We use cookies to personalize content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services.
Some of the data collected by this provider is for the purposes of personalization and measuring advertising effectiveness.
Some of the data collected by this provider is for the purposes of personalization and measuring advertising effectiveness.
We do not use cookies of this type.
Okay. Great.
We are live.
Awesome.
So, you know, hello. Good morning. Good evening. Good afternoon. My name is Wyatt, and I am the product marketing manager here at DeepInStinct.
I wanted to thank you all for joining us, on this Wednesday as we gear up for the winter holidays.
It's been a super exciting year for us here at DeepInStinct, and we're really happy to finish out strong with this webinar.
Joining me today are our presenters, David Tregano, Deep Instinct's director of product management, and Amit Yanev, our principal product manager for DSX for cloud and DSX for NAS.
Additionally, Brian Black, our VP of global sales engineering, is going to join, to answer questions at the end of the webinar.
So feel free to leave your questions in chat, and we will get to them. Make sure that you have all the information you need.
I'm gonna briefly cover today's agenda, and then I'm gonna turn the floor over to David, for what is gonna be an exciting webinar.
Starting out, we're going to talk about the failure of legacy tools, especially in the current moment.
We're gonna get an interesting demo on the rise of dark AI.
We're then going to transition over to DSX for cloud, Amazon s three, newly released, integrated, and available on the AWS marketplace.
And we're going to give you a demo of DSX for cloud before wrapping up with a q and a.
So, again, leave your questions in the chat, and let me turn it over to David Trigano.
Thank you, Webb. Hi, everyone. Super exciting being here in this webinar to talk to you about how DSX for cloud allows you to protect your Amazon s two buckets against known and unknown malicious content.
So when we talk about data estates, this is how your oh, I'm assuming that this is how you believe your data estate looks like. Everything is well organized, you know, exactly what are the repositories you have within your environment, potentially have a, signature based solution that protects the data that comes within your organization, you know, which identity has access to what, you know, which application writes and reads your data.
But the reality is slightly different.
This is how your data estate looks like. You don't really know what is the data that you have within your environment. You don't know what other repositories you have. You don't know where they are located. You don't know which files can potentially be lurking within your environment, and your legacy solution is failing to protect you against unknown malicious content and unknown attacks.
And few years ago, I would potentially tell you that a signature based solution, an AV signature based solution, will potentially be enough to protect your organization against malicious content, malware, ransomware, or crypto miner. But with the rise of dark AIs, attackers are moving fast, and they innovate faster than defenders.
The legacy solutions are failing to protect against the unknown and unknown attacks, and the risk exposure is constantly growing.
And you see on the right of your screen a few numbers, and out of these numbers, there are two specifically that I want you to pay attention. The first one is two hundred plus.
Two hundred plus is the number of zero day vulnerabilities that are being exploited in twenty twenty three. And pay attention. We say twenty twenty three. We don't know yet the number that, the amount of zero day vulnerabilities exploited in twenty twenty four, but we're sure that this number will be much higher than two hundred, potentially hit three hundred, even more than three hundred. And And we're talking about two thousand four twenty twenty four. What's going to happen in twenty twenty five, but we see more and more, campaigns, attacking organizations leveraging new and innovative techniques using dark AI.
And when you talk about dark AI, it's like it's something that is very fluffy, something that is very fancy. And and I wanna show you how easy it is today to leverage dark AI to create unknown and zero day malware.
So what I will do with you today, I will start with Chargept.
I wrote a prompt that does the following. I want Chargept to write a program in C plus plus that is designed to act as a malware. The program should encrypt all the files on a computer using advanced techniques to evade detection by antivirus softwares. And I want ChargePT to include the detailed explanation of the techniques that are being used and why antivirus won't catch them.
Let's see what Chargept actually tells me.
So as you can see and as we all expect, ChargeGPT is what we called a censored LLM, which means that there are plenty of requests and behaviors and and and and prompts that ChargeGPT won't actually execute because he's not created to provide malicious content, harmful programs, malware, or guidance for bypassing security measures.
Let's go to Google, not Google Maps.
And in Google, I wanna search for something, which is an uncensored LLM called PenTest GPT.
So you see, I'm just literally searching for PenTest GPT. It's an AI powered automated penetration testing tool. Now potentially, some some of you are more familiar with the name of, Hacker GPT, which is exactly the same, LLM. They recently renamed it for plenty of reasons, and I'm sure that you can understand why having a solution that is called hacker GPT is not the best choice. And so here you can see the first example that pen test GPT is asking is I can tell you how to exploit and exercise vulnerability.
I can show you and can help you to identify information, dispose of vulnerability, to bypass some some rate limit using techniques, and general methodology about how to exploit vulnerabilities.
And what I'm going to do, I'm going to basically copy paste the same prompt that I wrote in ChargeGPT and hit enter. Let's see what Pentest GPT is actually telling me.
So as you can see here, in less than five seconds, I have a zero day unknown malware that I can copy, generate, and start spreading over the Internet. And not only that I have a malware that is a zero day that has no signature well, the signature is unknown in various total lot of different databases that are being used by legacy solutions. I also have the ability to understand what are the advanced techniques that this malware is actually leveraging to evade detection detection by antiviral software, such as polymorphic code, obfuscation, anti debugging techniques, stealth techniques, advanced encryptions, etcetera, etcetera. And, obviously, I have the explanation. And if we want, we can even continue the generation. And as you see, I was just using Google dot com.
Another website that I want you to pay attention to is a website that is called Huggins Face. Huggins Face is the AI community, one of the biggest, if not their biggest community where organizations and anybody can share models and datasets for AI, machine learning, and large model, so LLM. And so what we're going to search, we're going to search for uncensored.
And what you can see here is that it has more than one thousand uncensored model is that anybody can actually download and then generate a lot of different content. And so you can see here llama three, which is the meta model, which is, which means that you can basically implement within your organization and then start asking these LLM questions such as, please help me to create a program in c plus plus that is designed to act like a malware. And pay attention to the amount of downloads just the last month. And this is one out of more than one thousand models that is being available in Hugging Face.
And I just showed you HUGGPT or PentaxGPT, but there are plenty of other LLMs and plenty of other uncensored LLMs that are available. Warm GPT, Freedom GPT, Poison GPT, Stopwatch AI, or Lama, which is an open source tool to run an unrestricted LLM to download these unrestricted LLM and and sensor LLM. And please note that most of them, as you just saw in this demo, can be found on Google and on Hugging Face.
Let's move on to another part of the problem and and why legacy solutions are failing today to protect your organization against new techniques and malware that are unknown and zero day malware.
So our security team took a a a malware that is currently, being, published in VirusTotal.
For those of you who are not who are not familiar with VirusTotal, this is a website that has been, acquired by Google that centralized all the malicious content. It provides the the the malware themselves, and it allows any vendor on the market that provides an antiviral solution to upload their engine and to scan those files. And so we have in various total today sixty two AV solutions. Some of them are scanning.
Some of them are not scanning. But you see, we we took here a malicious file that is called Medusa dot p I. And what we did, we basically went to an NSUN saw the LLM, and we asked that LLM to refactor this file, and we reupload that file into virus dot com. And where we before we had thirty out of sixty two, we now have twelve out of sixty sixty five, which means that we have fifty percent of the AV that now suddenly failed to identify this malicious content because it was a refacto.
And we push that all a little bit farther. We say, okay. Now that we refacto that file, let's obfuscate that file. And guess what?
Out of sixty five, we have only three antivirus solutions that basically found this file as being malicious. And, obviously, as you can, as you can imagine, out of these three solutions, Deep Instinct was one of them.
And by the way, we are not the only one talking about the urgency and the and the need of having a cyber storage or a solution to protect your cloud storage. Galatino themselves discussed about this terminology called cyber storage here in their last latest hype cycle for data protection technology, And they basically said that the Styro Storage actively defends storage system against cyberattack through prevention, early detection, and attack blocking. So it's not only about having the ability to find malicious content, but also being able to prevent this malicious content to do any damage within your organization.
And cyber storage is pretty vague. When we focus more on cloud storage and specifically Amazon s three buckets, we realized that this is an an an attendant attack surface. Why? Because most of organization today that are actually moving to the cloud think that the cloud vendors protect the cloud storage and also the integrity of the file that is being stored.
But let me tell you something. The reality is different. The cloud cloud vendors are not scanning the files when entering or when you or your organization are actually storing them. It could lead to high risk with a malware infected file that could be stored in your data estates.
And as you can see on the right, we have some examples, and we wanted to capture some examples of organizations who's been, breached using Amazon s three buckets. And these are just two examples. Invite you to open Google, search data leak or data breach on Amazon s three buckets, and you will see that on a weekly basis, more and more organization are being exploit and being attacked on the cloud storage.
And as I said a few minutes ago, legacy solutions are failing and insufficient to protect your cloud storage against zero day attacks. And as I said at the beginning, this is not us. Gartner is saying the exact same thing. In the latest hype cycle for storage and data protection technologies, few months ago, they said the following.
Traditional storage technologies like snapshot, and by the way, the this is not only about snapshot. It's about AV. It's about CDR. As a single answer for ransomware, it's inadequate to meet the new challenges faced by ransomware.
We talked about legacy AV. We talked about immutable backup. We talked about CDR, which are all insufficient because they are missing zero day attack. They are insufficient. They require frequent update, extremely, cost in terms of infrastructures.
The operation is very complex, and they do not protect against data exfiltration.
And to effectively protect your cloud, not only your cloud, your entire data estate against zero day attacks, DeepInspect provides a comprehensive zero day data security solution called data security x or DSX.
DSX provide you a comprehensive solution that protects your data estate across your NAS, cloud applications, SaaS, and endpoints.
DSX has two main core functionalities.
The first one was the DSX BRAIN, a deep learning framework that is purposely built for cybersecurity that allows you to, prevent known and unknown malicious content across your data.
And, obviously, we have also Diana, the d s six companion that helps your SOC analyst to perform malware analysis in a matter of seconds by giving you explainability using Gen AI for unknown threats.
In today's sessions, we're gonna focus on cloud. And for this, I want to invite Amit to talk to you more about DSX for cloud Amazon s two.
Thank you, David.
So, yeah, as David mentioned, what we're gonna cover in the next few slides is the solution to the to the big challenge that we have, in front of us, which is, the whole thing of, dark AI and unknown zero days. And the solution for that is d s six for cloud, which provides zero day data security for Amazon f three buckets.
Now I would like to start by exploring the process, how to protect a file when it gets into an s three bucket. So what do you see here on the slide? On the left side, you see the users.
On the on the middle, you see the s three buckets themselves. And on the right side, you see the d six scanner, which is deployed on the AWS customer environment and run on top of an ECS cluster.
So the user it starts by the user uploading a file to an s three bucket. It can be done either directly or indirectly through an application.
Then the notification which results from this operation is forwarded to the, to the d six scanner.
The d six scanner then reads the file from the f three bucket and using d six brain, scan the file within less than twenty milliseconds.
D six brain, as David explained, contains deep learning AI models.
Now it based on the scanning, it provides a verdict whether it's malicious or benign. If the file is benign, then it is tagged appropriately.
And, also, the scan result is logged is logged into CloudWatch.
However however, if the file is malicious, it is quarantined in addition to the tagging and the CloudWatch log.
Now in today's environments, when dark AI and unknown zero day attacks, as explained deeply by David, have become the norm, the task of malware investigation by SOC teams becomes much more complex.
And for that, we've introduced d s six companion, which is also known as Diana, which can provide in a matter of seconds using generic UI full malware explainability, and by that, make the task of malware investigation much easier for the SOC analyst.
After covering the flow of how files how to protect files when they enter s three buckets, I would like to show you the value proposition of DSX for cloud.
So, primarily, it provides zero day attack prevention in real time using DSX frame.
It does it with high efficacy of more than ninety nine percent and low false positive rate of less than zero point one percent for both known and unknown attacks, and it does it much better than any other vendor in the market.
Using d six companion, the task of malware investigation is much easier now.
The throughput is high with a verdict of, less than twenty milliseconds per file, and the throughput itself goes above one gigabyte per second. And as a result, this the right of the speed of scan, the infrastructure which is required is low and results with overall low total cost of ownership.
Now yeah. So deploying this fast and can be configured in minutes.
And the privacy is data privacy is insured because the files never leave the customer environment.
And, another important value proposition is the d six brain updates, which up which occurs not more than twice a year. And this, eliminates the need for continuous full scan of the storage, which is required for legacy AV solution that rely on daily signature updates.
And all of that is certified by AWS, and the solution is also available in the marketplace.
Now, with that, I would like to move to the features and functionalities of d s six for Cloud.
With regard to deployment and scale, as mentioned, deployment is fast and easy and is done using CloudFormation template. Solution supports multiple accounts and regions and, support any scale using auto scaling.
With regard to bucket protection, so we have a, there is bucket automatic discovery, cross regions and accounts.
And once there is a list of all, of all the buckets in front of the user, it can now decide which buckets to enable first and which buckets to enable on a later stage.
Now it supports also event based scan as as we saw before, meaning file it will scan files that enter, the buckets. And if needed, there is also, the ability to to define security policy per bucket.
Now with regard to remediation, it's possible to quarantine a file, delete a file. And and if a file that was quarantined appears to be a false positive, it's also possible to restore from quarantine to its original location.
From security perspective, so all file types are supported.
And with regard to a large file, it supports up to one terabyte per single file and fifty gigabyte per archive file.
And with regard to integrations, so as mentioned, so all scan result, whether they're benign or malicious, are logged into CloudWatch, and there is also a REST API support for all the operation operations in the management console.
And with that, I would like to move to a demo, in which I'm gonna show you the power of d s six for cloud and its main benefits detecting and protect and and preventing from unknown malware to get into, your f three buckets.
But before we start, I would like to show you, the behavior of a malware that was detected by a research team in the wild. In this case, it's a ransomware.
So it starts by I first want to verify that the this malware is really unknown. So I'll take the hash of the file. I'll go to virus total, and I'll check for whether it exists. And it seems it's we see that it's unrecognized.
Then let's go back to the Windows machine and run the malware. We will see in a few seconds that all the files are encrypted, and it's also followed by a ransom note.
Now let's see how d six for cloud, Amazon s three can handle such an unknown ransomware.
We'll start from the management console.
What we can see here is the logical representative of the d six scanner deployed in the management sorry, in the AWS customer environment. Under protected storage, we see, full bucket discovery cross regions and accounts.
Here, there are only two. Let's enable protection for one of them and move to the AWS console. We see the two buckets in front of us. And let's start by uploading a benign file to the bucket that we just enabled protection for.
Immediately upon upload, the file is scanned by d s six four Cloud. And if we look at the file metadata, we can see that it is tagged b nine.
Now let's do let's upload the unknown ransomware that we saw before to the same bucket, and we will do that by copying it from a different bucket.
Again, immediately upon upload, the the file is scanned by g s six four cloud. And in this case, because it's malicious, it put in a restricted prefix, so other users cannot access it. And if we look at the file metadata, we can see that it is tagged malicious.
Now let's go back to the management console and review the security event resulted out of this malicious file.
We can see that the threat type is ransomware. We can also see the event description and other security related details to the malicious file.
Let's also double check-in VirusTotal that this file is still unrecognized.
Now let's say I'm a SOC analyst and I would like to investigate this unknown elsewhere.
The way to do it is through Diana, the d six companion companion that we mentioned also earlier.
The analyst can simply go to the management console, upload the file, and in a matter of seconds using generative AI can get full detailed explainability about this unknown ransomware.
And by that, the task that usually takes two hours or more can be completed in a matter of minutes.
And with that, I would like to go and summarize the discussion that we just had. So it start we we started discussing that existing solution failed to protect against Gen AI zero day attacks, mainly because they rely on signatures.
We we saw that d six is the only solution that provides zero day data security using its unique d six brain technology.
Now d six for cloud Amazon s three provides the following, real time prevention and explainability of known and unknown malware, including ransomware.
The the scanning throughput is high, as mentioned, and, the the with verdigal of less than twenty milliseconds per file, which also leads to low total cost of ownership.
The deployment is fast and easy.
And, also, as mentioned, the data your data privacy is ensured because the files never leave the customer environment.
And the solution, as I also specified earlier, is available in the AWS marketplace.
And with that, I would like to hand over to Brian so he can go through the questions and answer.
Very good. Thank you very much.
So we do have some questions coming in, which I'm always delighted to see. First, I wanna answer. It looks like is is DSX Cloud available in any region, and do we support multi region implement implementations?
Yes and yes. So that won't be a problem. Anywhere that you have the necessary data that you want to make sure that we protect in region and theater, we'll be able to accommodate you there.
Here's a good question that came. I really like this question.
Could the cloud providers be regulated to mandatory install EDR services, like DeepInStink?
Or or could cloud data users be protected from dark AI zero day attacks? The short answer is, I hope so. I don't know if that's in the works or if that's something that, compliance organizations are working towards in terms of, regulation.
But obviously, making sure that we have this type of coverage is really important. But we also have to be careful who would qualify for this. Cloud environments can be a little bit tricky, and this is why DeepInStink tend to excel here. It's because of our speed and our efficacy.
But also the fact that we're not doing a lot of, or any really, processing outside of your world.
Everything is going to take place within your direct environment. With many of the large EDR vendors that we see today, they have massive external, cloud environments that they're going to send data to in order to do the processing that they need to do to detect what they what they can detect. So that can be a little challenging, especially from not just a, architecture perspective, but from a cost perspective as well.
Got some other questions coming in.
This is a question that is pretty common.
Most of our presentations and and presentations that I've done are, or sessions that I've done with customers. This tends to come up a lot.
If the brain is only updated twice a year, how can you keep up with the threat landscape? Great question. Because it stands to reason. That's logical.
Right? When a brand new threat comes out, almost by definition, cybersecurity tools should not be able to detect it. There's no hash available. There's no signature available.
So how could we really do that? This is where deep learning is fundamentally different from every other type of, AI implementation or or really traditional machine learning implementation.
Whereas, deep learning understands its world around it contextually based upon how it was trained.
So the example I give all the time that I I is very, is very similar to how DeepInsync works is picture a self driving car that's been on the road, same road a hundred times.
But but today, it goes around a corner that it's familiar with, and there's a tree across the road. That's a zero day tree. Now the computer can't get updated with that tree. It can't take a picture of that tree and send it up to a training model or, in order to have it retrain and then get the information. That car has to make millisecond decisions in order to keep its passengers safe.
But because self driving cars are powered by deep learning, they're able to do that. They're able to look at a brand new event, a zero day event, determine what it is, and how they should best proceed. And this is something that DeepInSync does as well. Our deep learning models, that is what they do for our customers. When a brand new zero day comes in, they're going to take a look. The artificial brain's going to take a look at it and say, I may not have been trained on this one specifically, but I've been trained on hundreds of millions of pieces of malware.
And as a result, I know that this is malicious. I may not know its name or where it came from, but I know that it's malicious. And it's going to do that with an efficacy, you know, greater than ninety nine percent on on zero days. So that's a huge advantage that we have in that perspective.
And, our last question here is, do you protect AWS's other cloud storage offerings? Yes. We do.
So depending on the type of, architecture you have, and if you're dealing with something like, SFX, NetApp, or ONTAP, or or what have you, we'll be able to protect that as well. So DeepInSync is going to be able to cover the necessary use cases that that you have there.
Oh, one just popped up. So since I've got a little bit of time, I'm gonna take this one.
Do you have zero day exploit numbers for years before twenty twenty three? And when do you expect to have the twenty twenty four numbers? Yes. We do. Certainly. These are tracked not only by Deep Instinct, but by a number of organizations, within a very small percentage point of each other, essentially.
So as a result, we do have though that zero day knowledge going back. Twenty twenty four, most organizations, both ourselves and other cybersecurity companies, will begin to, compile that within the first quarter, probably within the first two months when the the final public bits of information start coming out.
And I love the fact that they just keep coming.
Not to be cavalier here. I like that, but millisecond response. What about microsecond response? Is that possible?
That's that's tough. Obviously, is it possible? Of course. I mean, just a few years ago, millisecond response wasn't wasn't possible.
So we'll be able to, get faster and faster over time. Hopefully, the whole cybersecurity industry gets faster over time because the threat actors certainly are. So is it possible? We never wanna rule it out with with technology advancements.
But is it possible right now? Well, we're limited to things such as disk rate speed, RAM access time, and how much utilization that the RAM or the CPU is currently under. So possible? Sure.
If not now, then then soon. And and if not soon, then almost soon. But right now, it can be very challenging just due to the architecture of the Internet.
So I'm gonna pause there. Wyatt, is there if there's anything else that, you'd like to discuss, I, I think that's our our questions.
Actually, one more, came in from, Nakanishi Hiroaki.
Oh, I apologize.
Are safety measures to avoid unrelenting detection of cloud users' data in deep learning AI program? Yes. So I got this. I got the question.
Yes. In short, it is. The technology itself doesn't really care about content at at all. So as a result, what content is in the particular data is not something that we're going to look at or or really even care too much about.
So as a result, we're only looking for those bit markers that are of a malicious nature. So anyone sensitive or proprietary information is not something that we examine, look at, or anything else.
Alright. And I think that that is it. So, I wanted to thank you all for joining us once again.
Thanks for coming here on this Wednesday. I hope that you all have a wonderful afternoon, evening, morning. If you have any more questions, feel free to reach out to us at deep instinct dot com slash contact us, and we will be able to answer those questions, show you a little bit more about the platform, whatever you'd like to do. So thank you once again. I hope you all have a great day. Look forward to a recording of this email of this webinar in your email inboxes.
Bye.