Network Intelligence Unleashed Turn Traffic into Actionable Threat Insights with Fortinet

So, um, I'm gonna talk a little bit about, uh, another source of information that we, that we have that a lot of times doesn't get utilized, at least in the public cloud. And so that's our network intelligence. As we saw pretty, pretty quickly at the beginning, Julian was able to bypass, you know, our perimeter defenses, which weren't really, we didn't have very many in this environment, but attackers regularly do by bypass those perimeter defenses.

And so what happens once they're inside? And so we did get a lot of great information, uh, from four to CA, and he was able to pass along some, uh, some ideas about a threat that we might be having. So we're gonna, we're gonna go and look at the demo, uh, our demo environment if we have time, uh, and see kind of what we found in that environment.

So, but really quickly, um, I wanna talk about what for to NDR is, and I'll kind of breeze through this. Um, we, we, we use, uh, AI and ml, um, foundationally to identify anomalies, to identify malware and some other things that I'm gonna really briefly cover. And so, um, the idea being that, uh, we're gonna ingest data, uh, as you can see, we've got on this slide, we've got, uh, data ingested through hardware and virtual appliances, and you're like, well, this is cloud field day.

And, um, so I would argue that, um, you know, one of the things about Fortinet, we, 86% of our customer base is actually hybrid cloud. And so when I say hybrid cloud, I mean, you know, they've got some on-prem data center, they've also got some cloud estate, um, and they're trying to secure all of that, right? And so we are in able to ingest traffic information from all of those sources and see whether, you know, in, in the case of somebody like Julian, maybe he was able to move to our on-prem data center or to, to some protected resource that we might not otherwise have seen.

And so the idea is we take in this unanalyzed data, this raw data, uh, we send it first to determine, is this an anomaly? Is this traffic, uh, is this a pattern that we've seen before? Is this an endpoint that's never communicated with the network?

Is this a, a, a port or a protocol that we're not accustomed to? Um, and so we can then classify those as either benign, known, malicious, or suspicious. So anything that's known, malicious, we, we flag immediately.

Um, anything that's suspicious, we send for more, um, uh, learn, uh, for more analysis, right? So, again, one of the things that Fortinet is really good at, a, Aiden talked about it at the beginning. We have a lot of data.

And so our threat models are well-trained. Uh, so we, we are very good at identifying what, you know, what is malicious versus what is benign. And so, um, that that next step sort of happens, we give that feedback to the user, and then the user can actually say, you know, can, can feed back into that loop, Hey, this is or is not actually a, a, a malicious intent, or this is actually, we see this, it's benign.

We also can use, um, a gradient boosted decision trees for, um, detecting a web shell. And as we saw, a web shell is just a, a piece of malicious code that attack an attacker can Put on your machine to take control and do other malicious things. Uh, uh, domain generation algorithms is, is another thing.

We didn't use this in this demo, but oftentimes, uh, and, and you're gonna see it's gonna be pretty easy. We're gonna block the IP address that Julian's coming from. Um, in, in a, in a live situation with a more sophisticated attacker, we would have, um, you know, they would use a domain generation algorithms.

So they're kind of creating, uh, semi-random domains, uh, that the, the application is calling out to. And eventually one of those will resolve, uh, to a command and control server. And so that makes it a little more difficult to actually block that traffic.

But with, um, for the NDR, we can actually, using deep neural networks, we can actually identify those patterns and spot that, uh, type of traffic and those malicious users. And finally, from, from an ML perspective, um, we've got, we, we are getting malware, uh, sorry, uh, files from the wire. We're either getting it from the wire, we're getting it from other sources.

And I'm gonna talk a little bit about where, where we get those sources on the network. Um, but when we take in a file, we unpack it, and part of our, the magic, I'm gonna, I'm gonna hold up air quotes. Part of the magic that Fortinet is doing comes from our years of experience actually with unpacking malware.

And so that's part of what you get. So we unpack it, we feed that file directly into an AV engine, and that's signature based. Um, if it flags hot on a signature that we know about, well immediately we're gonna call that, uh, an an an alert, right?

Um, but if it doesn't, then we're gonna send it through, um, this, uh, our parsers, depending on what kind of file it is, we're gonna send it to a text parser or a disassembler, and we're gonna break that down into code blocks. Uh, and, and you can see here the average is 3000. Um, we also, you know, we see 'em as as much as as large as 5,000 code blocks, and we feed those code blocks into our artificial neural network within Florida NDR.

And we're, we're looking for patterns. So we're looking for, um, you know, is is there a downloader, is there a Trojan, is there some, you know, is this, does this look like it could have something to do with ransomware? And so we, we sort of prioritize those matches and then, uh, we figure out how many of them we get within that code block and we make a decision.

Is this in fact, uh, malicious or is it a clean file? Um, it, so I wanna talk a little bit about data ingest. So today we're talking about public cloud.

Um, we are in AWS, uh, again, our customers are hybrid cloud, and that could mean private data center, but that could mean multiple public clouds as well. Um, and so the ability to cover all of those, those attack surfaces, uh, is, is useful. So we, we cover AWS Azure and Google, again, our users are in private cloud.

So we, we have, uh, sensors for the, the, uh, most popular hypervisors. So you can see Hyper VKVM and ESXI. Uh, and we also have just standard network sensors, right?

We can actually, um, NFS mount to your storage environment. SMB as well, we can serve as an ICAP server. Um, but we, you can see also, we also have, can use other pieces of the Fortinet security fabric.

And this is not a sales pitch, but, you know, um, oftentimes our users, uh, users come to us. They already are FortiGate customers. And so this is a really quick integration that we can do to get more data into forta NDR to identify those attacks for Mayo Forta Sandbox as well.

And then we also have a physical appliance that you can plug into your, to your switched network if you want. From an enrichment perspective, we can pull data from, uh, our four own four to EDR platform. So if we have a, an endpoint that we see doing, you know, trying to do some malicious things, we can pull that data in.

Same thing with CrowdStrike. We know that not all of our customers are in a greenfield, uh, of Fortinet field. Um, so we, we do have some third party integrations with other products, uh, CrowdStrike being one of those, and then active Directory.

From there, we can gain information about the end points themselves. Sorry, I'm kind of rushing through this here. Um, once we've, once we've done the, uh, once we've gathered all that data, we do the attack identification.

And the first thing, this is our little forti guard labs, um, shield. And again, uh, we're using our signatures as well as our content pattern recognition, uh, and all of these other features from Forti Guard to identify these threats. But we also realize that hey, there are a lot of, uh, other people in the industry that are watching these things.

And so we pull in third party feeds as well. Um, and that you can see we use virus total and then, uh, the, uh, cyber threat intelligence from the Cyber Threat Alliance. And so that's an organization of, of cloud vendors that actually, or security vendors that actually share threat intelligence among each other.

'cause at the end of the day, the idea is to make the world a bit more secure. So now we come to the response portion of this. Um, we have these, the ability to remediate.

And so you can see a lot of these are part pieces of our security fabric. So we have the FortiGate, um, which is, you know, our next gen firewall. Many of our customers that are data center customers that move into the cloud actually do deploy for Gates, uh, for that outbound security, for their, for their cloud infrastructure.

If they have that in place, we can actually automatically block based on the threats we find in Ford. NDR, um, for inac is more for, you know, our customers with their own, uh, physical on-prem data centers. And then for Switch as well, for Soar is really our pivot point into the outside world.

And, and that's what you're gonna see, um, with, when Julian pops up here, I'm gonna give him, I'm gonna go really quickly here so he can pop up and show you the mitigation. So if there's an API, uh, chances are for Assor can integrate with it, and we can do, you know, we can enrich our data, we can do mitigation, uh, uh, and whatever ever other things we want to do with that. So, uh, from an escalate perspective, again, Part of the response, we integrate with our own sim, our own four to analyzer, but we also integrate with, uh, cortex and Splunk, again, in deference to the fact that, you know, we're not alone in the world of security.

Uh, and finally, um, the, I'm gonna go through this really quickly. Um, the, the way we're getting traffic in this particular environment, this is a cloud only. We have a, uh, Ford NDR deployed on the left into what I call a services VPC.

Um, and we have a VPC peering connection between those. So traffic comes in, hits our internet gateway, hits our load balancer is then forwarded to our T three instances. And I, I bring up the instance type because, um, we're actually using, uh, traffic mirroring, uh, in, in AWS to get the traffic into Florida NDR.

And so not all instance types can support that. So if we're gonna use this solution, we do need an instance type that supports mirroring. So we create a mirror session and we send that traffic to our load balancer, which is in our services VPC.

That traffic is then sent to the sniff report on Ford, NDR.