2011
AV Comparatives 97.6 % 95.8 % 92.1 %
AV Test 97 % 99 % 96 %
Measuring the quality of antimalware engines
AMTSO’s mission is to develop and
publish standards and best practices for
testing of antimalware products

14. What are the capabilities of the security solutions?
Antivirus productvulnerabilitiesfrom the National VulnerabilityDatabase
0
10
20
30
40
50
60
70
2005 2006 2007 2008 2009 2010 2011 2012
NumberofVulnerabilitiesinAntivirusproducts[CVEs]
Year

15. What are the capabilities of the security solutions ?
Antivirus
 Tested 30 known malware files (Disguised as documents
or embedded within documents)
 Fewest number of engines detecting the threat was 10 (out of 43)
 Highest number of engines detecting the threat was 30 (out of 43)

16. What are the capabilities of the security solutions ?
Sandbox?
 Tested 30 known malware files (Disguised as documents
or embedded within documents)
 Lowest number of threats detected was 3
 Highest number of threats detected was 23

17. What are the capabilities of the security solutions
Sandboxing
X1%
Protection level :
100%
Multiscannin
g
X2%
Protection
level:
Measuring detection coverage

18. Conclusion
 Viruses and vulnerabilities are very hard to detect
 No current answer about the amount of threats
 No clear answer about the quality of the security
solutions

19. Conclusion
What can we do
 Use many antivirus engines to protect against known and
unknown threats using heuristics and sandboxes
 Sanitize the data to protect against unknown threats
 Protect the security system

20. Use many antimalware engines
This graph shows the time between
malware outbreakandAntivirus detection
by sixAntivirus engines for 75 outbreaks
over three months.
No Vendor detects every outbreak.
Only by combining six engines in a
multiscanningsolution are outbreaks
detected quickly.
By adding additional engines,zero hour
detection rates increase further.
Zero hour detection
5 min to 5 days
No detection at 5 days

21. What are the capabilities of the security solutions
Sandboxing
X1%
Protection level :
100%
Multiscannin
g
X2%
Protection
level:
Measuring detection coverage

22. Sanitize the data to protect against unknown threats
Sanitize the data in a well defined process
1. User Authentication
2. Input Policy Based on User Privileges
3. File Type Policy
4. Scan by Many Antivirus engines
5. Embedded Object and Macro Removal via File Type Conversion
6. File and Media Signature Verification
7. Notification to the user data is ready
8. File and Media Deletion
Keep a healthy tradeoff between security and usability

23. Protect the security system
 Execute sensitive tasks in an isolated virtualized
environments
 Revert your system on an ongoing basis
 Check the memory integrity and the disk integrity of your
system
 Patch the system and its components
 Constantly review the security architecture

24. Questions

25. References
Av-test.com
Av-comparatives.com
www.metascan-online.com
Amtso
Software system defect content prediction from development process
and product characteristics - Harris institute
McAfee