Cisco Customer Education How to Detect and Defend Against Today's Security Threats This session was recorded via Cisco WebEx! You can watch the live session recording via the following URL: https://acecloud.webex.com/acecloud/lsr.php?RCID =2a9e13dcb37a4721b5c9fc97052488bb Thanks for your interest and participation! This session was recorded via Cisco WebEx! You can watch the live session recording via the following URL: https://acecloud.webex.com/acecloud/lsr.php?RCID=a95525 d3a4d94e6887d6edc67ddd0e24
Transcript
Cisco Customer Education How to Detect and Defend Against Today's Security Threats
This session was recorded via Cisco WebEx! You can watch the live session recording via the following URL:
It’s All About The Money Industrial Hackers Are Making Big Money with Innovative Tactics
1990 1995 2000 2005 2010 2015 2020
Viruses 1990–2000
Worms 2000–2005
Spyware and Rootkits 2005–Today
APTs Cyberware Today +
Phishing, Low Sophistication Hacking Becomes
an Industry Sophisticated Attacks, Complex Landscape
of large companies targeted by malicious traffic 95% of organizations interacted
with websites hosting malware 100% 1. Cybercrime is lucrative, barrier to entry is low 2. Hackers are smarter and have the resources to compromise your organization 3. Malware is extremely sophisticated and complex 4. Cybercrime is now a formal, for-profit industry
100 days - Source: 2016 Cisco Annual Security Report
Cisco Security Decreases Time to Detection
37
Cisco Security Decreases Time to Detection
38
100 days to 17.5 hours - Source: 2016 Cisco Annual Security Report
Point in Time Protection
Point-in-Time Detection AMP Delivers the First Line of Defense, Blocking Known and Emerging Threats with Point-in-Time Defenses
One-to-one signature
Fuzzy finger-printing
Machine learning
Advanced analytics
Static and dynamic analysis (sandboxing)
â
Offer better accuracy and dispositioning
Block known and emerging threats
Protect your business with no lag
Automatically stop as many threats as possible, known and unknown
Dynamic Analysis
Machine Learning
Fuzzy ger-printing
Advanced Analytics
Indications of Compromise
Device Flow Correlation
Behavioral Detection: Example Point-in-Time Detection Retrospective Security
Cisco Collective Security Intelligence
Collective Security Intelligence Cloud
File of unknown disposition is encountered 1
File replicates itself and this information is communicated to the cloud
2
File communicates with malicious IP addresses or starts downloading files with known malware disposition
3
Combination of activities indicates a compromise and the behavior is reported to the cloud and AMP client
4
These indications are prioritized and reported to security team as possible compromise
5
namic alysis
Advanced Analytics
Device Flow Correlation
Behavioral Detection: Example Point-in-Time Detection Retrospective Security
Cisco Collective Security Intelligence
Collective Security Intelligence Cloud
IP: 64.233.160.0
Device Flow Correlation monitors communications of a host on the network
1
Two unknown files are seen communicating with a particular IP address
2
One is sending information to the IP address, the other is receiving commands from the IP address
3
Collective Security Intelligence Cloud recognizes the external IP as a confirmed, malicious site
4
Unknown files are identified as malware because of the association
5
Trajectory Behavioral Indications
of Compromise
Breach Hunting
nuous ysis
Attack Chain Weaving
Behavioral Indications of Compromise: Example
Point-in-Time Detection Retrospective Security
Cisco Collective Security Intelligence
Behavioral Indications of Compromise uses continuous analysis and retrospection to monitor systems for suspicious and unexplained activity… not just signatures!
Using the power of Attack Chain Weaving, Cisco® AMP is able to recognize patterns and activities of a given fi le, and identify an action to look for across your environment rather than a fi le fingerprint or signature
An unknown file is admitted into the network
1 The unknown file copies itself to multiple machines
2 Duplicates content from the hard drive
3 Sends duplicate content to an unknown IP address
Cisco Advanced Malware Protection (AMP) Deployment Options Get Visibility and Control across all attack vectors to defend against today’s most advanced threats.
Protect your Endpoints! Get visibility into file and executable-
level activity, and remediate advanced malware on devices running Windows, Mac OS,
Linux, and Android. Supercharge your next-generation
firewall by turning on AMP capabilities on the Cisco Firepower
NGFW or the Cisco ASA with Firepower Services.
Get deep visibility into threat activity and block advanced malware with
AMP deployed as a network-
Add AMP to a Cisco Web Security Appliance (WSA) or Cisco Cloud
Web Security (CWS) and get visibility and control to defend
against advanced threats launched from the web.
Add AMP to a Cisco Email Security Appliance (ESA)
and get visibility and control to defend against advanced
threats launched via email.
Combat and block network-based threats by deploying
AMP capabilities on the Cisco Integrated Services
Router (ISR).
For high privacy environments that restrict the use of the public cloud, use an on-premises, air-gapped
private cloud deployment of AMP for Networks or AMP for Endpoints.
An on-premises appliance or cloud-based solution for static and dynamic malware analysis
(sandboxing) and threat intelligence.
based solution running on AMP-bundled security appliances (NGIPS). AMP for Endpoints
AMP for Firew alls
AMP for Netw orks
AMP for Email
AMP for ISR
AMP for Web
Threat Grid
AMP for Private Cloud Virtual Appliance
The AMP Everywhere Architecture AMP Protection Across the Extended Network for an Integrated Threat Defense
AMP Threat Intelligence
Cloud
Windows OS Android Mobile Virtual MAC OS CentOS, Red Hat Linux for serv ers and datacenters
AMP on Web and Email Security Appliances AMP on Cisco® ASA Firewall
with Firepower Services
AMP Priv ate Cloud Virtual Appliance
AMP on Firepower NGIPS Appliance
(AMP for Networks)
AMP on Cloud Web Security and Hosted Email
CWS/CTA
Threat Grid Malware Analysis + Threat
Intelligence Engine
AMP on ISR with Firepower Serv ices
AMP for Endpoints
AMP for Endpoints
Remote Endpoints
AMP for Endpoints can be launched from AnyConnect
Third Party Validation NSS Labs Security Value Map for Breach Detection Systems - 2015
Who is NSS Labs? NSS Labs is an independent testing organization focused on the cyber security industry.
What was measured? Security Effectiveness of Breach Detection Systems • Malware delivered by HTTP, Email, and Server Message Block
(SMB), Drive-by and Social Exploits, and Evasions • Total Cost of Ownership per protected Mbps
What Cisco products were tested?
Advanced Malware Protection • AMP for Networks and AMP for Endpoints • FirePOWER 8120 (with AMP subscription)*
What competitor products were evaluated?
Blue Coat, Check Point, Fidelis, FireEye, Fortinet, Lastline, Trend Micro
Methodology BDS Methodology 2.0
The Leader in Security Effectiveness
§ 99.2% Security Effectiveness rating in BDS testing, the highest of all vendors tested.
§ Only vendor to block 100% of evasion techniques during testing.
§ Excellent performance with minimal impact on network, endpoint, or application latency.
§ Download the flysheet and full report here.
Cisco AMP offers superior security effectiveness, excellent performance, and provides security across more attack vectors than any other vendor
