netwrix auditor deep dive€¦ · netwrix auditor deep dive how to secure your cisco and fortinet...

14
Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers

Upload: others

Post on 28-Jun-2020

35 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

Netwrix Auditor

DeepDiveHow to Secure Your Cisco and

Fortinet Devices from Attackers

Page 2: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

Welcome

Netwrix Solutions Engineer

Email: [email protected]

Roy Lopez

Page 3: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

Top 5 Network Device Incidents

Briefly about Netwrix

Netwrix Auditor for Network Devices

Q&A

Agenda

Page 4: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

#1: Configuration Changes

Protocols, ports and connection limits

Modifications of Group Policy

New users or groups

Page 5: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

#2: Repeated Failed Logon Attempts

• Successful logons to network devices

are they fully authorized?

• Multiple failed logon attempts

Is someone trying to brute-force administrative credentials?

Page 6: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

#3: VPN Logon Attempts

• Who tried to access network devices over a VPN?

• Which IP address was the authentication attempt made from?

• What was the cause of each failed VPN logon?

• When was each VPN logon attempt initiated?

• What device was the user attempting to log on to?

Page 7: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

#4: Hardware Malfunctions

Underperfomance Complete shutdown

Page 8: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

#5: Scanning Threats

• Which host and subnet were scanned?

• When was each scanning attempt performed?

• Which IP address was the scanning initiated from?

• How many scanning attempts were made from each IP address?

Page 9: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

About Netwrix Auditor

Netwrix Auditor is an agentless data security platform that empowers organizations to accurately identify

sensitive, regulated and mission-critical information and apply access controls consistently, regardless of

where the information is stored.

It enables them to minimize the risk of data breaches and ensure regulatory compliance by proactively

reducing the exposure of sensitive data and promptly detecting policy violations and suspicious user behavior.

Netwrix Auditor

Page 10: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

“Swiss Army Knife” for Visibility Across the Entire IT

Active DirectoryWindows File Servers

Oracle Database

Dell EMC SQL Server

Exchange

NetApp

Office 365

SharePoint sMySQLOpenTextContent Suite

WebsitesPostgreSQL

Box

Salesforce

Google Drive

Windows Server

VMware

Network Devices

Azure AD

Nutanix Files

Audit

Data Discovery and Classification

Page 11: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

Netwrix Auditor for Network Devices

Page 12: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

Demonstration

Netwrix Auditor

Page 14: Netwrix Auditor Deep Dive€¦ · Netwrix Auditor Deep Dive How to Secure Your Cisco and Fortinet Devices from Attackers. Welcome ... New users or groups #2: Repeated Failed Logon

Thank You!

www. .com

Questions?

Roy Lopez

Solutions Engineer