Cisco Canada, profile picture
Uploaded byCisco Canada
PDF, PPTX1,150 views

Behind the Curtain: Exposing Advanced Threats

The document discusses advanced threat solutions by Cisco, highlighting the importance of effective threat detection and response in today's cybersecurity landscape. It emphasizes that even with high protection rates, numerous threats evade detection, leading to substantial vulnerabilities within organizations. Cisco's Advanced Malware Protection (AMP) system is presented as a solution that leverages big data analytics to continuously analyze and respond to threats, ultimately improving defense mechanisms against evolving cyber threats.

Embed presentation

Download as PDF, PPTX
Advanced Threat Solutions seearhar@cisco.com / 647-988-4945 Sean Earhard Advanced Threat Solutions CSE jkerouan@cisco.com / 647-929-5938 Jean-Paul Kerouanton EXPOSING ADVANCED THREATSAMP
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 HOW QUICKLY CAN YOURTEAM—AND YOUR SECURITY VENDORS—DELIVER THEANSWERS TO THESE QUESTIONS:  WHERE DID IT ORIGINATE?  HOW DID IT SUCCEED?  HOW MANY MACHINES/USERS?  WHAT IS IT DOING NOW?  HOW CAN IT BE STOPPED?  WITH 100% CONFIDENCE?
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3 24 HOURS INENTERPRISE SECURITY vs. SYSTEMS WILL SUCCESSFULLY STOP A THREAT 72 32 SYSTEMS WILL BE FOUND TO BE BREACHED 6 24 BREACHED SYSTEMS WILL HAVE BEEN BREACHED FOR OVER A WEEK 1 3 DEPLOYED SYSTEMS HAVING VULNERABLE SOFTWARE 48% 28% MORE LIKELY TO BE BREACHED IF A VULNERABLE APPLICATION EXISTS 62% 39% MORE LIKELY TO BE BREACHED IF THEY HAVE BEEN BREACHED IN THE PAST 35% 38% 20162015
B L O C K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. TYPICAL CYBERSECURITY WORKFLOW vs. TIME REQUIRED × “How are we finding these failures in our environment?” “How do we know we’re responding to the right alerts?” “How long does it take us to answer these questions?” “How long does it take us to find the rest of the machines compromised by the same attack?” “How long does it take us to redefine security in all our tools?” R E S P O N D T O A L E R T S Security tools generate 100’s, even 1,000’s of alerts each day. Any one of those could be a breach in progress. ! I N V E S T I G A T E I N C I D E N T S When a cybersecurity incident impacts the business, the business needs answers: • Where did it start? • How did it succeed? • How long have we been compromised? • How many machines are impacted? • How can it be stopped? ? R E I M A G E + R E C O V E R Reimaging is not recovering. The average compromised machine remains undiscovered for 200+ days. I M P R O V E D E F E N S E Reducing the attack surface means upgrading security policy – but the average organization manages 34-55 security tools.
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5 1. BLOCK
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6 Stay out!
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7 BEFORE Discover Enforce Harden DURING Detect Block Defend AFTER Scope Contain Remediate THEATTACK CONTINUUM BUDGET BUDGET BUDGETTIME TIME TIME  Firewall  App Control  VPN  Patch Mgmt  Vuln Mgmt  IAM/NAC  IPS  Antivirus  Email/Web  IDS  FPC  Forensics  AMD  Log Mgmt  SIEM  Firewall  App Control  VPN  Patch Mgmt  Vuln Mgmt  IAM/NAC  IPS  Antivirus  Email/Web  IDS  FPC  Forensics  AMD  Log Mgmt  SIEM
antivirus point in time threat inspection This population of threats is 100% effective, 100% of the time network point in time threat inspection web point in time threat inspection email point in time threat inspection BEFORE, DURINGANDAFTER INACTION
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9 LEGACY SECURITY PRODUCTION MODEL 1. mass sample collection MALWARE SAMPLE #A4409K 2. prioritized sample processing MALWARE ANALYSIS #A4409K 3. prioritized detection creation SIGNATURE UPDATE #A4409K 4. signature payload distribution TODAY
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10 b260653178.exe Firefox user connects to http://www.downloaders.com Downloads an unknown .zip Two files are accessed when the .zip is opened, b260653178.exe, and a PDF. PDF Reader application is opened to read the PDF. Acrobat launches svchost.exe svchost.exe connects to http://192.168.1.12 File #3, connects to 4 IP addresses File #3 opens a dialog window and awaits response. The last unknown file launches calc.exe, hollows the process and begins listening for remote connections Geolocates and then connects to a C&C server 3 files are downloaded but 2 are blocked by AMP File#4 is downloaded AMP Cloud issues a retrospective block ATTACK FLOW EXAMPLE 37% FALSE NEGATIVES ARE COUNTED AS SECURITY ‘WINS’
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11 WHATIS GARTNER ADVISINGABOUT THIS?
65% of CEOs say their risk management approach is falling behind. In a new reality where security breaches come at a daily rate, we must move away from trying to achieve the impossible perfect protection and instead invest in detection and response. Organizations should move their investments from 90 percent prevention and 10 percent detection and response to a 60/40 split. Peter Sondergaard Senior VP and Global Head of Research Gartner
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13 WHOISTHETOP ‘DETECTIONAND RESPONSE’ VENDOR?
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14 NSS LABS: BREACH DETECTION SYSTEMS  Over 5 billion discrete data elements  Hundreds of victim machines  Collection and analysis of Terabytes of logs  Hundreds of discrete samples used in current campaigns  Exploits, malware, and evasion testing was performed using regularly abused compromise mediums such as web and email—leveraging multiple common document types  Over 100 unique evasion mechanics were tested ONLY VENDOR TO BLOCK 100% OF EVASION TECHNIQUES TOP VENDOR 2 YEARS IN A ROW CISCO AMP RATED 99.2% EFFECTIVE AMP
2015 Gartner MQ for Intrusion Prevention Systems “The Advanced Malware Protection (AMP) products provide a quicker path to adding advanced threat capabilities… competing well against stand-alone and established advanced persistent threat (APT) solution vendors.”
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16 THE CISCO RESPONSE
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17 OVERVIEWAMP
Cisco Advanced Malware Protection Built on Unmatched Collective Security Intelligence 1.6 million global sensors 100 TB of data received per day 150 million+ deployed endpoints 600 engineers, technicians, and researchers 35% worldwide email traffic 13 billion web requests 24x7x365 operations 4.3 billion web blocks per day 40+ languages 1.1 million incoming malware samples per day AMP Community Private/Public Threat Feeds Talos Security Intelligence AMP Threat Grid Intelligence AMP Threat Grid Dynamic Analysis 10 million files/month Advanced Microsoft and Industry Disclosures Snort and ClamAV Open Source Communities AEGIS Program Email Endpoints Web Networks IPS Devices WWW Automatic updates in real time 101000 0110 00 0111000 111010011 101 1100001 110 1100001110001110 1001 1101 1110011 0110011 101000 0110 00 1001 1101 1110011 0110011 101000 0110 00 101000 0110 00 0111000 111010011 101 1100001 1100001110001110 1001 1101 1110011 0110011 10100 1001 1101 1110011 0110011 101000 0110 00 Cisco® Collective Security Intelligence Cisco Collective Security Intelligence Cloud AMP Advanced Malware Protection 3.5 BILLION SEARCHES TODAY 18.5B CLOUDAMP 20.1 BILLION THREATS BLOCKED TODAY TALOS THE CISCO SECURITY AND INTELLIGENCE RESEARCH GROUP
AMP CONTINUOUSLY RECORD ACTIVITY REGARDLESS OF DISPOSITION
AMP CLOUD PRIVATE CLOUD AMP ThreatGrid
CONTINUOUS BACKGROUND ANALYSIS vs. AMP CLOUD SYSTEMIC RESPONSE RETROSPECTIVE DETECTION
HQ STORE: POS DATA CENTER ENDPOINT MALWARE EVENTS SHARED AMPAMPAMPAMPAMP AMPAMPAMP AMP AMP AMP AMP THREATGRID AMP OR TALOS SECURITY AND INTELLIGENCE RESEARCH FireSIGHT AMP APPLIANCE (NGIPS) AMP CLOUDAMP AMP FOR ENDPOINTS THREATGRID DYNAMIC ANALYSIS CISCO W EB CISCO EMAIL AMP AMP ASA + FPS AMP
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23 AMP WORKFLOW IN ACTION
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24 AMP INFRASTRUCTURE AMP ARCHITECTURE TALOS AMP FOR ENDPOINT FIRESIGHT MANAGEMENT CENTER AMP APPLIANCE (NGIPS) AMP THREATGRID DYNAMIC ANALYSIS EQUIVALENT COMPETITIVE ARCHITECTURE
B L O C K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. × ! ? “How are we finding these failures in our environment?”
C O N T I N U O U S A N A L Y S I S A N D R E T R O S P E C T I V E S E C U R I T Y AMP blocks threats, but it doesn’t stop there. AMP uses big data analytics to continuously analyze the history of endpoint and network behavior in your environment – uncovering advanced threats and rewinding history to block them.
NETWORK: • Start with Blocking: IP, IPS, Files • Tracking Files: Good, Unknown, Bad • Unknown Files = Dynamic Analysis • Retrospective Events ENDPOINT • Tracking Files • Tracking Behavior • Blocking examples: IP, IoC, Files • Dynamic Analysis • Retrospective Events
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28 L b260653178.exe Firefox user connects to http://www.downloaders.com Downloads an unknown .zip Two files are accessed when the .zip is opened, b260653178.exe, and a PDF. PDF Reader application is opened to read the PDF. Acrobat launches svchost.exe svchost.exe connects to http://192.168.1.12 File #3, connects to 4 IP addresses File #3 opens a dialog window and awaits response. The last unknown file launches calc.exe, hollows the process and begins listening for remote connections Low prevalence analysis delivers a retrospective block Tries to geolocate and then connect to a C&C server 3 files are downloaded but 2 are blocked by AMP File#4 is downloaded AMP Cloud issues a retrospective block DEVICE TRAJECTORY TRIGGERED FILE TRAJECTORY TRIGGERED THREATGRID DYNAMIC ANALYSIS TRIGGERED SNORT RULE ANALYSIS TRIGGERED RETROSPECTIVE BLOCK SYSTEMIC BLOCK LOW PREVALENCE THREATGRID DYNAMIC ANALYSIS TRIGGERED L AMP FOR NETWORK AMP FOR ENDPOINT DETECTION ATTACK FLOW vs. AMP
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 29 2. RESPOND TO ALERTS
R E S P O N D T O A L E R T S Security tools generate 100’s, even 1,000’s of alerts each day. Any one of those could be a breach in progress. B L O C K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. × ! ? “How are we finding these failures in our environment?” “How do we know we’re responding to the right alerts?”
C O N T I N U O U S A N A L Y S I S A N D R E T R O S P E C T I V E S E C U R I T Y AMP blocks threats, but it doesn’t stop there. AMP uses big data analytics to continuously analyze the history of endpoint and network behavior in your environment – uncovering advanced threats and rewinding history to block them. T H E P O W E R O F C O N T E X T In real-time, AMP Appliances passively discover the environment they are protecting – mapping the vulnerabilities of each host. An attack leveraging actual vulnerabilities of the target host is a true top alerts.
• Alert overload example • Unfiltered: List of Intrusion Events • By Impact: List of Intrusion Events • How? Passive Discovery Overview • Endpoint: Vulnerable Software
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 33 3. INVESTIGATE INCIDENTS
R E S P O N D T O A L E R T S Security tools generate 100’s, even 1,000’s of alerts each day. Any one of those could be a breach in progress. I N V E S T I G A T E I N C I D E N T S When a cybersecurity incident impacts the business, the business needs answers: • Where did it start? • How did it succeed? • How long have we been compromised? • How many machines are impacted? • How can it be stopped? B L O C K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. TYPICAL CYBERSECURITY WORKFLOW vs. TIME REQUIRED × ! ? “How are we finding these failures in our environment?” “How do we know we’re responding to the right alerts?” “How long does it take us to answer these questions?”
C O N T I N U O U S A N A L Y S I S A N D R E T R O S P E C T I V E S E C U R I T Y AMP blocks threats, but it doesn’t stop there. AMP uses big data analytics to continuously analyze the history of endpoint and network behavior in your environment – uncovering advanced threats and rewinding history to block them. T H E P O W E R O F C O N T E X T In real-time, AMP Appliances passively discover the environment they are protecting – mapping the vulnerabilities of each host. An attack leveraging actual vulnerabilities of the target host is a true top alerts. V I S I B I L I T Y + C O N T R O L Because AMP records the history of the environment, your team can quickly scroll back time to discover what happened. • Identify ‘patient zero’ – the first victim. • Determine the attack scope – how malware traversed the organization. • Contain the event, understanding all affected systems. • Remediate quickly, focusing on high-priority events and systems. • Prevent reinfection by identifying the root causes.
Workflow: Investigate Incidents • Network • Endpoint
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37 4. REIMAGE AND RECOVER
R E S P O N D T O A L E R T S Security tools generate 100’s, even 1,000’s of alerts each day. Any one of those could be a breach in progress. I N V E S T I G A T E I N C I D E N T S When a cybersecurity incident impacts the business, the business needs answers: • Where did it start? • How did it succeed? • How long have we been compromised? • How many machines are impacted? • How can it be stopped? B L O C K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. R E I M A G E + R E C O V E R Reimaging is not recovering. The average compromised machine remains undiscovered for 200+ days. × ! ? “How are we finding these failures in our environment?” “How do we know we’re responding to the right alerts?” “How long does it take us to answer these questions?” “How long does it take us to find the rest of the machines compromised by the same attack?”
C O N T I N U O U S A N A L Y S I S A N D R E T R O S P E C T I V E S E C U R I T Y AMP blocks threats, but it doesn’t stop there. AMP uses big data analytics to continuously analyze the history of endpoint and network behavior in your environment – uncovering advanced threats and rewinding history to block them. T H E P O W E R O F C O N T E X T In real-time, AMP Appliances passively discover the environment they are protecting – mapping the vulnerabilities of each host. An attack leveraging actual vulnerabilities of the target host is a true top alerts. V I S I B I L I T Y + C O N T R O L Because AMP records the history of the environment, your team can quickly scroll back time to discover what happened. • Identify ‘patient zero’ – the first victim. • Determine the attack scope – how malware traversed the organization. • Contain the event, understanding all affected systems. • Remediate quickly, focusing on high-priority events and systems. • Prevent reinfection by identifying the root causes. S Y S T E M I C R E S P O N S E AMP works through the cloud, enforcing security response everywhere it is installed. Before we can react to alert, AMP is already blocking on the network, endpoints – even laptops off our network, email and web.
Systemic Response • Example Move beyond blind reimaging: • Identify root cause (review) • Roll back time even after reimaging
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 41 5. IMPROVE DEFENSE
R E S P O N D T O A L E R T S Security tools generate 100’s, even 1,000’s of alerts each day. Any one of those could be a breach in progress. I N V E S T I G A T E I N C I D E N T S When a cybersecurity incident impacts the business, the business needs answers: • Where did it start? • How did it succeed? • How long have we been compromised? • How many machines are impacted? • How can it be stopped? B L O C K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. R E I M A G E + R E C O V E R Reimaging is not recovering. The average compromised machine remains undiscovered for 200+ days. I M P R O V E D E F E N S E Reducing the attack surface means upgrading security policy – but the average organization manages 34-55 security tools. TYPICAL CYBERSECURITY WORKFLOW vs. TIME REQUIRED × ! ? “How are we finding these failures in our environment?” “How do we know we’re responding to the right alerts?” “How long does it take us to answer these questions?” “How long does it take us to find the rest of the machines compromised by the same attack?” “How long does it take us to redefine security in all our tools?”
C O N T I N U O U S A N A L Y S I S A N D R E T R O S P E C T I V E S E C U R I T Y AMP blocks threats, but it doesn’t stop there. AMP uses big data analytics to continuously analyze the history of endpoint and network behavior in your environment – uncovering advanced threats and rewinding history to block them. T H E P O W E R O F C O N T E X T In real-time, AMP Appliances passively discover the environment they are protecting – mapping the vulnerabilities of each host. An attack leveraging actual vulnerabilities of the target host is a true top alerts. “AMP finds what our other tools miss” “We used to have to choose from 1,000’s of alerts…now we know the 4-6 critical alerts for our environment” “What used to take us 2 weeks or 2 months now takes us 2 minutes” “Instead of spending 4 hours each day chasing our tools, we’re blocking everywhere, automatically”“It would have taken 2 hours a day to do what’s being done automatically ” V I S I B I L I T Y + C O N T R O L Because AMP records the history of the environment, your team can quickly scroll back time to discover what happened. • Identify ‘patient zero’ – the first victim. • Determine the attack scope – how malware traversed the organization. • Contain the event, understanding all affected systems. • Remediate quickly, focusing on high-priority events and systems. • Prevent reinfection by identifying the root causes. S Y S T E M I C R E S P O N S E AMP works through the cloud, enforcing security response everywhere it is installed. Before we can react to alert, AMP is already blocking on the network, endpoints – even laptops off our network, email and web. S H A R E D S E C U R I T Y I N T E L L I G E N C E With AMP ThreatGrid, both Cisco industry partners and non- Cisco solutions can benefit from dynamic analysis executed by AMP, automatically improving your defense.
Integration • How sharing Threat Intelligence works • Adding integration • Invitation to review your environment?
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 45 Shares the results of dynamic analysis (sandboxing) of your files, and threat intelligence feeds, with your existing security. • Firewall • IPS/IDS • Gatway/Proxy • Network Taps • SIEM • Log Management • Endpoint Security • Other tools THREATGRID TG THREATGRID OR
NEXT STEPS 1. “Cisco AMP” 2. Scoping Call 3. Custom Demo 4. POC Sean Earhard seearhar@cisco.com / 647-988-4945

More Related Content

PDF
Emerging Threats - The State of Cyber Security
byCisco Canada
 
PDF
Cisco Connect Toronto 2017 - Accelerating Incident Response in Organizations...
byCisco Canada
 
PPTX
Ignite your network digitize your business
byCisco Canada
 
PDF
Cisco Intelligent Branch - Enabling the Next Generation Branch
byCisco Canada
 
PDF
Cisco ONE Enterprise Cloud (UCSD) Hands-on Lab
byCisco Canada
 
PDF
NSO: Network Service Orchestrator enabled by Tail-f Hands-on Lab
byCisco Canada
 
PPTX
Cisco connect winnipeg 2018 we make it simple
byCisco Canada
 
PDF
Cisco Connect Vancouver 2017 - Anatomy of Attack
byCisco Canada
 
Emerging Threats - The State of Cyber Security
byCisco Canada
 
Cisco Connect Toronto 2017 - Accelerating Incident Response in Organizations...
byCisco Canada
 
Ignite your network digitize your business
byCisco Canada
 
Cisco Intelligent Branch - Enabling the Next Generation Branch
byCisco Canada
 
Cisco ONE Enterprise Cloud (UCSD) Hands-on Lab
byCisco Canada
 
NSO: Network Service Orchestrator enabled by Tail-f Hands-on Lab
byCisco Canada
 
Cisco connect winnipeg 2018 we make it simple
byCisco Canada
 
Cisco Connect Vancouver 2017 - Anatomy of Attack
byCisco Canada
 

What's hot

PDF
Leverage the Network
byCisco Canada
 
PDF
Presentación - Cisco ASA with FirePOWER Services
byOscar Romano
 
PDF
Cisco Connect Toronto 2017 - Security Through The Eyes of a Hacker
byCisco Canada
 
PDF
Cisco Connect Toronto 2017 - Anatomy-of-attack
byCisco Canada
 
PDF
ASA Firepower NGFW Update and Deployment Scenarios
byCisco Canada
 
PDF
Cisco Connect Halifax 2018 Anatomy of attack
byCisco Canada
 
PPTX
Secure Data Center Solution with FP 9300 - BDM
byBill McGee
 
PDF
Cisco connect winnipeg 2018 accelerating incident response in organizations...
byCisco Canada
 
PDF
Cisco ASA con fire power services
byFelipe Lamus
 
PDF
Cisco Connect Halifax 2018 Cisco Spark hybrid services architectural design
byCisco Canada
 
PDF
Cisco Connect Toronto 2017 - Optimizing your client's Wi-Fi Experience
byCisco Canada
 
PDF
Putting Firepower into the Next Generation Firewall
byCisco Canada
 
PDF
Cisco Security Architecture
byCisco Canada
 
PDF
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
byCisco Canada
 
PPTX
Building Up Network Security: Intrusion Prevention and Sourcefire
byGlobal Knowledge Training
 
PDF
Meraki powered services bell
byCisco Canada
 
PDF
Cisco Connect Vancouver 2017 - Cloud and on premises collaboration security e...
byCisco Canada
 
PDF
Putting Firepower Into The Next Generation Firewall
byCisco Canada
 
PDF
Cisco Connect Toronto 2017 - Your time is now
byCisco Canada
 
PDF
Cisco connect winnipeg 2018 stealthwatch whiteboard session and cisco secur...
byCisco Canada
 
Leverage the Network
byCisco Canada
 
Presentación - Cisco ASA with FirePOWER Services
byOscar Romano
 
Cisco Connect Toronto 2017 - Security Through The Eyes of a Hacker
byCisco Canada
 
Cisco Connect Toronto 2017 - Anatomy-of-attack
byCisco Canada
 
ASA Firepower NGFW Update and Deployment Scenarios
byCisco Canada
 
Cisco Connect Halifax 2018 Anatomy of attack
byCisco Canada
 
Secure Data Center Solution with FP 9300 - BDM
byBill McGee
 
Cisco connect winnipeg 2018 accelerating incident response in organizations...
byCisco Canada
 
Cisco ASA con fire power services
byFelipe Lamus
 
Cisco Connect Halifax 2018 Cisco Spark hybrid services architectural design
byCisco Canada
 
Cisco Connect Toronto 2017 - Optimizing your client's Wi-Fi Experience
byCisco Canada
 
Putting Firepower into the Next Generation Firewall
byCisco Canada
 
Cisco Security Architecture
byCisco Canada
 
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
byCisco Canada
 
Building Up Network Security: Intrusion Prevention and Sourcefire
byGlobal Knowledge Training
 
Meraki powered services bell
byCisco Canada
 
Cisco Connect Vancouver 2017 - Cloud and on premises collaboration security e...
byCisco Canada
 
Putting Firepower Into The Next Generation Firewall
byCisco Canada
 
Cisco Connect Toronto 2017 - Your time is now
byCisco Canada
 
Cisco connect winnipeg 2018 stealthwatch whiteboard session and cisco secur...
byCisco Canada
 

Viewers also liked

PDF
Driver recruiter - Multiple Locations CA, NV, TN
byAngelene Green
 
DOCX
Virus que apaga
byJúnior Oliveira
 
DOCX
Evasesión25 26
bykeithlerma
 
PPTX
Windodws xp
byFlorita Shupingahua Tananta
 
PPTX
Presentación cristhian bogado
bycristhian bogado
 
PPTX
Los 5 métodos de la propaganda
byJessica Pérez
 
PDF
certoffirstaid
byMaSocorro Alberto
 
PDF
Aborboletaazul
byJanaina Campos
 
PDF
Quote of the Day #1
byProtrain
 
PPSX
Sistema nacional de control jzr (acceso libre)2
byJohnny Zorrilla Rojas
 
PPTX
Ch 9 PowerPoint
byJerry Kosak
 
PPTX
Proyecto minerva (1)
byequipo 6
 
PPT
Accidente Cerebrovascular
byVirginia Reyes
 
PDF
Mapa conceptual medios impresos y digitales
byJessica Pérez
 
Driver recruiter - Multiple Locations CA, NV, TN
byAngelene Green
 
Virus que apaga
byJúnior Oliveira
 
Evasesión25 26
bykeithlerma
 
Windodws xp
byFlorita Shupingahua Tananta
 
Presentación cristhian bogado
bycristhian bogado
 
Los 5 métodos de la propaganda
byJessica Pérez
 
certoffirstaid
byMaSocorro Alberto
 
Aborboletaazul
byJanaina Campos
 
Quote of the Day #1
byProtrain
 
Sistema nacional de control jzr (acceso libre)2
byJohnny Zorrilla Rojas
 
Ch 9 PowerPoint
byJerry Kosak
 
Proyecto minerva (1)
byequipo 6
 
Accidente Cerebrovascular
byVirginia Reyes
 
Mapa conceptual medios impresos y digitales
byJessica Pérez
 

Similar to Behind the Curtain: Exposing Advanced Threats

PPTX
AMP_Security_ Malware Protection Presentatiion
bySohanGole1
 
PDF
CYBERSECURITY: Game Planning for Success lunch and learn event, April 10th
byUnited Technology Group (UTG)
 
PDF
The World Against the Bad, Cisco AMP Solution to the Rescue
byCisco Canada
 
PDF
Cisco Live Cancun PR Session
byFelipe Lamus
 
PDF
CONFidence2015: Real World Threat Hunting - Martin Nystrom
byPROIDEA
 
PDF
Cisco amp everywhere
byCisco Canada
 
PDF
Cisco Advanced Services
byCisco do Brasil
 
PPTX
Two for Attack: Web and Email Content Protection
byCisco Canada
 
PPTX
Isday 2017 - Atelier Cisco
byInforsud Diffusion
 
PDF
BGA SOME/SOC Etkinliği - Tehdit Odaklı Güvenlik Mimarisinde Sourcefire Yakla...
byBGA Cyber Security
 
PDF
Cisco amp for endpoints
byCisco Canada
 
PDF
[CONFidence 2016] Gaweł Mikołajczyk - Making sense out of the Security Operat...
byPROIDEA
 
PDF
Cisco Connect Toronto 2018 sixty to zero
byCisco Canada
 
PPTX
Scalar Security Roadshow - Vancouver Presentation
byScalar Decisions
 
PDF
Scalar Security Roadshow - Toronto Presentation
byScalar Decisions
 
PPTX
Scalar Security Roadshow - Calgary Presentation
byScalar Decisions
 
PDF
Cisco Connect Ottawa 2018 sixty to zero
byCisco Canada
 
PDF
Cisco amp for networks
byCisco Canada
 
PDF
Advanced threat security - Cyber Security For The Real World
byCisco Canada
 
PDF
Cisco Connect 2018 Singapore - Cisco Incident Response Services
byNetworkCollaborators
 
AMP_Security_ Malware Protection Presentatiion
bySohanGole1
 
CYBERSECURITY: Game Planning for Success lunch and learn event, April 10th
byUnited Technology Group (UTG)
 
The World Against the Bad, Cisco AMP Solution to the Rescue
byCisco Canada
 
Cisco Live Cancun PR Session
byFelipe Lamus
 
CONFidence2015: Real World Threat Hunting - Martin Nystrom
byPROIDEA
 
Cisco amp everywhere
byCisco Canada
 
Cisco Advanced Services
byCisco do Brasil
 
Two for Attack: Web and Email Content Protection
byCisco Canada
 
Isday 2017 - Atelier Cisco
byInforsud Diffusion
 
BGA SOME/SOC Etkinliği - Tehdit Odaklı Güvenlik Mimarisinde Sourcefire Yakla...
byBGA Cyber Security
 
Cisco amp for endpoints
byCisco Canada
 
[CONFidence 2016] Gaweł Mikołajczyk - Making sense out of the Security Operat...
byPROIDEA
 
Cisco Connect Toronto 2018 sixty to zero
byCisco Canada
 
Scalar Security Roadshow - Vancouver Presentation
byScalar Decisions
 
Scalar Security Roadshow - Toronto Presentation
byScalar Decisions
 
Scalar Security Roadshow - Calgary Presentation
byScalar Decisions
 
Cisco Connect Ottawa 2018 sixty to zero
byCisco Canada
 
Cisco amp for networks
byCisco Canada
 
Advanced threat security - Cyber Security For The Real World
byCisco Canada
 
Cisco Connect 2018 Singapore - Cisco Incident Response Services
byNetworkCollaborators
 

More from Cisco Canada

PDF
Cisco connect montreal 2018 net devops
byCisco Canada
 
PDF
Cisco connect montreal 2018 iot demo kinetic fr
byCisco Canada
 
PPTX
Cisco connect montreal 2018 - Network Slicing: Horizontal Virtualization
byCisco Canada
 
PDF
Cisco connect montreal 2018 secure dc
byCisco Canada
 
PDF
Cisco connect montreal 2018 enterprise networks - say goodbye to vla ns
byCisco Canada
 
PDF
Cisco connect montreal 2018 vision mondiale analyse locale
byCisco Canada
 
PDF
Cisco Connect Montreal 2018 Securité : Sécuriser votre mobilité avec Cisco
byCisco Canada
 
PDF
Cisco connect montreal 2018 collaboration les services webex hybrides
byCisco Canada
 
PDF
Integration cisco et microsoft connect montreal 2018
byCisco Canada
 
PDF
Cisco connect montreal 2018 compute v final
byCisco Canada
 
PDF
Cisco connect montreal 2018 saalvare md-program-xr-v2
byCisco Canada
 
PDF
Cisco connect montreal 2018 sd wan - delivering intent-based networking to th...
byCisco Canada
 
PDF
Cisco Connect Toronto 2018 DNA automation-the evolution to intent-based net...
byCisco Canada
 
PDF
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
byCisco Canada
 
PDF
Cisco Connect Toronto 2018 IOT - unlock the power of data - securing the in...
byCisco Canada
 
PDF
Cisco Connect Toronto 2018 DevNet Overview
byCisco Canada
 
PDF
Cisco Connect Toronto 2018 DNA assurance
byCisco Canada
 
PDF
Cisco Connect Toronto 2018 network-slicing
byCisco Canada
 
PDF
Cisco Connect Toronto 2018 the intelligent network with cisco meraki
byCisco Canada
 
PDF
Cisco Connect Toronto 2018 sd-wan - delivering intent-based networking to t...
byCisco Canada
 
Cisco connect montreal 2018 net devops
byCisco Canada
 
Cisco connect montreal 2018 iot demo kinetic fr
byCisco Canada
 
Cisco connect montreal 2018 - Network Slicing: Horizontal Virtualization
byCisco Canada
 
Cisco connect montreal 2018 secure dc
byCisco Canada
 
Cisco connect montreal 2018 enterprise networks - say goodbye to vla ns
byCisco Canada
 
Cisco connect montreal 2018 vision mondiale analyse locale
byCisco Canada
 
Cisco Connect Montreal 2018 Securité : Sécuriser votre mobilité avec Cisco
byCisco Canada
 
Cisco connect montreal 2018 collaboration les services webex hybrides
byCisco Canada
 
Integration cisco et microsoft connect montreal 2018
byCisco Canada
 
Cisco connect montreal 2018 compute v final
byCisco Canada
 
Cisco connect montreal 2018 saalvare md-program-xr-v2
byCisco Canada
 
Cisco connect montreal 2018 sd wan - delivering intent-based networking to th...
byCisco Canada
 
Cisco Connect Toronto 2018 DNA automation-the evolution to intent-based net...
byCisco Canada
 
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
byCisco Canada
 
Cisco Connect Toronto 2018 IOT - unlock the power of data - securing the in...
byCisco Canada
 
Cisco Connect Toronto 2018 DevNet Overview
byCisco Canada
 
Cisco Connect Toronto 2018 DNA assurance
byCisco Canada
 
Cisco Connect Toronto 2018 network-slicing
byCisco Canada
 
Cisco Connect Toronto 2018 the intelligent network with cisco meraki
byCisco Canada
 
Cisco Connect Toronto 2018 sd-wan - delivering intent-based networking to t...
byCisco Canada
 

Recently uploaded

PDF
IAI-Unit1-notes useful.............................
bydinesh620610
 
PDF
Small Business Automation: A Comprehensive Cost and ROI Guide
byAmelia Swank
 
PPTX
Digital transformation success powered by EPM and NexInfo.pptx
byjayasuryanexinfo
 
PPTX
Cybersecurity Basics: Understanding Threats, Protection Methods, and Safe Dig...
byDhruvManiar3
 
PDF
Unit 1.2 Components of a Computer System.pdf
bySanieBautista
 
PDF
Ai In Courts Ai in courts AI in court AI in court
byZainKarim7
 
PDF
Regenerative Agriculture Finance : Environmental impact
byrose mason
 
PDF
MAD (1).pdf Mobile application develipment
byprathiT1
 
PDF
Benefits of Using the IAC 500 Sensor for Ambient Conditions
byCS Instruments
 
PDF
AI Driven & AI Native Development AI native development
byZainKarim7
 
PPTX
Document Reconstruction using AI & Deep Learning
bysonjuktaweb
 
PPTX
Why 2026 Could Be a Turning Point for Decentralized Exchanges.pptx
bycalliemorgan193
 
PPTX
Corporate AI Training to AI Enable a Company Workforce
byStélio Inácio
 
PDF
Industrial RFID Landscape for 2025 - Readers, Tags, Antennas, Printers, etc
byRich Rogers
 
PDF
Achieving Interoperability in Healthcare IT: A Strategic Guide
byHart, Inc.
 
PDF
Video Infrastructure_ Streaming Architecture and Delivery Systems.pdf
byTenbyte Limited
 
PPTX
Compare and contrast types of attacks.pptx
bysyednaqihassan14
 
PDF
Artificial Intelligence(AI) full Book.pdf
bydeyanimesh299
 
PDF
कम्प्यूटर.pdf for all computer examination
bynm92169694
 
PPTX
Pizza Chain Market Data Scraping for Better Insights Report.pptx
byWeb Data Crawler
 
IAI-Unit1-notes useful.............................
bydinesh620610
 
Small Business Automation: A Comprehensive Cost and ROI Guide
byAmelia Swank
 
Digital transformation success powered by EPM and NexInfo.pptx
byjayasuryanexinfo
 
Cybersecurity Basics: Understanding Threats, Protection Methods, and Safe Dig...
byDhruvManiar3
 
Unit 1.2 Components of a Computer System.pdf
bySanieBautista
 
Ai In Courts Ai in courts AI in court AI in court
byZainKarim7
 
Regenerative Agriculture Finance : Environmental impact
byrose mason
 
MAD (1).pdf Mobile application develipment
byprathiT1
 
Benefits of Using the IAC 500 Sensor for Ambient Conditions
byCS Instruments
 
AI Driven & AI Native Development AI native development
byZainKarim7
 
Document Reconstruction using AI & Deep Learning
bysonjuktaweb
 
Why 2026 Could Be a Turning Point for Decentralized Exchanges.pptx
bycalliemorgan193
 
Corporate AI Training to AI Enable a Company Workforce
byStélio Inácio
 
Industrial RFID Landscape for 2025 - Readers, Tags, Antennas, Printers, etc
byRich Rogers
 
Achieving Interoperability in Healthcare IT: A Strategic Guide
byHart, Inc.
 
Video Infrastructure_ Streaming Architecture and Delivery Systems.pdf
byTenbyte Limited
 
Compare and contrast types of attacks.pptx
bysyednaqihassan14
 
Artificial Intelligence(AI) full Book.pdf
bydeyanimesh299
 
कम्प्यूटर.pdf for all computer examination
bynm92169694
 
Pizza Chain Market Data Scraping for Better Insights Report.pptx
byWeb Data Crawler
 

Behind the Curtain: Exposing Advanced Threats

  • 1.
    Advanced Threat Solutions seearhar@cisco.com/ 647-988-4945 Sean Earhard Advanced Threat Solutions CSE jkerouan@cisco.com / 647-929-5938 Jean-Paul Kerouanton EXPOSING ADVANCED THREATSAMP
  • 2.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 2 HOW QUICKLY CAN YOURTEAM—AND YOUR SECURITY VENDORS—DELIVER THEANSWERS TO THESE QUESTIONS:  WHERE DID IT ORIGINATE?  HOW DID IT SUCCEED?  HOW MANY MACHINES/USERS?  WHAT IS IT DOING NOW?  HOW CAN IT BE STOPPED?  WITH 100% CONFIDENCE?
  • 3.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 3 24 HOURS INENTERPRISE SECURITY vs. SYSTEMS WILL SUCCESSFULLY STOP A THREAT 72 32 SYSTEMS WILL BE FOUND TO BE BREACHED 6 24 BREACHED SYSTEMS WILL HAVE BEEN BREACHED FOR OVER A WEEK 1 3 DEPLOYED SYSTEMS HAVING VULNERABLE SOFTWARE 48% 28% MORE LIKELY TO BE BREACHED IF A VULNERABLE APPLICATION EXISTS 62% 39% MORE LIKELY TO BE BREACHED IF THEY HAVE BEEN BREACHED IN THE PAST 35% 38% 20162015
  • 4.
    B L OC K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. TYPICAL CYBERSECURITY WORKFLOW vs. TIME REQUIRED × “How are we finding these failures in our environment?” “How do we know we’re responding to the right alerts?” “How long does it take us to answer these questions?” “How long does it take us to find the rest of the machines compromised by the same attack?” “How long does it take us to redefine security in all our tools?” R E S P O N D T O A L E R T S Security tools generate 100’s, even 1,000’s of alerts each day. Any one of those could be a breach in progress. ! I N V E S T I G A T E I N C I D E N T S When a cybersecurity incident impacts the business, the business needs answers: • Where did it start? • How did it succeed? • How long have we been compromised? • How many machines are impacted? • How can it be stopped? ? R E I M A G E + R E C O V E R Reimaging is not recovering. The average compromised machine remains undiscovered for 200+ days. I M P R O V E D E F E N S E Reducing the attack surface means upgrading security policy – but the average organization manages 34-55 security tools.
  • 5.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 5 1. BLOCK
  • 6.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 6 Stay out!
  • 7.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 7 BEFORE Discover Enforce Harden DURING Detect Block Defend AFTER Scope Contain Remediate THEATTACK CONTINUUM BUDGET BUDGET BUDGETTIME TIME TIME  Firewall  App Control  VPN  Patch Mgmt  Vuln Mgmt  IAM/NAC  IPS  Antivirus  Email/Web  IDS  FPC  Forensics  AMD  Log Mgmt  SIEM  Firewall  App Control  VPN  Patch Mgmt  Vuln Mgmt  IAM/NAC  IPS  Antivirus  Email/Web  IDS  FPC  Forensics  AMD  Log Mgmt  SIEM
  • 8.
    antivirus point intime threat inspection This population of threats is 100% effective, 100% of the time network point in time threat inspection web point in time threat inspection email point in time threat inspection BEFORE, DURINGANDAFTER INACTION
  • 9.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 9 LEGACY SECURITY PRODUCTION MODEL 1. mass sample collection MALWARE SAMPLE #A4409K 2. prioritized sample processing MALWARE ANALYSIS #A4409K 3. prioritized detection creation SIGNATURE UPDATE #A4409K 4. signature payload distribution TODAY
  • 10.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 10 b260653178.exe Firefox user connects to http://www.downloaders.com Downloads an unknown .zip Two files are accessed when the .zip is opened, b260653178.exe, and a PDF. PDF Reader application is opened to read the PDF. Acrobat launches svchost.exe svchost.exe connects to http://192.168.1.12 File #3, connects to 4 IP addresses File #3 opens a dialog window and awaits response. The last unknown file launches calc.exe, hollows the process and begins listening for remote connections Geolocates and then connects to a C&C server 3 files are downloaded but 2 are blocked by AMP File#4 is downloaded AMP Cloud issues a retrospective block ATTACK FLOW EXAMPLE 37% FALSE NEGATIVES ARE COUNTED AS SECURITY ‘WINS’
  • 11.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 11 WHATIS GARTNER ADVISINGABOUT THIS?
  • 12.
    65% of CEOssay their risk management approach is falling behind. In a new reality where security breaches come at a daily rate, we must move away from trying to achieve the impossible perfect protection and instead invest in detection and response. Organizations should move their investments from 90 percent prevention and 10 percent detection and response to a 60/40 split. Peter Sondergaard Senior VP and Global Head of Research Gartner
  • 13.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 13 WHOISTHETOP ‘DETECTIONAND RESPONSE’ VENDOR?
  • 14.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 14 NSS LABS: BREACH DETECTION SYSTEMS  Over 5 billion discrete data elements  Hundreds of victim machines  Collection and analysis of Terabytes of logs  Hundreds of discrete samples used in current campaigns  Exploits, malware, and evasion testing was performed using regularly abused compromise mediums such as web and email—leveraging multiple common document types  Over 100 unique evasion mechanics were tested ONLY VENDOR TO BLOCK 100% OF EVASION TECHNIQUES TOP VENDOR 2 YEARS IN A ROW CISCO AMP RATED 99.2% EFFECTIVE AMP
  • 15.
    2015 Gartner MQfor Intrusion Prevention Systems “The Advanced Malware Protection (AMP) products provide a quicker path to adding advanced threat capabilities… competing well against stand-alone and established advanced persistent threat (APT) solution vendors.”
  • 16.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 16 THE CISCO RESPONSE
  • 17.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 17 OVERVIEWAMP
  • 18.
    Cisco Advanced MalwareProtection Built on Unmatched Collective Security Intelligence 1.6 million global sensors 100 TB of data received per day 150 million+ deployed endpoints 600 engineers, technicians, and researchers 35% worldwide email traffic 13 billion web requests 24x7x365 operations 4.3 billion web blocks per day 40+ languages 1.1 million incoming malware samples per day AMP Community Private/Public Threat Feeds Talos Security Intelligence AMP Threat Grid Intelligence AMP Threat Grid Dynamic Analysis 10 million files/month Advanced Microsoft and Industry Disclosures Snort and ClamAV Open Source Communities AEGIS Program Email Endpoints Web Networks IPS Devices WWW Automatic updates in real time 101000 0110 00 0111000 111010011 101 1100001 110 1100001110001110 1001 1101 1110011 0110011 101000 0110 00 1001 1101 1110011 0110011 101000 0110 00 101000 0110 00 0111000 111010011 101 1100001 1100001110001110 1001 1101 1110011 0110011 10100 1001 1101 1110011 0110011 101000 0110 00 Cisco® Collective Security Intelligence Cisco Collective Security Intelligence Cloud AMP Advanced Malware Protection 3.5 BILLION SEARCHES TODAY 18.5B CLOUDAMP 20.1 BILLION THREATS BLOCKED TODAY TALOS THE CISCO SECURITY AND INTELLIGENCE RESEARCH GROUP
  • 19.
  • 20.
  • 21.
  • 22.
    HQ STORE: POS DATACENTER ENDPOINT MALWARE EVENTS SHARED AMPAMPAMPAMPAMP AMPAMPAMP AMP AMP AMP AMP THREATGRID AMP OR TALOS SECURITY AND INTELLIGENCE RESEARCH FireSIGHT AMP APPLIANCE (NGIPS) AMP CLOUDAMP AMP FOR ENDPOINTS THREATGRID DYNAMIC ANALYSIS CISCO W EB CISCO EMAIL AMP AMP ASA + FPS AMP
  • 23.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 23 AMP WORKFLOW IN ACTION
  • 24.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 24 AMP INFRASTRUCTURE AMP ARCHITECTURE TALOS AMP FOR ENDPOINT FIRESIGHT MANAGEMENT CENTER AMP APPLIANCE (NGIPS) AMP THREATGRID DYNAMIC ANALYSIS EQUIVALENT COMPETITIVE ARCHITECTURE
  • 25.
    B L OC K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. × ! ? “How are we finding these failures in our environment?”
  • 26.
    C O NT I N U O U S A N A L Y S I S A N D R E T R O S P E C T I V E S E C U R I T Y AMP blocks threats, but it doesn’t stop there. AMP uses big data analytics to continuously analyze the history of endpoint and network behavior in your environment – uncovering advanced threats and rewinding history to block them.
  • 27.
    NETWORK: • Start withBlocking: IP, IPS, Files • Tracking Files: Good, Unknown, Bad • Unknown Files = Dynamic Analysis • Retrospective Events ENDPOINT • Tracking Files • Tracking Behavior • Blocking examples: IP, IoC, Files • Dynamic Analysis • Retrospective Events
  • 28.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 28 L b260653178.exe Firefox user connects to http://www.downloaders.com Downloads an unknown .zip Two files are accessed when the .zip is opened, b260653178.exe, and a PDF. PDF Reader application is opened to read the PDF. Acrobat launches svchost.exe svchost.exe connects to http://192.168.1.12 File #3, connects to 4 IP addresses File #3 opens a dialog window and awaits response. The last unknown file launches calc.exe, hollows the process and begins listening for remote connections Low prevalence analysis delivers a retrospective block Tries to geolocate and then connect to a C&C server 3 files are downloaded but 2 are blocked by AMP File#4 is downloaded AMP Cloud issues a retrospective block DEVICE TRAJECTORY TRIGGERED FILE TRAJECTORY TRIGGERED THREATGRID DYNAMIC ANALYSIS TRIGGERED SNORT RULE ANALYSIS TRIGGERED RETROSPECTIVE BLOCK SYSTEMIC BLOCK LOW PREVALENCE THREATGRID DYNAMIC ANALYSIS TRIGGERED L AMP FOR NETWORK AMP FOR ENDPOINT DETECTION ATTACK FLOW vs. AMP
  • 29.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 29 2. RESPOND TO ALERTS
  • 30.
    R E SP O N D T O A L E R T S Security tools generate 100’s, even 1,000’s of alerts each day. Any one of those could be a breach in progress. B L O C K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. × ! ? “How are we finding these failures in our environment?” “How do we know we’re responding to the right alerts?”
  • 31.
    C O NT I N U O U S A N A L Y S I S A N D R E T R O S P E C T I V E S E C U R I T Y AMP blocks threats, but it doesn’t stop there. AMP uses big data analytics to continuously analyze the history of endpoint and network behavior in your environment – uncovering advanced threats and rewinding history to block them. T H E P O W E R O F C O N T E X T In real-time, AMP Appliances passively discover the environment they are protecting – mapping the vulnerabilities of each host. An attack leveraging actual vulnerabilities of the target host is a true top alerts.
  • 32.
    • Alert overloadexample • Unfiltered: List of Intrusion Events • By Impact: List of Intrusion Events • How? Passive Discovery Overview • Endpoint: Vulnerable Software
  • 33.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 33 3. INVESTIGATE INCIDENTS
  • 34.
    R E SP O N D T O A L E R T S Security tools generate 100’s, even 1,000’s of alerts each day. Any one of those could be a breach in progress. I N V E S T I G A T E I N C I D E N T S When a cybersecurity incident impacts the business, the business needs answers: • Where did it start? • How did it succeed? • How long have we been compromised? • How many machines are impacted? • How can it be stopped? B L O C K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. TYPICAL CYBERSECURITY WORKFLOW vs. TIME REQUIRED × ! ? “How are we finding these failures in our environment?” “How do we know we’re responding to the right alerts?” “How long does it take us to answer these questions?”
  • 35.
    C O NT I N U O U S A N A L Y S I S A N D R E T R O S P E C T I V E S E C U R I T Y AMP blocks threats, but it doesn’t stop there. AMP uses big data analytics to continuously analyze the history of endpoint and network behavior in your environment – uncovering advanced threats and rewinding history to block them. T H E P O W E R O F C O N T E X T In real-time, AMP Appliances passively discover the environment they are protecting – mapping the vulnerabilities of each host. An attack leveraging actual vulnerabilities of the target host is a true top alerts. V I S I B I L I T Y + C O N T R O L Because AMP records the history of the environment, your team can quickly scroll back time to discover what happened. • Identify ‘patient zero’ – the first victim. • Determine the attack scope – how malware traversed the organization. • Contain the event, understanding all affected systems. • Remediate quickly, focusing on high-priority events and systems. • Prevent reinfection by identifying the root causes.
  • 36.
  • 37.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 37 4. REIMAGE AND RECOVER
  • 38.
    R E SP O N D T O A L E R T S Security tools generate 100’s, even 1,000’s of alerts each day. Any one of those could be a breach in progress. I N V E S T I G A T E I N C I D E N T S When a cybersecurity incident impacts the business, the business needs answers: • Where did it start? • How did it succeed? • How long have we been compromised? • How many machines are impacted? • How can it be stopped? B L O C K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. R E I M A G E + R E C O V E R Reimaging is not recovering. The average compromised machine remains undiscovered for 200+ days. × ! ? “How are we finding these failures in our environment?” “How do we know we’re responding to the right alerts?” “How long does it take us to answer these questions?” “How long does it take us to find the rest of the machines compromised by the same attack?”
  • 39.
    C O NT I N U O U S A N A L Y S I S A N D R E T R O S P E C T I V E S E C U R I T Y AMP blocks threats, but it doesn’t stop there. AMP uses big data analytics to continuously analyze the history of endpoint and network behavior in your environment – uncovering advanced threats and rewinding history to block them. T H E P O W E R O F C O N T E X T In real-time, AMP Appliances passively discover the environment they are protecting – mapping the vulnerabilities of each host. An attack leveraging actual vulnerabilities of the target host is a true top alerts. V I S I B I L I T Y + C O N T R O L Because AMP records the history of the environment, your team can quickly scroll back time to discover what happened. • Identify ‘patient zero’ – the first victim. • Determine the attack scope – how malware traversed the organization. • Contain the event, understanding all affected systems. • Remediate quickly, focusing on high-priority events and systems. • Prevent reinfection by identifying the root causes. S Y S T E M I C R E S P O N S E AMP works through the cloud, enforcing security response everywhere it is installed. Before we can react to alert, AMP is already blocking on the network, endpoints – even laptops off our network, email and web.
  • 40.
    Systemic Response • Example Movebeyond blind reimaging: • Identify root cause (review) • Roll back time even after reimaging
  • 41.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 41 5. IMPROVE DEFENSE
  • 42.
    R E SP O N D T O A L E R T S Security tools generate 100’s, even 1,000’s of alerts each day. Any one of those could be a breach in progress. I N V E S T I G A T E I N C I D E N T S When a cybersecurity incident impacts the business, the business needs answers: • Where did it start? • How did it succeed? • How long have we been compromised? • How many machines are impacted? • How can it be stopped? B L O C K Protection fails. Today, 1.5M unique threats will be discovered – even 99.9% protection will fail 1,500 times. R E I M A G E + R E C O V E R Reimaging is not recovering. The average compromised machine remains undiscovered for 200+ days. I M P R O V E D E F E N S E Reducing the attack surface means upgrading security policy – but the average organization manages 34-55 security tools. TYPICAL CYBERSECURITY WORKFLOW vs. TIME REQUIRED × ! ? “How are we finding these failures in our environment?” “How do we know we’re responding to the right alerts?” “How long does it take us to answer these questions?” “How long does it take us to find the rest of the machines compromised by the same attack?” “How long does it take us to redefine security in all our tools?”
  • 43.
    C O NT I N U O U S A N A L Y S I S A N D R E T R O S P E C T I V E S E C U R I T Y AMP blocks threats, but it doesn’t stop there. AMP uses big data analytics to continuously analyze the history of endpoint and network behavior in your environment – uncovering advanced threats and rewinding history to block them. T H E P O W E R O F C O N T E X T In real-time, AMP Appliances passively discover the environment they are protecting – mapping the vulnerabilities of each host. An attack leveraging actual vulnerabilities of the target host is a true top alerts. “AMP finds what our other tools miss” “We used to have to choose from 1,000’s of alerts…now we know the 4-6 critical alerts for our environment” “What used to take us 2 weeks or 2 months now takes us 2 minutes” “Instead of spending 4 hours each day chasing our tools, we’re blocking everywhere, automatically”“It would have taken 2 hours a day to do what’s being done automatically ” V I S I B I L I T Y + C O N T R O L Because AMP records the history of the environment, your team can quickly scroll back time to discover what happened. • Identify ‘patient zero’ – the first victim. • Determine the attack scope – how malware traversed the organization. • Contain the event, understanding all affected systems. • Remediate quickly, focusing on high-priority events and systems. • Prevent reinfection by identifying the root causes. S Y S T E M I C R E S P O N S E AMP works through the cloud, enforcing security response everywhere it is installed. Before we can react to alert, AMP is already blocking on the network, endpoints – even laptops off our network, email and web. S H A R E D S E C U R I T Y I N T E L L I G E N C E With AMP ThreatGrid, both Cisco industry partners and non- Cisco solutions can benefit from dynamic analysis executed by AMP, automatically improving your defense.
  • 44.
    Integration • How sharingThreat Intelligence works • Adding integration • Invitation to review your environment?
  • 45.
    © 2014 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential 45 Shares the results of dynamic analysis (sandboxing) of your files, and threat intelligence feeds, with your existing security. • Firewall • IPS/IDS • Gatway/Proxy • Network Taps • SIEM • Log Management • Endpoint Security • Other tools THREATGRID TG THREATGRID OR
  • 46.
    NEXT STEPS 1. “CiscoAMP” 2. Scoping Call 3. Custom Demo 4. POC Sean Earhard seearhar@cisco.com / 647-988-4945