深信服：云网端安全托管服务的创新实践报告（28页）.pdf

1、?BG?DIRECTORYDIRECTORY010203?-?04?2021?3?REvil?5000?500?尼?20182018?1212?1988?0day?0day?2020-2022?From?IBM?Threat?Intelligence?Index?2023?研2018-2022?研?务?务?！?务?够?够?5G5G?研?研?研?PC?务?73%?60%?42%?30%?28%?Devolutions?2021-2022?务?1 1?0 0dayday?2 2?+?1 1?2 2?1 1?2 2?！?！?3 3?呢?呢?-?呢?呢?-?务?务?封?封?务?封?2021?务?83%

2、?2019?74%?IDCIDC?IT?CISOCISO?73%73%?MDR?/?ESGESG?告?7*24?！?！?！?！?！?LockBit.LockBit.?.?0day0day?.?2.02.0?研?研?/?7*24H7*24H?/?99%99%?100%100%?+?7*24H?！?！?AI?.?.?7*24H?！?！?+?AIAI?+?-?-?MSSMSS?7*24H?研研?封封的?的?SaaS?XDRSaaS?XDR?+?|?|?|?7*24H|?7*24H?+?|?|?p?pSaaS?XDR?E+N?+?usecase?/?p?+?pXDR+AF+EDR?p?AF?EDR?p

3、?+?7*24H?封?p?XDR?p?/?7*24H7*24H?/?SLASLA?WebShell?+?SAVE?WISE?IOC/IOA?AI?ATT&CKATT&CK?+?研?99%99%?E+NE+N?封?尼?99%99%?7 7*2424?封?封?7*24H?E+NE+N?E+N?研?100%100%?PortalPortal?IPS?WISE?Web?SAVE?AI?AV-TEST?top?+?l?l?0DAY?webshell?l?3936?1.8?URL?7.8?l?2000+Usecase?l5000+web?12000+?160?+?99%l?l?+?l?l70+?HW?l?

4、AF?EDR?CWPP?50+?l?2H?5?l?研?封?AFSaaS?XDR?MSS?EDREDREDREDREDREDR?EDREDR?模?AF?IPS?WAF?AF?EDRAF?EDR?l?AI?+?+?l?API?EDR?l?IP?+?l?l?AF?EDR?+?+?lMSS?AF+EDR?99%?TSS?web?模?模?EDR?务?IP?务?XDR?MSS?200+?IP?始?100+?+?+?+?200+?IT?2000+Usecase?+?500+SOAR?Playbook?7*24H?10?mins20-60?mins24?hour6?hour+XX?封?封?12 day?5?2

5、-4?6?2?10?70%5?30?10?mins?是否需要T2/T3协助是否需要线下员协助专家指导完成处置?程师上处置闭环?Playbook?天夜间节假特殊时期7*24H?1?2?3?4?5?SLA?SLA!#$%&()?Webshell?4?/?l?Usecase?Playbookl?/?100+?l?linux?/?封?5*8?7*24?l?l?7*24?！?封?l?！?！?封?l?IPS?WAF?l?！?HW?l?务?+?2?l?IP?ACL?l?&?/?-云化智能、省托管、效果敢承诺-席质量官能和质量部质量管理交付管理运营管理研发规划整体安全效果评价综合服务能评价户服务体验评价?7*

6、24H?7*24H服务，平均5分钟响应?/?/?/?+?99%?/?100%?30?99%?专属服务经理安全事件损失理赔（10300W）?5*8H分析研判?99%?定频次的应急?PS?5*8H?+?模?7*24H?99%?100%?5?！?！?1+12?+?7*24H*365?封?！?2?/?研?AI?IoT?SaaS?-?5Min-?客户专属服务经理T1志分析师客户服务经理T1现场服务程师T2事件溯源专家T2威胁狩猎专家T2安全漏洞专家T3Web应急专家T3病毒应急专家T3