TechTalk Summit 2022
Thomas Fuchs
Hello, my name is Thomas Fuchs, I'm an Account Executive here at Blackberry Cylance and I joined the team a little over six months ago. I would like to start our discussion with a screenshot from the dark side group chat. What is better to underline our prevention first cybersecurity strategy with them saying if you had your Cylance, you would have not been hit. So why did they say that?
When we think about prevention, then we do this and we probably realize. We go to our doctors for annual checks, repairing our cars to the car dealership for checks. And we also do this in our personal life. So why do we still rely so much on this reactive detect and respond paradigm that we've seen for over 20-years, Next Gen AV products and solutions such as EDR, and SDR. We all know that reactive strategies are expensive. It's not necessarily the software costs itself, it's a specially trained staff that is required to properly install, tune and operate, that dominates the budget. And in most cases, this is even in addition to the existing endpoint protection products.
Cybersecurity solutions today operate on the model of inodes non-malware, non-attack techniques and even non-attackers. Vendors collect samples, and indicators of compromise coming from the names in the news and from victims of the attacks. At some point, new signatures in EDR XDR rules are built and these become your problem.
And you must have systems in place to automatically update to test in tune to deploy these new signatures and rules. This entire process starts over with every new sample of malware, and we talk about like 4,000 each day, or a new attacker with new techniques gets discovered. Utilizing this reactive model forces us to deal with the after effects of a cyberattack.
In 2012, a company named Cylance was founded by McAfee employees, we knew that the only way to succeed against attackers is to predict their actions, and actively prevent them before they cause problems. After the 2019 acquisition of Cylance, Blackberry has started continuing this approach. And Blackberry has more patents in using AI to prevent cyberattacks than anyone else.
Let's take a look at this and on my initial statement from the dark side group chat. Without AI, everything is reactive, interpatient zero is required. In the case of the Colonial Pipeline attack, it begins on May 6. Then after five days of shutdown department resumes operation. The damage has already been done. On May 7, we tested the Cylance AI model in our current version of protect, and it prevented a large collection of dark side ransomware.
We did the same with our 2020, 2017, 2016 and all the way back to our model that was released in October 2015. BlackBerry customers were proactively protected from dark side for over 67-months, about five and a half years. We call this our predictive advantage. It is the amount of time our scientists say I can predict an attack before it occurs.
For Real, Conte, Revel [ph] we were able to realize the same impressive advantage. When you have a solution that is truly based in AI you can reallocate resources, you can remove many of the traditional resource distractions. You no longer need to burden your users and computers with constant updates. You don't ever have to impact your user productivity with recurrent scans because the new update has no signatures and must rescan every file on the system.
You also no longer need to make sure that every endpoint has constant and reliable internet connection. Every cybersecurity solution in the world today says they have AI, but if that solution also requires you to carry the baggage of their 20 plus years of bolted on technology like [indiscernible] signatures, sandboxing, heuristic rules and infrastructure then their AI it is not up to the task of keeping you safe.
Despite the results that show AV vendors continuing having 100% detection test after tests, in the real world, we find that traditional AV is about 30% to 40% effective at preventing zero day cyberattacks. This leaves a huge gap of 60% to 70% where industry analysts say the most important capability is instrumentation and visibility into events occur after the breach, also known as EDR.
In this traditional reactive approach, you need a stack of products in the prevention space and in the EDR space. Blackberry protected optics work together in the same console to provide better than 99% prevention and automatically having the forensic events and the data readily available if an attack slips through. And our call is BlackBerry to protect, our AI based pre execution prevention, and this is where the predictive advantage is realized.
Optics is all prevention first EDR product that uses AI based and behavioral rules to detect the response automatically within milliseconds, whether the device has internet connectivity or not. Like full tech optics can operate completely offline, when connected to the internet optics offers the longest forensic cloud storage in the industry up to 365 days.
With our prevention first strategy, the primary goal of optics is to prevent a breach even earlier in the attack kill chain. And the best way to see this is to go through a quick demonstration. You're going to see many different attack vectors with one single goal. The goal is to attack our system and to ransom our files. Can you switch to my second monitor?
What we see here is our victim's system. As you can see, there's no AV installed. But it's still an actual system, he has photos on the desktop and resume which is not likely not my one. So let's go to Google Chrome. And as you remember, I called my presentation, someone always clicks. And this is what we demonstrate here. I would like to log into my bank, I click on this banner. And that's a question to download Microsoft security update.
So I couldn't do that. I keep the file and try to install. And while I'm waiting and waiting, and wait, nothing seems to happen. But then you see that all the file types change and system get locked. In this situation, our system and our files got ransomed unfortunately.
Let's try the same thing with our protected system. You can see here that we have protect, let's try the same thing. By the way, we have the same resume here on the desktop, so let's try and open the same page again. Someone always clicks, someone to get access to their bank. On the banking you click on the banner, try to install the Microsoft update and keep it and open this e-file. And at this point it gets removed. It's not possible to execute this code to open this file as you can see in our console.
So let's go back and try a different protect vector. The privacy policy is available on this page. We downloaded it and tried to open the file. It's a doc file which is required to enable the macro, but even this one gets blocked by protect. It is called script control and prevents even disposal.
So let's try the last one. We have all the 2021 ransomware samples in our network life. I copy those ones to my desktop and try to open them. What happens now is protect stops it. Conte our site and while I'm doing this, the system also starts to run a load slow scan, we will see this in a few seconds. We'll see here inspecting. So every new file that gets copied to the computer to your system get scammed. Now you see inspecting. So this lowers your risk dramatically in getting ransoms and run into any problems.
Let's go back to our presentation. Just close this real quick. So sitting on top of both protect and optics, there's BlackBerry guard, best utilize your scarce resources and just stay focused on growing your business you couldn't BlackBerry completely manage the entire solution with guard. Guard is the ultimate cost saving solution where you and your staff are backed up by our award winning industry leading security experts, who constantly monitor and hand in your environment making sure that you are safe. Guard is also very flexible to meet your needs. You can use guard to augment your existing staff or to fill your gaps in staffing.
When it comes to key differentiators, then, there's actually a lot to talk about. But I would like to highlight only a couple. It is really simple to set up and use. We call it a set and forget management, there is no deployment training required to learn normal behavior. We also offer flexible deployment options that are included adding protector the existing EPP solution of renewal in EDR, even if optics provides EDR that you can continue using what you might have already had in place.
Our solutions are for the best performance in the industry. And lastly, all of it works 100% offline. And especially this feature is key for some industries, where our customers are, for example, oil and gas with limited Internet content connectivity on their offshore rigs and vessels.
BlackBerry provides the best prevention and the lowest TCO. And our customers love our solution because it allows them to dedicate their scarce resources that really matters, growing their own business. So prevention is possible and it can save more than you rent. That being said, I'd like to close my presentation with challenging you of this, take your existing EPP solution a week and month, a year out of date and test it against new malware samples. Do you think you would get the same results as BlackBerry over the five years out of day? Thank you. |
