okay welcome to the end of Thursday if
you want to get me really annoyed you
should refer to this conference as the
antivirus conference because I really
think it isn't but at the same time the
fact is a lot of people here work for
antivirus vendors or endpoint security
vendors and I think this is and a little
in this landscape a lot of things are
changing so I think it's important to
have a discussion about these changes
and I'm very excited to introduce Adrian
Sanabria from 4-5-1 research to talk
about you things thank you thank you and
you you do have virus in the name of the
conference so that's you can't get too
upset I don't think all right thank you
for coming in today
late on the second day of a conference
I've been on the last day of the
conference the last presentation and
that's that's not the best best time to
be there but yes so I actually emailed
sint maarten in email and you know asked
about you know if the this industry
would be interested in doing something
you know I think we we tend to stay
within our bubbles too much you know and
and while some issues it is important to
stay close to them I've always been a
big-picture guy and that's one of the
reasons I love being an industry analyst
it allows me to spend all day thinking
way too much about all these topics and
how they fit into the other topics and
and that's why I want to share with you
today
so just to give you a background I don't
know about the average industry analyst
but I've been on the defense side I've
been on the offense side I've been a PCI
qsa I've been they spent five years of
my career as a chief incident handler I
was an IT before that so I've been a
sysadmin I've done architecture you know
generally I jump it pretty much
everything in anything I can get my
hands on so we're gonna start out with
the big picture
so it's a and this is typical of
security security is a second layer on
top of technology and everything else
and it's just the nature of security and
I don't think the financial markets have
understood this yet have gotten this yet
you know if you look at fireeyes stock
prices and things like that disruption
has to occur you know a lot of times we
don't know that we've picked the wrong
route or the wrong technology until
we're several years down it you know the
startups have been built sold you know
the money's been pumped into it and and
sometimes just the landscape changes
it's not that we made a mistake it's
just that things change technologies new
technologies come out and old strategies
don't work anymore so a lot has changed
and I think one of the most important
things I'd say - two very important
things have changed here the user and
how they use technology and the
technology itself has changed and the
attacker has changed significantly so I
think there's a lot of gaps here and I'm
going to get into these more I don't
want to spend too long on these on these
overview slides but if you were to you
know step out of the room right now you
know I think that this gets across some
of the the key concepts and ideas I'm
trying to get across here we often
there's a lot of key things we don't
think about when we build security
solutions we don't think about the user
we don't think about where it's going to
be used where that users going to be and
how they're going to use it and then we
don't think from the attacker
perspective well enough I think I think
we it's too easily and I don't have that
xkcd comic in here but the you know the
Hollywood versus the the real life you
know in Hollywood you know there's some
very creative and and sexy ways that you
can break into systems and then there's
you know you look at the attacker
mindset and they want the paycheck as
easily and quickly as possible you know
they're not going to go for the the
coolest story to tell over beers they're
gonna go for money in their account so
the market view here it's very difficult
to even as an industry analyst to keep
up with it
so backing up if we look at the history
of endpoint security here AV was was
kind of the the key product in 2002 and
before and then we started to see a
branch out and we saw a lot of
additional technologies in it they don't
even fit in in the bubble here but we
just saw and this is a classic security
startup market this is a classic
security cycle where it just breaks out
like this and even today you know I
think a lot of people don't recall that
money was actually spent on host-based
firewalls because windows didn't have
one Mac didn't have one you know they
weren't built in if you wanted a
firewall on the OS you had to buy it you
know because it was you know it hadn't
become ordinary for laptops to leave the
enterprise for most of the employees to
take a corporate device and plug it in
places that weren't trusted and networks
that weren't trusted we didn't need a
firewall there so a lot of these got
consolidated then we ended up with
something we called endpoint protection
then in 2010 we saw some significant
changes in the attacker it's not that
the attacker changed in 2010 said we
became aware of the landscape change in
2010 so again we had this explosion you
know a V wasn't stopping a lot of the
stuff and and we just had other needs
you know the the ways the attacks change
required us to defend differently back
in 2004 I was responsible for my company
sim and one of the things I looked at
doing was just taking the windows logs
from all the workstations and putting
them
to that sim and of course we were I was
a large payment processor so we had to
comply with PCI and that that means
keeping your data for a year is one of
the requirements and just putting the
windows logs you know not even what
crowd striking carbon black and these
guys are talking about doing today you
know taking every network connection
every file change what's access to file
you know process tree in memory you know
this was just windows logs I would have
had three weeks of storage after pulling
them all in there so that changed it was
able to change primarily now we have no
SQL we've got Hadoop we've got solid
state based sans things like that the
storage and the data technology enable
us to do that now it didn't ten years
ago we couldn't have done that ten years
ago so again we're we're right there
again we're seeing heavy consolidation
and when I released my report I'll show
you here in a moment the one I wrote
last December I had five categories in
there and I noted in the report that I
fully expect two or three years from now
to only have two categories to go from
five down to two so I don't know what
we'll call the next thing I work at four
or five one I don't work at Gartner
they'll come up with that term we'll all
have to use it but I hope it doesn't
have next generation in it because I
don't know about you but that terms I
think outlived its usefulness by now
it's a term that expires you know what
do you have after next generation next
next ji mean what do you call it
you know if palo alto firewall was next
generation in 2006 what do you call it
now also a little jab at machine
learning there i think the marketing is
has taken to referring to machine
learning and AI as equivalent things so
i had to take a little jab there another
one of my feeble attempts at humor
the attacker landscape
so this was a 2003 this is my boss when
I joined four or five one I quoted her
saying this I'm not sure if she's happy
with me quoting or saying this but but
it's important to understand you know
you know when we were talking about the
death of antivirus we're really talking
about the process of doing detection and
doing prevention not the market not
necessarily the products again it's just
this change that we have to make and how
we do this and publicly gotten out there
you know Netflix made some PR statement
about the death of a V I said no just
because we're doing it differently just
because we're stopping malware
differently doesn't mean that it's dead
but you know maybe again they're using
the other definition maybe they're
talking about the fact that the process
has changed so it is all about the
process you know now we live in a world
where malware is completely disposable
there's no reason to use binary
executable file with this particular
hash more than once you know part of the
malware kit is it'll generate something
unique that's guaranteed or literally
your money back to bypass AV and once
you're done with it you dispose of it so
we've had to move on one of the things
that urged me is a lot of companies out
there have advanced products and then
they're non advanced products the way I
look at it is we have things that work
better and things that don't work as
well so to me you know somewhat jokingly
asked companies you know are you gonna
charge people for the patch you know for
the upgrade here now because all this is
doing is what the original product was
designed to do so why sell them even as
separate products you know I mean this
this should not be marketed as a premium
product because this is just how it is
now
you know the attackers have access to
things we consider advanced
and it's no more difficult for them to
use them so they use them so another
term I want us to get out of using these
things that were maybe they were
advanced in 2010 but it's not 2010 so
the first what I call the first great
and point security consolidation started
with zone alarm in 2003 checkpoint
acquiring zone alarm which was a
host-based firewall product I think it
did some additional thing some ids/ips
and roughly I mean it's kind of hard to
tell exactly where it ends but you know
whitelisting was big and late 2000s and
there were some key acquisitions there
like solid core and then Symantec
acquired PGP which one of the key pieces
of endpoint protection was full disk
encryption this was before we had
BitLocker before Mac had gonna blank on
the name but Windows Mac host firewalls
full disk encryption all these got built
into the OS and really if you look at
this trend what's a feature today Emmit
AppLocker
ends up as part of the OS you know so we
just end up with a more resilient more
security feature complete operating
system as we go down the line here it
makes sense to ship with a lot of these
core key technologies we need to keep
these systems safe so it was about 30
acquisitions over that time period
just for endpoint security and so
several events helped us kick start the
second consolidation which started also
in 2010 i I think whitelisting was a big
one of them I think a lot of people got
keyed up over white listening there are
big marketing campaigns saying that
white listening could replace AV you
know and solve that problem forever and
even technically if it could you know I
think what
a lot of us certainly a lot of the
vendors didn't count on was that again
what I said at the beginning the users
they didn't take the the use cases the
workflows into consideration you know
and anybody who tried to do this blanket
wide across the entire operating system
all executables all employees in the
organization quickly found out that it
wasn't something that was maintainable
so what happened after 2010 we found out
about some super cool malware
created by governments highly funded
some other state actors Snowden so some
NSA tools and toys made it out of the
the toy box and into public so all these
things once you use a piece of malware
once somebody spends all this money
whether it be state-sponsored or you
know just a single malware author it's
very difficult to use those tools to use
malware to use these whether you want to
call them tools weapons whatever and not
have them get in the hands of people
that will take them build on them and go
from there and then ransomware has been
the big one I remember you know decade
before we first saw a ransomware
chatting with people and wondering you
know why don't these guys just you know
you know automate something really
destructive you know why don't we see
more of that and we have started seeing
that and it really is like when we can
come up with these scenarios you know
it's it's not that it's not attractive
to them they just haven't figured out
how to monetize it yet so ransoms
extortion has been going on since we've
had broadband you know since before that
you know related to servers and
computers and things like that
ransomware is just the first time we've
seen somebody come up with a better way
to monetize it and fully automate it so
they've scaled it up
right so the second big endpoint
security consolidation a key one we saw
Webroot acquired a company that had some
technology allowed them to do detection
without depending on signatures so that
was a big turning point there we started
seeing more and more of that Google
acquired virustotal Avastin AG AVG was a
was a good one and your joke was
excellent by the way
about the let me know if the the
acquisition helps them with their with
their foosball game or tape you call it
a table soccer table football that's
right only only we call it soccer so
that's 26 acquisitions so far we're
gonna see several more this year before
the years even out and we'll see a lot
next year because we're now up to
something like I think I tracked 77
endpoint security vendors and actually
excludes some things that you might call
endpoint security so here's some
statistics we gather at 451 clearly you
can see here a lot of people are piling
up solutions here they're not using one
endpoint solution here and it's because
of this fragmentation the fact that we
have so many products that do nice
things and also as I mentioned before
the first great security consolidation
you know created this monolithic
endpoint protection client most of the
new guys that are maybe more effective
at catching malware aren't doing any of
those things they're not doing full disk
encryption they're not doing device
ports control over your USB ports
they're not doing all those extra
features so one of many reasons we might
be running more than one of these and we
actually captured some of that here's
some of the things that people that we
survey this is a part of 451 called
voice of the enterprise that surveys I
think for this one it was something like
900 buyers in in the enterprise every
quarter
so we get some great data out of there
and you're gonna see more of it
so last December this is what my market
map looked like I broke it out into five
categories and as I promised I've
already consolidated down some from this
but it's extremely difficult I think to
build these categories
I'm confused the buyers confused even
some of the vendors are confused over
how to break up their products how to
sell it who the buyers might be and a
part of my job to guide them on that and
sometimes I have to say you know I'm not
sure you're gonna have to fill this one
out so this was sixty two vendors this
is ten months ago five categories and
now I'm kind of down to three categories
and we're up to 77 vendors and what
we're seeing a lot of is we're seeing a
lot of vendors with some cool tricks you
know but it not much more than a cool
trick to stop malware you know maybe
they a shim rights to the colonel maybe
they they look for certain syscalls or
patterns of Cisco so again they're
shimming the kernel to do that a lot of
people have found these little tricks to
catch malware but there are tricks that
could be evaded and it's not really a
product you know they're gonna try and
sell it as a product but it really
should just be one technique used within
a larger product and again this is this
is normal for security most startups and
security are building features that are
destined to become features in larger
products later on and financially I mean
that that's just that's the way it is
you know you can't boil the ocean when
you're startup and you have limited
funding and capital and access to talent
so we also see a 50/50 split between
complementary and primary and what I
mean there is there are products out
there that are meant to be installed
alongside AV and then there are products
that are meant to replace it or to be
that primary product so that's a 50/50
split right now and that was complete
coincidence that it's exactly 50/50 well
actually it can't be that's I've got 77
vendors
I probably a few of those I'm not sure
I have to do more research they're so
primary we've got pretty much two things
here and and to be a primary vendor
again if I'm a PCI company they've got
to be certified AV or Mike USA is gonna
say no that doesn't count as antivirus
you can't use that you know whitelisting
you know it can get past that sometimes
but you know really that AV
certification is very important it's
it's a it's a water line that they've
got across for legitimacy you know a lot
of these products you know there's no
free trial there's no way to grab it
download it look at it play with it so
we have to depend on some kind of system
here you know to give us some confidence
that this does what it says it can do
and so we're just now starting to see
I've got a list of four there you know
of these next-gen AV companies that do
that so talking about next-gen I don't
know what Gardner's definition for
next-gen AV is but the way I generally
think of it is we have products that
require prior knowledge of a threat to
stop that threat and products that don't
require prior knowledge to stop a threat
so in my mind that's the clear
distinction between the two here
anything I'm going to consider next-gen
does not require IOC s or signatures or
a malware sandbox to take five minutes
to analyze it
I think static analysis is fine you know
because you have to think about the use
cases I think a malware analysis sandbox
is fine for email because a five minute
delay an email isn't a big deal but if
I'm browsing the web if I'm downloading
something you know if I've just plugged
in a flash drive I mean I can't wait
five minutes you know for a malware
sandbox to run that you know so that
technically to me you know even though
you're the first one potentially to
analyze it you're you have to turn that
into yes it's a known threat no it's not
a threat before you can take action on
it so
prevention and detection the difference
between though these is pretty
significant and I think what the market
is really striving for right now is
prevention and and the big difference
here is prevention just stops malware
from executing end of story you just go
on with your day you don't have to
analyze it you don't have to spend any
time on it product just did its job and
end a story user goes on with their day
if you don't have time you don't have to
look at it whereas on the detection side
it's much more expensive because you
have to launch into your incident
response process and any time you you
have to kick you know security team in
gear you know maybe you want to reimage
that machine after you're done with it a
lot more labor involved with that
workflow you know so big distinction
between the two and most enterprises I
talked to their hair's on fire 24/7 so
they're really looking for the
prevention side of things and once they
get that down once they have less
infections on a regular basis you know
and and and they get that tied down i we
definitely have to move in the detection
route because things will get past that
I don't think it's important or even
necessary to go for a hundred percent
prevention you know some point we've got
to have that layer further down to catch
things so data collection that's where
this comes in
we've got all these products that just
gather tons and tons of data from the
endpoint and I think it's I see a lot of
enterprises trying to compare prevention
products and products that just call
this data from endpoints and it's just
it's it's night and day if you've got
infections going on 24/7 you know that
and you're you never come out of
Incident Response mode you don't need
more data at that point to have to comb
through you know that that's not the
right move there and and generally those
those attempts fail because they do not
have the extra people to look through it
to tune it to monitor it to manage it
and that's why we see a lot of managed
services around this now you know the
red canary is a company they do nothing
but take your carbon black data and tell
you if something bad is in it that's all
they do they go through all that all
that noise for you and pull out the
signal so another big thing to mention
here a lot of the newer guys don't do a
whole lot with remediation and the term
remediation here I want to be clear on
when I think of remediation I think of
actually cleaning it up you're actually
undoing registry keys that were set you
know pulling files off the system
unregistering dll's whatever the piece
of malware did you're undoing it versus
containment which a lot of people use
the term remediation to refer to as an
incident responder what i think of as
containment that's just keeping you know
it from exfiltrating stuff talking to
see to spreading to something else if
it's a worm you know that's just
limiting your damage which is is very
useful in the moment that you detect
something you know bad is on your
systems but beyond that you still have
to clean it up eventually and it's very
very expensive as I mentioned to take a
system from somebody pull it back to the
helpdesk copy the data off reimage it
copy the data back on hand it to them
and my estimates it's anywhere from 800
to 2,300 dollars every time you do that
to an employee depending on that
employee salary your security analyst
salary your helpdesk people's salary all
the time necessary and labor necessary
to do that
so the startup cycle switching gears
here a little bit important to
understand that at some point here you
know most of these I'd say 95% plus
startups are going to be acquired by
somebody the founders are going to leave
at some point you know very important
understand if you're in a start-up
dealing with the startup using a
startups product and because it can be
disruptive to the customer you know some
customers prefer to wait for the
consolidation to happen you know other
companies you
like you see Netflix will try one of
everything you know anything new that
comes out they actually have the
bandwidth to try some of it and they'll
give good feedback and it's it's good
for the startup community and general
it's a three to five year cycle is what
we see in security from the start of a
market to most of the consolidation
having happened so here's my roadmap for
security and honestly this actually
might be a good place to stop because
I've got a ton more slides but it's
really mostly an angry rant for me so
maybe I can just I can give the other
part of the presentation and a bar later
but this is kind of the key here so this
is you know I promised five years out
this is really and I formed this over
you know several several years doing
this well we're really my whole career
just thinking about it so all of this is
happening right now this is not going to
happen linearly in this order companies
are every single one of these steps is
happening now but I put this in this
order because I think this is the order
that makes the most sense for the
average enterprise out there right now
what their capabilities are you know
what they have available and like I said
before it doesn't make sense you know to
get terabytes of new data every week you
know when you're just trying to handle
stop the infections so the better
malware mousetrap is definitely what we
see most of those 77 vendors doing and
really really focused on and just a
broad number of different ways to
accomplish that AV certification is
obviously important for the market
because a lot of people can't buy it you
know that they're not going to be able
to use it unless that certification is
their you know standards regulation
stuff like that requires it to be
something that's that's had some kind of
due diligence third-party due diligence
done on it non malware attacks we could
solve malware today be done with it have
a 100% solution for it and attackers
will still get on
you know so we we clearly have other
issues we have to do there you know
somebody earlier was talking about they
call it CFO fraud yeah I guess a new
term but the idea that you know if I'm
an attacker and I want you know there
was the case in Austria where the think
it was an airplane parts manufacturer
attacker just sent the CFO an email
requesting forty five million euro to be
moved from this bank account to this
bank account and he did it there is no
link there was no attachment there's no
exploit it was just 100% social
engineering you know and really that you
have to get down into thinking about the
entire workflow of how we use computers
email things like that because
transferring forty five million euro is
not a workflow that should exist in a
company of excise within email there
should be some other system some other
workflow for that an email gets abuse
for that kind of thing
so it's a you know for a defender that's
a different way of thinking about things
then of course the endpoint protection
features there's a lot more we need on
the endpoint than just malware or even
just attack prevention you know so these
features are going to have to make it
into whatever product we end up getting
using or using and I think eventually
we'll see a shift where the enterprise
is not comfortable with having two or
three vendors you know separate invoices
for each product separate separate
control management consoles for each
product they're only going to deal with
that temporarily so we're going to have
to see that consolidate and then data
visibility I think this one is huge and
it's been avoided because it's a very
very hard problem we have a lot of
products that can tell us if an
infection occurred but very few those
products can tell us what was taken and
it's incredibly important because
generally you know if that
happens the default for a company is to
assume the worst and so they buy all
their customers identity theft
protection you know they assume all 7
million records were lost but if we had
a product that could tell us exactly
what was taken if anything was
successfully exfiltrated you know maybe
it was only seven thousand records or
seven records or no records and we don't
have to enact the the breach protocol at
all we don't have to go through that
work workflow at all
and I think that's going to be very very
attractive to companies and ultimately I
think the direction we need to move in
is aiming to not need a separate product
in a first place we saw that with a lot
of these features with host firewall
full disk encryption I don't have to buy
a third party product to do that Android
iOS you know the average person I think
does completely fine on those platforms
even Mac without antivirus you know
generally if you make a few precautions
you know you don't have to do it so you
know Windows is kind of the special
child here because there's so many
legacy requirements so many components
and I think there are signs that we're
getting there though recently they
opened up their App Store which I think
having a centralized App Store is one of
the key ways you know that that you
increase the resilience of the platform
you keep bad stuff away from it and
Microsoft just opened their App Store to
external full applications not just you
know they cross-platform mobile
applications that have been the only
thing on there before okay all right
okay thank you