[Music]
all right 84 slides everybody ready
ready yeah okay that's what we're going
to
do that was the first version that's
right then we'll go to number two and
three corporate deck ready no all right
we're going to get going here guys thank
you everybody for jumping in here how is
Cypher combat so far not too bad pretty
tolerable right might it show up again
right yeah I went to the video game
thing last night and had a blast that
was just old school JDM equipment so we
are going to move as fast as we can
because it's a 30 minute slot we're
going to be respectful of the next
presenters my name is Chris ears I'm an
endpoint endpoint I'm a security
engineer and I cover about 87 different
products that that checkpoint sells this
is Chris Richard you see what his title
is right there this is Brian neelen um
we've been with checkpoint for a long
time we're very proud to be here today
and what we're doing today is
unprecedented in terms of checkpoint
presentations so let's get into it
here's the agenda very important every
single bullet point matters especially
in the corporate world uh self-
description what is this campaign this
campaign so far as my Engineers who
developed this entire campaign have told
me is uh an operator is going to come up
push a button bad stuff's going to
happen and we all get rich that's what
I've been so
you see I could have swore yeah see I
could have swore he asked me for a
Bitcoin address and I made that
mistake we're going to get this thing
rolling then let's do it all right so we
drew a name and Ashley come on
up or you can be right there yep and
then so what we're going to do is uh
here I'll give you this one here buddy
and I'll pop down
there
all right so you won uh name and school
and what specific like Direction you
want to roll with in security um my name
is Ashley Tong I am a data science major
and I go to the University of Wisconsin
medicine so data science and then your
friend oh hi I'm Anna I also go to the
University of Wisconsin Madison and I a
coment major good so one thing that a
checkpoint we do and I'll be real quick
about this is that we we have a whole
thing called secure Academy we support
students the next generation of Security
Professionals are currently students
today um we also partner a lot with
women in cyber security so you'll see at
any one of our events we will be working
very closely with those organizations
going forward so with that Brian do you
want to go aad and explain what sort of
a mess we're going to make today yeah
absolutely so and I'm actually going to
slow it down just a little bit because
that timer on that screen is very very
important that is when that big red
button goes live anybody can come up
here smash that button it's not going to
work yet so uh that button will start
working in 330 seconds so we'll slow
down just a little bit but I want to
actually pull back the curtain just a
little bit to tell you guys what it is
we're actually doing what we've
developed so this is a custom developed
implant which is going to act as a piece
of ransomware on 20 different hosts that
we've infected right now you're going to
see on this screen over here after uh
the big red button is pushed you're
going to actually see that switch over
to two remote desktop sessions that you
know we're actually going to watch watch
what's happening so here's the deal the
two desktop remote desktop sessions one
of them we have Microsoft Defender ATP
we're not here to bash Microsoft
Defender that's that's not what we're
here to do what we're here to do is talk
about the story primarily manage
detection and response and how that all
integrates together with a good uh
security platform and ecosystem the
other one you will see will be our own
endpoint security tool called Harmony
endpoint uh so you'll see those both
side by side we'll actually see the
encryption happen we'll see any response
from either of the hosts so we'll
actually have a lot of fun with that so
what we've developed here we have nine
different stages of operation in our
implant so this first stage right this
is to initialize what I've done here is
I've said okay well I need to set some
things appropriately on the system so I
can actually operate right want to make
sure it's a good clean environment to be
able to operate my implant
on next we go into the profil now
there's a lot that happens here high
level what I do is I collect a lot of
system information I collect a lot of
user information I also make sure that
the environment is safe for my implant
to be able to operate in what I mean by
that I go and I try to determine if this
is an analysis environment so if it is
running within a virtual environment if
I can actually look at what's the input
uh signatures are and identify if this
is something that is you know some kind
of pattern that is not some human
derived interaction with the system so
we go through all that and if all that's
working then we get on to this very
important thing right here right so
we've developed this thing this is great
but it wouldn't be so great if it got
out right we don't want this to to end
up getting out now uh suffice to say uh
there are limitations inside the code
that we've developed here so the first
one is it does not have a lateral
movement mechanism and that is by Design
we don't want this you know going
anywhere we don't want it to the other
part here is the kill switching and that
basically looks at everything that's
operating within that environment and
says hey uh is you know is it actually
okay to operate here we look to make
sure that we have the right artifacts
within that system otherwise it won't
continue to
work then we're going to generate our
implant ID this is actually very
important uh because we need to keep
track of what we have infected right we
have to keep track of that all of this
is managed by a command control control
server then we go right from there into
registration with the command and
control server again we have the
capability to come in here and just say
hey just kill it right now but we've
already gotten to this point we're you
know registered with the command and
control server we're down here a little
ways after we've successfully registered
with the command and control server we
get into my my favorite part this is the
file system enumeration you'd think that
you know actually encrypting the files
or you know making fun of the user that
would be fun but this I really like so
what we're doing here is we're actually
targeting specifically in this case just
user space and we're gaining a giant
file tree of everything that is within
scope there so I'm building an entire
file tree but then I want to make sure
that I'm actually targeting just
relevant files so I get rid of
directories I get rid of links you know
things like that um then I'm going to
say all right well I only want files
that are of certain size in our case
we're looking at files that are just 10K
to 13 Meg right so I'm not looking to
Target things that you know would be
massively huge they're probably not
super impactful anyway so I scope that
down then I say hey I just want to
Target specific file types so we do all
that and then finally I get down to
doing something that is actually really
kind of fun here and it's Honeypot file
avoidance so one of the big things that
we see endpoint security tools do is lay
down honeypop files throughout the file
system and if those are messed with in
any way it starts to raise some alarms
and raise some triggers right well this
particular implant actually goes and
removes those from its Target list
because let's face it most vendors out
there even us right what do we do we go
and we say all right we're going to
create honeypop files and we give them
predictable programmatic name names
guess what those are easy to find and
easy to avoid so what we end up with is
hey we've had 9,000 files in the
beginning and all the way at the end we
actually have 73 files that we are
actually going to
encrypt this is where we are today we're
actually in this Loop of requesting
tasking from the command and control
server as you can see we're coming down
there to the point where we can actually
hit that
button then we're going to go ahead and
do encryption and then finally we're
going to get into actually mocking the
user so again this is where we are today
and I'll pass it on over to Chris so we
can actually have some fun here so big
picture um one thing that was confusing
to me for a long time because I wasn't a
coder is the require the requesting
tasks that's literally the infected
hosts sitting there going hey can I go
can I go can I go well now we can go
so your Jour you guys come over and hit
the button and then what you're going to
see is uh I'm going to switch the
monitors pretty quickly and what you'll
end up seeing is our actual RDP session
so goe and hit it
girls and okay so now what we have just
done is we have told the C2 that it's
good to go um oh uh stick around after
the show here girls but as a thank you
we wanted to give you this so this is a
custommade laser engraved Yeti um let's
have a round of applause for our
volunteer I really appreciate them
coming up she's like I'm scared I don't
want to be up here um
the guys with big black Suburbans
they're probably going to be meeting you
afterwards and thanks for the plausible
deniability we don't have to worry about
that go ahead and have a seat
girls yep y but you're on a list
congratulations if you're in cyber
security and you're not on a list you're
not doing it
right
so now we're on to this is the RDP
sessions these are going to be hanging
out in the background while Chris does
some more explanations of uh what we're
going to be seeing
here
okay so ideally what should happen
although Brian reminds me constantly
that anything could happen uh ideally
what we should see happen is we should
see uh harbon inpoint detected so we
should see the splash screen for
ransomware come up here shortly uh we
should see um uh ATP end up getting
known and we'll see the uh splash screen
up there for the ransom
note so hopefully in a perfect world uh
we'll be able to get it stopped what
we'll do is we'll send all that
information up to Horizon so that's our
MDR platform Brian's going to cover a
little bit more of that later um you
guys can come down uh to the booth after
to be able to get a little bit more
information on the full uh attack chain
there and just to touch on a little bit
although you stole my thunder with the
Honeypot files um just to touch a little
bit on you know kind of how things work
right what how we're detecting different
types of things so one of the things
things is volume Shadow copyright so a
lot of companies use that as a mechanism
for file restoration so one of the
things that most ransomware does
although we didn't do it in this case is
the ability to to disable that and then
clear it out of course Brian already
touched a little bit on the Honeypot
files right so those generally rank
higher so as soon as we touch them we
start to trigger alarms and alerts on
it um file extension modification so
this is something that I kind of learned
more recently uh is that if we don't
modify a file extens it doesn't raise as
many alarms so a lot of times you'll see
Ransom chains that file extension that's
a good tip uh to this solution that they
need to start addressing it and then for
us um I think one of the most important
things that checkpoint is a uh trust
nothing verify everything so a lot of
the other solutions they have a little
bit of inherit trust so if Microsoft
trusts the process then it too should
trust it and anything below that
checkpoint is a little bit differently
uh we analyze everything so regardless
of whether it's trusted processed or not
we're going to inspect everything which
is one of the reasons we're able to uh
to catch
things couple of the other things um we
are not relying on volume Shadow copy uh
we do have a custom folder that's uh on
the route of C uh we lock that down to
the end point agent itself that is our
mechanism for file restoration so as
encryption starts to occur we move files
to that folder and then at the end of
the attack we end up restoring them back
to where they were and then lastly uh we
do do a little bit of ranking so we look
at different occurrences on the machine
so different things that are happening
like volume Shadow copy deletion
touching Honeypot files uh and a variety
of other things and which we hit a
threshold and we trigger it so with that
I'm going to give this back to Brian
because at the end of the day it's more
about Manch detection response although
I would love to steal all each
Thunder well you can if you
want you're walking away with the yeah
there you go all right so uh obviously
you know the end point that is a crucial
component here right so we are infecting
an environment that has npoint security
Microsoft Defender ATP on one and
Harmony endpoint on the other and uh
what we're hoping to see right uh Chris
would be really really happy right if
everything uh worked out and we see our
Harmony mend Point go ahead and catch it
that's going to be really cool uh I will
admit I am torn well I'm here to talk
about that manage detection and response
today and yes that is a Lynch pin in our
process of being able to send something
over to
MDR I mean I wrote the thing I'd kind of
like to see it succeed right uh but
we'll see what happens so on that note
of manage detection and response so
checkpoint we are involved in a lot of
different things a lot of people know us
as the firewall company right so back in
in good Lord 30 years ago this year we
actually uh Incorporated ourselves in
our big claim to fame was the fact that
our founder and still CEO Gil schwed
invented the state full inspection
firewall so we have a very long pedigree
and we still do network security
firewalls and gateways today but that's
not you know everything that we do we're
in Cloud security we're obviously in
endpoint security user protection secure
access service edge um
however we are also in this space of
security
operations and that's where our manage
detection and response platform really
comes to play now I'm not going to beat
you guys over the head with a lot of oh
hey here's our manage detection and
response platform this is really cool go
out and buy it
no but here's the
deal we as security practitioners we've
been through this game time and time
again right and we you know know we see
breaches happen we see this and we see
vendors come in and say hey this is a
really cool solution this will stop it
and oft times it doesn't it's broken
promises all the time so let's actually
break this down and talk about what an
MDR solution is a true managed detection
and response solution so in our view
right what should be included in a true
MDR solution well first of all not just
one vector we see many many ERS out
there who say that they have MDR
Solutions and what do they say they say
oh well we work with the endpoint okay
we what else do you work with do you
check email do you have visibility on
the network do you look in the cloud
environment no no no well we believe
that that's not enough right so that is
our philosophy and we'll get into that a
little bit more we also believe that
things should be a true MDR platform
should be both vendor agnostic and then
holistic and full service what we mean
by that is we should be able to go
and basically follow this entire stack
give you coverage for everything and
then full service from the perspective
of we should never have an MDR offering
that sees something happen and then just
says oh hey look I found something good
luck speaking of
which it worked hey all right we're
totally not sweating it over here for
real yeah definitely are not looking at
the cran control in the back end
going yeah yeah it it was quite fun dis
vantage point we we'll describe more of
this in just a moment all right so now
all right that was a little bit boring
okay thank you I was kind of you know
stalling myself to make sure that that
was all going to happen all right so now
we're really going to get into it all
right so what is checkpoints philosophy
when it comes to MDR right so I said
that you know when we talk about about
this we're talking about every single
Vector right we want to be able to cover
every single Vector for you but we also
believe that an MDR solution should be
these five core tenants simple tailored
comprehensive collaborative and vendor
agnostic we talked about vendor agnostic
we also believe that there should be a
life cycle to everything that we do a
simple security operations life cycle
right no checkpoint we've said for years
we are a prevention first company right
and honestly if you look at the real
marketing material for our manage
detection and response service it is
manage detection manag prevention and
response I hate that name right because
that makes no sense if you're doing
manage detection and response you're
already past the point of prevention so
we just don't even talk about that uh
don't let this get this get back to our
marketing Folks at checkpoint Brian real
quick ran so looks like actually the
restoration continued too absolutely so
that's awesome
so we see that there's this life cycle
here going all starting with prevention
right and then we're going to monitor
detect investigate respond hunt and then
we're going to you know cycle through
that all over
again so what does that look like in the
checkpoint ecosystem right we have
Horizon MDR and just like we were
talking about the cyclical process this
is what we have
developed right and we were talking
about this concept of you know this
repeatable process this cycle a rinse
lather repeat right and this is what we
do and this is this is pointing to the
fact that you know MDR ultimately should
be a foundational component right we
shouldn't be going and saying hey you
know what MDR is just a Bolton it's just
a nice good to have it should be a
foundational component of your security
operations
platform so when we talk about that
right we say well there's your security
stack and yes we leverage your security
stack but the MDR solution should be
that foundational component to your
security stack where we have complete or
as complete as possible visibility to be
able to do security operations on your
behalf of course what is that next level
right so we deserve to continue to move
forward right so I had a very uh very
good friend and mentor of mine who
pulled me aside one day and he said
Brian goes who do you think has the
easier job he goes and by the way we're
we're working for uh CIA cyber defense
organization at the time he goes Brian
who do you think has the easier job do
you think it's you know us and we're
we're charged with defending all these
networks that's great or do you think
it's the bad guys I looked at him I said
well you know uh my job's really hard
right and he goes well yeah he goes but
overall he goes it's it's the bad guys
he goes you see they only have to be
right once and and they're going to win
right and at that level the stakes are
insane uh but he goes we we have to be
right every single time or we lose right
so we deserve to continue to drive this
industry and drive advancements in
technology not just because it's a cool
thing to do but because the bad guys are
doing it too right so we have to stay on
par with them so what are the next
things that we really need to account
for this you know concept of enrichment
intelligence building in AI ML and deep
learning uh going through and accounting
for aggregation and correlation like
you'd find in a traditional seam but
also building in automation that you're
starting to see with sore
platforms right and what's that next
level right we want to get there
hopefully that's not lost on on many
people uh but
right that is ultimately what we are
bringing to bear in the true foundation
of every single technology here at
checkpoint which is the threat Cloud
right every single one of these
capabilities from being able to provide
intelligence and enrichment
intelligence-driven enrichment AI
functionality doing real real time
inline aggregation and correlation and
automation all of that is purpose-built
into the solution for from threat Cloud
now threat Cloud it's this crazy crazy
thing it's I could do an hour on threat
Cloud alone but just take this for
example 83 different data Lakes make up
the checkpoint threat Cloud today and
that consists of 86 billion daily
transactions coming into the threat
Cloud Quick question anybody have an
idea how much excuse me how many
transactions Google averages per day
just
ballpark 5.7 to 5.8 billion per day how
many do we have again 86 billion 86
billion transactions a day a lot of you
probably heard of this down on the booth
there that's broken down across 150,000
networks that we operate in from the
largest nations to small Nations to smbs
across 100,000 different customers so
scale matters here it really does and it
ties back into what you were saying
about the depth of it it's not just the
Endo it's everything it's mobile devices
it's Cloud it's everything so that's
that's the size of the threat cloud or
the data Lake you're walking in makes a
difference absolutely so how does that
all kind of look in terms of MDR
bringing this back to MDR what do we do
what is our life cycle right that's
that's actually important if you're
going to talk to somebody about MDR you
need to understand their life cycle so
we're going to get events from your
security stack and all of this is
actually apid driven we have some
exceptions in there for instances where
a product doesn't actually have a usable
able API but we prefer to go via API
with your security stack that gives us a
lot of agility and you a lot of control
now we pull all that data into the MDR
platform which actually has a
purpose-built uh system behind it that
accounts for all these things that we
were just talking
about we have our customer dashboard we
have our analysts that are constantly on
it and of course live inline enrichment
through the threat Cloud I know it looks
like it's off the top there but is a
inline process that occurs before these
things even reach the Analyst at
checkpoint and that's what we have for
you guys any questions open discussion
we're going to start tearing it down as
we go because we want to respect our
next vendor but seriously what do you
guys think not too bad you saw what
happened up here on the screen right
awesome um congratulations Brian I'm
expecting a nice dinner after you
getting paid for that um what questions
do we got well my boys are breaking it
down what questions you guys have about
this have you guys seen live ransomware
launch that actually worked thank god um
anybody seen this before yeah go
ahead so the question was about um what
different levels of of incident response
do you basically have so at checkpoint
depending on the size of the
organization it's the same team right uh
Diamond customers customers that are at
the the paying the highest level they
get a certain uh SLA 4 hours whatever it
is our customers that are SMB customers
that that might be really small
customers they still are working with
that team they have that level of
response and again the size of the
customer doesn't matter to us they have
access to their portal they can see the
interaction they can see the alerts I
have a bank in Central South Dakota with
28 customer or 28 employees they have
the exact same level of support and
response times as
3M that's the difference between us and
a lot of other organizations thank you
for the question any other questions you
guys on
that great question so what's that split
between IRT checkpoints IRT and um
working with the on Prem team it is
actually completely up to the end point
the end user the customer some
organizations are like no no no no I got
two and a half people they're dealing
with a bunch of other garbage I ain't
got time for it checkpoint you have
access to everything go nuts the other
side of it with typically larger
organizations they're like okay let us
know there's a chain of command there's
a process playbooks please tell me you
guys have all done some play booking um
how do we exercise those tabletop
exercises do that so many people have
not or so many organizations have not
respectfully done a tabletop exercise
you know they looked at it on a
whiteboard and they're like that'll work
next thing you know something hits a
face fan and oh crap where'd that book
go so the way that we try to do it is
with each and every customer our our MDR
team our IR team um they work with that
customer and say Hey how do you want to
do how do you envision this and if we've
had this happen where customers will be
like you just email us we'll handle it
all okay we're emailing you because it
probably didn't get handled the first
time maybe we want to do a little more
than that if you know what I mean but we
always try to customize it based on what
the needs of that organization are again
great question thank you how we looking
boys pretty much good we can get out of
the way here pretty quick for those guys
okay um we you guys know where our table
is hard to miss us we're giving away in
Atari if you haven't signed up I don't
know why you have
problems thank you Christina I mean
let's be honest that makes it more
awesome
[Music]
so so thank you for coming everyone I I
really do appreciate it uh because of
the time that we had available today uh
in this presentation we weren't able to
show the MDR side what the MDR analyst
see what the customer see but if you
come down to the booth we're going to
continue to track this event through uh
and we actually have one of our MDR
analysts here today who will actually
help talk through this whole process
we'll actually have the uh customer
portal uh available for uh everybody to
look at interact with as well awesome
thanks okay so thanks everybody hope you
guys have a great one come on down check
us out we'll talk to you guys
[Applause]
soon