Skybox Security

Overview
Model the Attack Surface

DMZ

Security Controls Network Topology Assets Vulnerabilities Threats

2
 Fastest–growing company
Silicon Valley HQ
in our space
Offices around the globe
$270M funding since February 2016

Who We Are
5–star reviews
700+ active customers
Vulnerability/Threat Management
50 countries, all verticals
Risk/Policy Management

3
Who Relies on Us

Financial Service Government Energy & Technology &

Healthcare Consumer
Services Providers & Defense Utilities Manufacturing

4
Why We’re Needed

97% of breaches are avoidable through standard controls

Limited visibility Non–actionable Lack of resources

intelligence and
data silos

5
Why We’re Needed

Skybox helps bridge the security management gap

Unparalleled visibility Integration with Intelligent automation

and comprehensive existing technologies and orchestration
network modeling and added intelligence

6
Improve Existing Resources
Firewall/Network
Security &
Infrastructure

Vulnerability
Management,
SIEM

120+
technology
Endpoint integrations
Security

Cloud/
Virtual

7
Skybox Security Suite

Integrated Security Management

Attack Surface Visualization
• Total visibility of the attack surface
– Physical, virtual, cloud and
OT environments
– Vulnerabilities and threats
• Measurable risk reduction
• Improved communication across
teams and up management chain

8
Skybox Security Suite

Integrated Security Management

Security Policy Management

• Easy, efficient compliance reporting
• Intelligent workflows and automation
• Proactive risk assessments of security
and network changes

9
Skybox Security Suite

Integrated Security Management

Vulnerability and Threat Management
• Vulnerability prioritization aligned to
the current threat landscape
• Exposed and exploited vulnerabilities
highlighted
• Resources directed where they’re
needed most

10
Skybox Security Intelligence Feed

Skybox Research Lab Exploits in the wild

700,000+ sites
in the dark web
Vulnerabilities used in
ransomware, exploit kits, etc.

30+ security
data feeds
Attack vector details

11
Security Policy Management

Model Analyze Monitor Change

Network Security Controls Compliance Management

• Network topology • Cloud security tags • Automated audits • Change request

view • Firewalls • PCI DSS • Tech details
• Normalized data • Rule and • FISMA • Risk assessment
from 120+ configuration checks
technologies • NERC • Provisioning options
• Network path analysis • NIST • Reconciliation and
• Physical, virtual, cloud
and industrial • Rule optimization • GDPR verification
• Access simulation • Change tracking • Custom policies

Understand Confirm Document Continuously

Network Context Effective Controls Compliance Verify Rulebase

12
Vulnerability and Threat Management

Discover Analyze Prioritize Remediate

Vulnerabilities Attack Surface Response & Track

• Scanless • Hot spot analysis • Imminent threats • Remediation planning

vulnerability detection • Attack simulation (exposed/active • Ticketing and
(physical/cloud) exploit) workflow
• Business impact
• Support for all third- • Potential threats • Dashboards and
party VA scanners • Network topology and (known/available
compensating reporting
• Threat-centric exploit)
controls
vulnerability • Attack vector details
management • Threat context

Same-Day Highlight Assets Focus on Areas of Respond

Identification at Risk Greatest Impact Quickly

13
Firewall Assurance
Comprehensive Multi-Vendor Firewall Management

Firewall Continuous Firewall Rule

Security Assessment Policy Compliance Life Cycle Management

How It Works

1 2 3

Collect & Normalize Analyze Report & Act

14
Change Manager
Secure, Automated Firewall Change Management

Change Management Automated Risk Rule Recertification

Automation Assessment Workflow

How It Works

1 2 3 4 5

Request Identify Assess Implement Verify

15
Network Assurance
Complete Visibility and Command of Hybrid Network Access and Routes

Network Compliance
Network Model Security Analytics
Verification

How It Works

1 2 3

Collect & Normalize Create a Model Analyze in Context

16
Vulnerability Control
Threat-Centric Vulnerability Management

Scanless Assessments Network + Threat Context Exposed and Exploited Vulns

How It Works

1
2
3

1 2 3 4

Assess Analyze Prioritize Remediate

17
Threat Manager
Threat Intelligence Analysis and Response

Consolidated Threat Contextual Threat Focused Threat

Intelligence Assessment Response

How It Works

1 2 3

Collect & Normalize Check Relevancy Track Remediation

18
Visualize Your Entire Attack Surface From
Multiple Perspectives

US
Unsecure Device Configuration (Total: 72)

Name: UDP reply packets – filtered #Violations: 1

Vulnerability Risky Access Policy: Checkpoint FW Standard Policy
Exposure Rules Last 4 Months
Name: Encrypted Line Password - required #Violations: 1
Policy: Cisco IOS RTR Standard Policy

311 Assets Name: IP source routing - prohibited #Violations: 1

Policy: Cisco IOS RTR Standard Policy
5 Firewalls
Name: Password Encryption Service - required #Violations: 1
Exploited
Site Details Unsecure March April May June Current Policy: Cisco IOS RTR Standard Policy
in the Wild Device
Vulnerabilities Configuration Name: SNMPv3 Group - required #Violations: 1
Policy: Cisco IOS RTR Standard Policy

Exploitable
Vulnerabilities

19
Skybox Horizon
Attack Surface Visualization

Risky Access Rule

Allows inbound access from DMZ
to deeper in network

Exploited in the Wild Vulnerability

Vulnerability with available and active
exploit is attacked

Unsecure Device Configuration

Misconfiguration enables the
continuation and spread of attack

20
Threat-Centric Vulnerability Management

Attack Surface Model

Context: Asset Exposure/Criticality

Vulnerability
Intelligence Prod FW Backbone Core Router

Vulnerabilities
+ Main Router GatewayEastA

Exploits in the Wild

Main FW GatewayEastA IPS

21
Threat-Centric Vulnerability Management

Attack Surface Model

Context: Asset Exposure/Criticality

Imminent Threat
Vulnerability
High-priority
Intelligence Prod FW remediation/mitigation
Backbone Core Router
Analytics Prioritize
Vulnerabilities
+ Main Router
Potential Threat GatewayEastA

Exploits in the Wild Gradual risk

reduction
Main FW GatewayEastA IPS

22
Security in Multi-Cloud Environments
NSX
AWS Azure
(Private)
Complete Visibility

End–to–end path analysis

Policy compliance across networks

in a single dashboard view

Out–of–the–box regulatory
compliance checks

Threat–centric
vulnerability management

23
Security in Industrial Networks

Visibility and path analysis

for combined IT and OT
OT networks IT
Production Control
Business/
System Network
Corporate Network
Risk analysis

Util Util
Vulnerability detection E A
Internet
Util
B
RTU/PLC/DCS Util Util
Controller Units & C D
Field Devices Neighboring
Utilities

24
GDPR—How Skybox Can Help
Article 25 Article 30 Article 32

Record
Data Protection Security
Processing
By Design of Processing
Activities

Article 33 Article 34 Article 35

Breach Notification
Breach Notification Data Protection
to Supervisory
to Data Subject Impact Assessment
Authority

25
Take Control of Your Attack Surface

Attack Surface Threat and

Automation and
Visibility and Vulnerability
Orchestration
Analytics Intelligence

26
Thank You
Skybox Security
Technical Overview

28
Skybox Architecture

29
Deployment Diagram
• Integrates with existing
infrastructure
• Automation, workflows
• Not a scanner, Agentless
• Built-in ticketing system
• APIs for integration with
third-party systems
• Appliance, virtual appliance,
software only

30
Network Model Visualization

31
A Comprehensive Network View
Detailed Model Complex and Changing Network

• Network context
• Network size, complexity
• Multi-vendor environment
Device-Level view

• Routers, LBs, FWs, Assets

• Routing tables, ACLs, IPS
• NAT/PAT, VPNs, Tunnels

32
Network Path Analysis
Access Analyzer
Understands
• Routing/PBR
• NAT/PAT/VPNs
• Load Balancing
• Firewall rules
• Multiple routes

33
Continuous Compliance Monitoring
Automated
Compliance Checks
– Access Compliance
– Configuration Compliance
– Rule Compliance
• PCI, NIST, Custom Policies
• Vendor best practices
• Track exceptions

34
Optimise Rules
• Spot shadowed and redundant
rules quickly
• Gather log data to analyse
historical rule usage
• Tighten the rule base, improve
security and effectiveness
• Have a consultative conversation

35
 Zone-to-Zone Access Compliance
Internet /
External

Only Port 80

No Access
Paris
New
York

DMZ

London
Development

Partners
Only Ports 80, 8080, 443, 22
Resellers

Finance Servers

36
Optimizing Change Management Workflow
Automate Change Management
Change
Request
• Vastly improve operational costs
• Reduce time to implement changes Technical
Details

• Risk assessment before change is made

Risk
• Automate changes/generate configuration Assessment

• Reconcile changes Change

Implementation

Reconcile
and Verify

37
Change Management Workflow
Technical Risk Implementation
Request Verification
Details Assessment

Capture Translate Identify policy Assign to Reconcile

business/ violations & team for against
Path
technical Vulnerability provisioning observed
identification
details exposures changes
Rule analysis
Accept/Reject Verify Access

Skybox Analytics Engine

38
Change Management Workflow

Request for Other

Audit Trail
Request Firewall Change
Maintained
Change Requests

Technical Risk
Implementation Verification
Details Assessment

Skybox Change Manager

39
Skybox Vulnerability Database
• Skybox Research Lab aggregates 30+ vulnerability and
threat feeds
• More than 70,000 vulnerabilities on 8,000+ products
• CVE compliant, CVSSv3 standard
• Updated daily

ADVISORIES SCANNERS IPS OTHER

CERT, ICS CERT Symantec Security
Adobe Microsoft BeyondTrust Rapid7 Nexpose Fortinet FortiGuard Flexera Secunia Focus
Apple Oracle Retina Tenable Nessus McAfee IPS IBM X-Force Rapid 7 Metasploit
Cisco Red Hat McAfee FoundstoneTripwire IP360 Palo Alto Networks Mitre CVE Zero-day
Qualys Cloud Trend Micro TippingPoint NIST NVD vulnerabilities for
Platform Cisco SourceFire OSVDB published incidents

40
Skybox Vulnerability Database
Subscribed customers
30+ threat feeds updated daily

Skybox
… Research
…
Labs
Dedicated team
verifies, normalizes,
adds more data

41
Main Uses of the Vulnerability Database

Data normalization Skybox

Attack vectors
(vulnerabilities, IPS Vulnerability information
signatures) Database

Product and
vulnerability
profiling rules

Data Collection
Attack
into Security
Simulation
Model
Vulnerability
Detector

42
Remediate the stuff that matters!

Threat-Centric Vulnerabilities Identified

Vulnerability Management

• How do we prioritize for

remediation?
• Are critical assets at risk?
• What’s our trend in fixing vs
finding vulnerabilities?
• Which vulnerabilities should I
fix for the biggest impact?

43
Threat-Centric Prioritization

44
 Vulnerabilities

Attack Simulation CVE 2014-0160

CVE 2014-0515

CVE 2016-0076
Compromised
Server

Internet
Hacker

Attack Vectors

Infected
Partner

45
Thank You

46