Two for Attack: Web and Email Content Protection
•Download as PPTX, PDF•
2 likes•861 views
Session: Two for Attack: Web and Email Content Protection Presenter: Steve Gindi, Director Advanced Threat Security Date: October 6, 2015
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Two for Attack: Web and Email Content Protection
Similar to Two for Attack: Web and Email Content Protection (20)
More from Cisco Canada
More from Cisco Canada (20)
Recently uploaded
Recently uploaded (20)
Two for Attack: Web and Email Content Protection
- 1. Director Advanced Threat Security Released: June 12, 2015 Web and Email Content Protection Two for attack Steve Gindi
- 2. Housekeeping Notes October 6th, 2015
- 3. Thank you for attending Cisco Connect Halifax 2015, here are a few housekeeping notes to ensure we all enjoy the session today. Session Surveys – Please fill them in Please ensure your cellphones / laptops are set on silent to ensure no one is disturbed during the session NO FALLING ASLEEP!!! ASK QUESTIONS Twitter: @sgindi House Keeping Notes
- 4. Cisco dCloud is a self-service platform that can be accessed via a browser, a high-speed Internet connection, and a cisco.com account Customers will have direct access to a subset of dCloud demos and labs Restricted content must be brokered by an authorized user (Cisco or Partner) and then shared with the customers (cisco.com user). Go to dcloud.cisco.com, select the location closest to you, and log in with your cisco.com credentials Review the getting started videos and try Cisco dCloud today: https://dcloud-cms.cisco.com/help dCloud Customers now get full dCloud experience!
- 5. Advanced Strategies for Defending Against a New Breed of Attacks
- 6. The Global Hacker Economy is 3x to 5x the size of the security industry. Industrialization of Hacking. Source: Center for Strategic and I
- 7. How Industrial Hackers Monetize the Opportunity Social Security $1 Medical Record >$50 DDOS as a Service ~$7/hour Cisco Confidential 7©2014 Cisco and/or its affiliates. All rights reserved. WELCOME TO THE HACKERS’ ECONOMY Source: RSA/CNBC DDoS Exploits $1000-$300K Facebook Account $1 for an account with 15 friends Global Cybercrime Market: $450B-$1T$ Bank Account Info >$1000 depending on account type and balance Malware Development $2500 (commercial malware) Credit Card Data $0.25-$60 Mobile Malware $150 Spam $50/500K emails
- 8. If you knew you were going to be compromised would you do security differently?
- 9. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9 Most dangerous threats –BlendedAttacks Approach Tactic Impact Threat vector Infect or inject a trusted site Conduct reconnaissance on a target Deliver an exploit that will attack Target users through compromised links Leverage social engineering Deliver an exploit that will attack Deliver malware with stealth and self-deleting programs Gain access through DLL injection and control firewalls, antivirus, etc Compromises system control, personal data and authorizations DropperWatering hole Spear phishing
- 10. Zero day and targeted attacks.
- 12. Why are we still Struggling??!!??!! Complexity Visibility Cost • Multi-Vendor • Redundancy • Training • Hardware • Power • Rack Space
- 13. What if we could do better?
- 15. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15 Covering the EntireAttack Continuum ATTACK CONTINUUM Discover Enforce Harden Detect Block Defend Scope Contain Remediate FireSIGHT and pxGrid ASA NGFW Secure Access + Identity Services VPN Meraki NGIPS ESA/WSA CWS Advanced Malware Protection Cognitive ThreatGRID
- 16. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16 Talos provides threat focused security intelligence 100 TB Intelligence 1.6M sensors 150 million+ endpoints 35% email world wide FireAMP™, 3+ million 80B DNS Request 13B web req AEGIS™ & SPARK Open Source Communities 180,000+ Files per Day 1B SBRS Queries per Day 3.6PB Monthly though CWS Advanced Industry Disclosures Outreach Activities Dynamic Analysis Threat Centric Detection Content SEU/SRU Sandbox VDB Security Intelligence Email & Web Reputation Email Endpoints Web Networks IPS Devices WWW 10I000 0II0 00 0III000 II1010011 101 1100001 110 110000III000III0 I00I II0I III0011 0110011 101000 0110 00 I00I III0I III00II 0II00II I0I000 0110 00 1010000II0000III000III0I00IIIIII0000III0 1100001110001III0I00III0IIII00II0II00II101000011000 100III0IIII00II0II00III0I0000II000Threat Intelligenc e Research ResponseTALOS
- 17. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17 Tackle the most advanced threats with Cisco Email Security solutions BEFORE Discover Enforce Harden DURING Detect Block Defend AFTER Scope Contain Remediate Attack Continuum Reputation Filtering Signature, AV, Spam scanning URL Scanning File Reputation Continuous Retrospection Sandboxing
- 18. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18 Cisco Email Security delivers industry leading… Data SecurityThreat Protection Anti-spam Outbreak Filters Advanced Malware Protection (AMP) Antivirus Data Loss Prevention Encryption
- 19. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19 Anti-spam Defense in Depth Choice of scanning engines to suit every customer’s risk posture Data SecurityThreat Protection Suspicious mail is rate limited and spam filtered • > 99% catch rate • < 1 in 1 million false positives Known bad mail is blocked before it enters the network Incoming mail good, bad, and unknown email What Cisco Anti-Spam WhenWho HowWhere TALOS
- 20. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20 Antivirus Defense in Depth Choice of Antivirus Engines • Sophos • McAfee • Or, both Sophos and McAfee Data SecurityThreat Protection Anti-Spam Engines Antivirus Engines Choice of Antivirus Engines What Cisco Anti-Spam, IMS WhenWho HowWhere
- 21. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21 Outbreak Filters Outbreak Filters in Action Zero-Hour Virus and Malware Detection Outbreak Filters Advantage • Average lead time*: Over 13 hours • Outbreaks blocked*: 291 outbreaks • Total incremental protection*: Over 157 days Cloud Powered Zero-Hour Malware Detection Malware Protection Virus Filter Dynamic Quarantine Cisco® SIO Data SecurityThreat Protection
- 22. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22 “This URL is blocked by policy”Replace Outstanding URL defense Many ways of protecting end users from malicious or inappropriate links Automated with Outbreak Filters or Manual BLOCKEDwww.playboy.comBLOCKED BLOCKEDwww.proxy.orgBLOCKEDDefang RewriteSend to Cloud Data SecurityThreat Protection Cisco SIO Email Contains URL URL Analytics
- 23. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23 Tackle the most advanced threats with Cisco Web Security solutions BEFORE Discover Enforce Harden DURING Detect Block Defend AFTER Scope Contain Remediate Attack Continuum Web Reputation Malware Signatures File Reputation Continuous Retrospection Sandboxing Usage Controls Application Controls Threat Analytics Actionable Reporting
- 24. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24 Cisco Web Security At a Glance Centralized Management and Reporting Cisco® Talos URL Filtering Application Visibility and Control (AVC) Data Loss Prevention (DLP) Threat Monitoring and Analytics Advanced Malware Protection ► Spots symptoms of infection based on behavioral anomalies (CWS only) and CNC traffic ► Blocks unknown files through reputation and sandboxing ► Continues to monitor threat levels after an attack ► Contains 50 million known sites ► Categorizes unknown URLs in real time ► Controls mobile, collaborative, and web 2.0 applications ► Enforces behaviors within web 2.0 applications ► Blocks sensitive information ► Integrates easily by ICAP with third-party vendors Offers actionable insight across threats, data and applications AllowWWW Limited AccessWWW BlockWWW Monitors threats worldwide, filters on reputation and automatically updates every 3-5 minutes Protection Control WWW
- 25. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25 Acceptable Use Controls Beyond URL Filtering URL Filtering ► Constantly updated URL database covering over 50 million sites worldwide ► Real-time dynamic categorization for unknown URLs HTTP:// Application Visibility and Control (AVC) Hundreds of Apps Application Behavior 150,000+ Micro-Apps ► Control over mobile, collaborative, and web 2.0 applications ► Assured policy control over which apps can be used by which users and devices ► Granular enforcement of behaviors within applications ► Visibility of activity across the network +
- 26. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26 Real-time Malware Scanning Dynamic Vectoring and Streaming Signature and Heuristic Analysis • Optimizes efficiency and catch rate with intelligent multi-scanning • Enhances coverage with multiple signature scanning engines • Identifies encrypted malicious traffic by decrypting and scanning SSL traffic • Improves user experience with parallel scanning for fastest analysis • Provides the latest coverage with automated updates Heuristics Detection Identify unusual behaviors Anti-malware Scanning Parallel Scans, Stream Scanning Signature Inspection Identify known behaviors Multiple Anti-malware Scanning Engines
- 27. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 27 What if we could do even better?
- 28. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28 Zero day and targeted attacks.
- 29. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 29 CiscoAMPDeliversABetterApproach Retrospective SecurityPoint-in-Time Detection Continuous ProtectionFile Reputation & Behavioral Detection Unique To Cisco AMP
- 30. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 30 Cisco Collective Security Intelligence Point-in-Time Protection Continuous Protection File Reputation & Behavioral Detection Unique to Cisco AMP Retrospective Security CiscoAMPDefends With Reputation Filtering And Behavioral Detection Reputation Filtering Behavioral Detection Dynamic Analysis Machine Learning Fuzzy Finger-printing Advanced Analytics One-to-One Signature Indications of Compromise Device Flow Correlation
- 31. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 31 CiscoAMPDeliversABetterApproach Retrospective SecurityPoint-in-Time Detection Continuous ProtectionFile Reputation & Behavioral Detection Unique to Cisco AMP
- 32. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 32 CiscoAMPDefends With Retrospective Security TrajectoryBehavioral Indications of Compromise Breach Hunting Retrospection Attack Chain Weaving
- 33. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 33 Cisco provides some of the best protection available Breach Detection Systems Security Value MapTM 100 % 99% 98% 97% 96% 95% 94% 93% 92% 91% $500 $450 $400 $350 $300 $250 $200 $150 $100 $50 Average Average Cisco (Sourcefire) Trend MicroFortinet Fidelis AhnLab FireEye *2014 NSS Breach Detection Report No one can provide 100% protection
- 34. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34 What if we could trigger a systemic response?
- 35. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 35 See once, protect everywhere. Network
- 36. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 36 Comprehensive Environment Protection withAMP AMP Protection Method Ideal for Content License with ESA or WSA New or existing Cisco Email or Web Security customers Network Stand Alone Solution -or- Enable AMP on FirePOWER Appliance IPS/NGFW customers Endpoint Install on endpoints Windows, Mac, Android, VMs Cisco Advanced Malware Protection Threat Vector Email and Web Networks Devices
- 37. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37 We need to do better. It’s not an option. It’s a requirement. Now is the time. The Reality
- 38. Thank You. Visit us in the World of Solutions.