Downloaded 49 times
Uploaded byCisco Russia
Cisco Cyber Threat Defense
Документ описывает решения Cisco для обеспечения киберзащиты, акцентируя внимание на методах обнаружения угроз и важности видимости всей сетевой активности. Он подчеркивает необходимость контроля за всеми устройствами и пользователями в сети, а также интеграцию различных инструментов для анализа угроз. Также рассматриваются аспекты управления и анализа данных о трафике для предотвращения атак и утечек информации.
More Related Content
Similar to Cisco Cyber Threat Defense
Cisco Cyber Threat Defense
- 1. Cisco Cyber ThreatDefense Алексей Лукацкий Бизнес-консультант по безопасности Cisco
- 2. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 2 СЕТЬ MOBILITYMOBILITY COLLABORATIONCOLLABORATION CLOUD НОВАЯ КАРТИНА УГРОЗ СНИЖЕНИЕ КОНТРОЛЯ
- 3. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 3 • Множество продуктов, политик, неуправляемых и чужих устройств, а также доступ в облака Межсетевые экраны, системы предотвращения вторжений, антивирусы, системы контентной фильтрации, средства защиты баз данных и порталов и т.п.
- 4. © Компания Ciscoи (или) ее дочерние компании, 2012 г. Все права защищены. Конфиденциальная информация Cisco 4
- 5. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 5 Слайд 5 Шпионаж РазрушениеМанипуляция Script Kiddies Группы хактивистов Организованная преступность Спец службы
- 6. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 6 Устройства периметра Контроль и управление Сетевая разведка и распространение Кража данных Целевые угрозы зачастую обходят периметр Только вся сеть целиком имеет достаточный уровень наблюдаемости для выявления сложных угроз
- 7. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 7 Advanced Persistent Threats и другие угрозы построянно проходят ваш периметр – это их правило прорыва и необходимое условие распространеня. Они играют не по правилам. ‘break the rules’. X X X X O X X X O O
- 8. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 8 Ваша сеть СКОМПРОМЕНТИРОВАНА Вы знаете где?
- 9. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 9 • Страна? Конкуренты? Частные лица?Кто? • Что является целью?Что? • Когда атака наиболее активна и с чем это связано?Когда? • Где атакующие? Где они наиболее успешны?Где? • Зачем они атакуют – что конкретно их цель?Зачем? • Как они атакуют – Zero-day? Известные уязвимости? Инсайдер?Как?
- 10. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 10 • Кто в моей сети? Кто? • Что делают пользователи? Приложения? • Что считать нормальным поведением?Что? • Устройства в сети? Что считать нормальным состоянием?Когда? • Где и откуда пользователи попадают в сеть? • Внутренние? eCommerce? Внешние?Где? • Зачем они используют конкретные приложения?Зачем? • Как всѐ это попадает в сеть? Как?
- 11. © Компания Ciscoи (или) ее дочерние компании, 2012 г. Все права защищены. Конфиденциальная информация Cisco 11
- 12. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 12 СЕТЬ Видимость всего трафика Маршрутизация всех запросов Источники всех данных Контроль всех данных Управление всеми устройствами Контроль всех пользователей Контроль всех потоков
- 13. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 13 Интегрированная архитектура ИБ Локальный и глобальный анализ угроз Общие политика & Управление Сеть, реализующая политику Многофункциона- льное устройство Анализ угроз Политика & Управление Hardware Сеть Одноцелевое устройство Network Security Content Security Ана- лиз угроз Policy & Mgmt HW Ана- лиз угроз Policy & Mgmt HW Сеть Cisco SecureX обеспечивает: • Понимание контекста • Всесторонний обзор • Масштабируемый контроль • Динамическая адаптация к новым угрозам • Защита данных и приложений
- 14. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 14 Всесторонний обзор и масштабируемый контроль Глобальный и локальный анализ угроз Общие политика и управление Информация Реализация Behavioral Analysis Encryption Identity Awareness Device Visibility Policy Enforcement Access Control Threat Defense Sees All Traffic Routes All Requests Sources All Data Controls All Flows Handles All Devices Touches All UsersShapes All Streams Сеть, реализующая политику
- 15. © Компания Ciscoи (или) ее дочерние компании, 2012 г. Все права защищены. Конфиденциальная информация Cisco 15
- 16. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 16 Обнаружение угроз на базе сигнатур / репутации Обнаружение угроз на базе аномалий Сетевой периметр МСЭ IPS/IDS Обманные системы Внутренняя сеть Контентная фильтрация Web/Email трафика Cisco Cyber Threat Defense
- 18. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 18 PerformanceandScalability ЦОДКампусФилиалыSOHO Периметр ASA5585-S60P60 ASA5585-S40P40 ASA5585-S20P20 ASA5585-S10P10 IPS 4510, 4520 IPS-4270 4345 (Saleen) Mar 2012 4360 (Saleen) Mar 2012 IDSM-2 ASA-SSM-40 ASA-SSM-20 ASA-SSM-10 ASA-SSC-5 IPS-4240 IPS-4255 IPS-4260 ISR-NME ISR-AIM
- 19. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 19 A B C C B A CA B
- 20. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 20
- 21. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 21 • Из всех критичных и важных точек
- 22. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 22 Выборочный трафик • Часть трафика, обычно менее 5%, • Дает быстрый взгляд в сеть Похоже на чтение каждой 20-й страницы книги. Технической книги-справочника ПОЛНЫЙ трафик • Весь трафик подлежит сбору • Предоставляет исчерпывающий обзор всей сетевой активности • Эквивалент внимательного постраничного чтения + пометки на полях + закладки Выборка полезна для мониторинга сети, но не для безопасности
- 23. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 23
- 24. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 24
- 25. © Компания Ciscoи (или) ее дочерние компании, 2012 г. Все права защищены. Конфиденциальная информация Cisco 25
- 26. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 26 Решение по мониторингу на основе NetFlow, которое предоставляет действенное понимание в отношении производительности и безопасности, а также сокращает время расследования подозрительного поведения • Признанный игрок рынка мониторинга сети и безопасности • Cisco Solutions Plus Product Общие дизайны Cisco+Lancope Совместные инвестиции в развитие Доступность в канале продаж Cisco • Отличный уровень сотрудничества с Cisco
- 27. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 27 TrustSec Enabled Enterprise Network Identity Services Engine NetFlow: Switches, Routers, и ASA 5500 Контекст: NBAR/AVC Cisco Cyber Threat Detection - повышает эффективность и действенность анализа и обеспечивает ключевое понимание внутренней активности в сети Телеметрия NetFlow Cisco Switches, Routers и ASA 5500 Данные о контексте угрозы Cisco Identity, Device, Posture, Application
- 28. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 28 Cisco Network StealthWatch FlowCollector StealthWatch Management Console NetFlow StealthWatch FlowSensor StealthWatch FlowSensor VE Users/Devices Cisco ISE NetFlow StealthWatch FlowReplicator Другие коллекторы https https NBAR NSEL
- 29. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 29 • Обнаружение брешей в настройках МСЭ • Обнаружение незащищенных коммуникаций • Обнаружение P2P-трафика • Обнаружение неавторизованной установки локального Web-сервера или точки доступа • Обнаружение попыток несанкционированного доступа • Обнаружение ботнетов (командных серверов) • Обнаружение атак «отказ в обслуживании» • Обнаружение инсайдеров • Расследование инцидентов • Troubleshooting
- 30. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 30 Что делает 10.10.101.89? Политика Время начала Тревога Источник Source Host Groups Цель Детали Desktops & Trusted Wireless Янв 3, 2013 Вероятная утечка данных 10.10.101.89 Атланта, Десктопы Множество хостов Наблюдается 5.33 Гб. Политика позволяет максимум до 500 Мб
- 31. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 31 Высокий Concern Index показывает значительное количество подозрительных событий Группа узлов Узел CI CI% Тревога Предупреждения Desktops 10.10.101.118 338,137,280 8,656 % High Concern index Ping, Ping_Scan, TCP_Scan Слежение за активностью как одного узла, так и группы узлов
- 32. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 32
- 33. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 33 C I2 I4 A ЛОКАЛЬНО Бизнес Контекст Кто Что Как Откуда Когда Внутри ВАШЕЙ сети ГЛОБАЛЬНО Ситуационный анализ угроз Снаружи ВАШЕЙ сети Репутация Взаимо- действия APP Приложения URL Сайты
- 34. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 34 Users/Devices Cisco Identity Services Engine (ISE) Network Based Application Recognition (NBAR) NetFlow Secure Event Logging (NSEL) Связь потоков с пользователями и конечными устройствами Связь потоков с приложениями, идущими через маршрутизаторы Связь потоков с разрешенными и заблокированными соединениями на МСЭ
- 35. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 35 ISEISE Ролевая функция — одна или несколько из следующих: •Администрирование •Мониторинг •Сервис политик Оценка состояния в потоке трафика Сервис политикМониторингАдминистри рование Одиночный узел ISE (устройство или виртуальная машина) Одиночный узел оценки состояния на пути трафика (только устройство)
- 36. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 36 Оконечное устройство РесурсРеализация Внешние данныеПросмотр / настройка политик Атрибуты запросов Запрос доступа Доступ к ресурсу Ведение журналов Контекст запроса / ответа Мониторинг Просмотр журналов/ отчетов Ведение журналов Ведение журналов Админист- рирование Сервис политик
- 37. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 37 • Cisco ISE – унифицированная система управления и контроля защищенным доступом к внутренним ресурсам Политика Время старта Тревога Источник Группа хостов источника Имя пользователя Тип устройства Цель Desktops & Trusted Wireless Янв 3, 2013 Вероятная утечка данных 10.10.101.89 Атланта, Десктопы Джон Смит Apple-iPad Множество хостов
- 38. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 38 • Поле Flow Action может добавить дополнительный контекст • NSEL-отчетность на основе состояний для поведенческого анализа Сбор информации о отклоненных или разрешенных соединениях
- 39. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 39 Cisco ISE Management StealthWatch Management Console StealthWatch FlowCollector Сбор и анализ З NetFlow записей Корреляция и отображение потоков, идентификационные данные Cisco TrustSec: Access Control, Profiling and Posture NetFlow Capable Devices Catalyst® 3750-X Catalyst® 3560-X Catalyst® 5500 Catalyst® 4500 Access Point Access Point Access BranchCampus Distribution Catalyst® 3750-X Stack WLC Catalyst® 6500 Catalyst® 6500 Edge Site-to- Site VPN ASA ISR-G2 Remote Access NetFlow Identity Масштабируемая NetFlow инфраструктура AAA services, profiling and posture assessment
- 40. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 40 • Получение данные от сетевого оборудования с NetFlow, а также от сенсоров без поддержке NetFlow (например, VMware ESX) • До 120.000 потоков в секунду на коллектор (до 3 миллионов на кластер) • Понимание контекста
- 41. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 41 InternetAtlanta San Jose New York ASR-1000 Cat6k UCS с Nexus 1000v ASA Cat6k 3925 ISR 3560-X 3850 Stack(s) Cat4kDatacenter WAN DM Z Access
- 42. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 42
- 43. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 43
- 44. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 44 Обнаружение разных типов атак, включая DDoS Детальная статистика о всех атаках, обнаруженных в сети
- 45. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 45 Предполагаемая утечка данных Слишком высокий показатель совместного использования файлов Достигнуто максимальное количество обслуженных потоков
- 46. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 46 Когда? Сколько? УчастникУчастник Каким образом?
- 47. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 47 Выберите узел для исследования Поиск исходящего трафика
- 48. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 48 Сервер, DNS и страна Тип трафика и объем
- 49. © Компания Ciscoи (или) ее дочерние компании, 2012 г. Все права защищены. Конфиденциальная информация Cisco 49
- 50. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 50 • Оценка готовности сети (Netflow-enabled сеть) • Проектирование • Пилотирование • Ограниченная продуктивная эксплуатация • Расширение на всю сеть • Интеграция с Cisco ISE • Применение для оптимизации правил защиты на других устройствах сети: МСЭ, IPS/IDS, ESA, WSA, ACL коммутатора, отражение DDoS • Построение процесса «Cyber Threat Defense»
- 51. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 51 Сидней Токио 13 миллиардов потоков / день 600 Гб / день Хранение в течение 90 дней Бангалор Амстердам RTP SJC
- 52. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 52 • Заказчики с Security Operations Center • Любая сделка по ISE • Виртуализированные среды • Каждая модернизация ядра сети • Любая 10Gbps сеть • Заказчик, подпадающий под требование нормативных актов • Заказчики с указанными проблемами: Проблема видимости сети Ботнеты Утечки данных Сетевое сканирование Распространение вредоносного кода BYOD
- 53. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 53 • Большое предприятие со следующими исходными данными Общий объем потоков - 150,000 fps (потоков в секунду) Сеть разделена на три географических региона, каждый из которых генерит до 70,000 fps трафика в пике, но не одновременно Старое средство мониторинга уже используется для анализа NetFlow в одном регионе; до 35,000 fps. Это позволит установить FlowReplicator в этом регионе 14 ESX узлов в ЦОДе требуют мониторинга трафика виртуальных машин Отказоустойчивый резервный SMC требуется
- 54. © Компания Ciscoи (или) ее дочерние компании, 2013 г. Все права защищены. 54 Заказ для большого предприятия
Editor's Notes
- #3 #1 Security is a critical component of all the transformational shifts happening in the IT industry at large, and further, the network is becoming more relevant. #2 These transitions are changing the security model…go to next slide.
- #4 Visibility into the new network isn’t the only challenge that IT faces. There continues to be a lingering disconnect between the goals and objectives of the Network and Security teams. What is needed is a holistic approach that addresses the big picture that the CEO is facing. You need a solution that drives these different objectives towards each other – that enables business acceleration while securing the entire distributed environment. But how do you do that?
- #6 As networks and users become more sophisticated so do the kinds of threats organizations are required to deal with. Gone are the days of nuisance viruses and website vandalism as our primary concerns. As the network becomes more important, the threats have become more serious – with the potential for a wider impact on organizations than ever before to
- #7 Transcript: Perimeter security alone is no longer sufficient. As an example, what happens is an attacker might be able to infect a host outside of the purview of an organization. This might be a Starbucks. This might be through a spear phishing attack, or a LinkedIn message, something that's outside of the purview of an organization. And that threat is then moved inside of the security perimeter, bypassing many of our security perimeter devices. And once inside the perimeter, we'll see a command and control channel that'll open up. And the attacker is then able to do some level of reconnaissance and infection spreading throughout the organization to execute against their objectives. Many times, the objective of this attack is going to be data loss. Now, it could be something else. The attacker might have infiltrated this organization for the purposes of disruption. They might decide to do a denial of service attack against the internal server here, shut down the operations of the organization. But many times, like I said, it will be data loss, and so we'll do some data theft. Now, when we're looking at attacks like this-- so we saw this device bypass the security perimeter. So only the network at this point has the appropriate level visibility to detect these threats, is able to track the spread of infection throughout the interior of the network, and be able to have the right level of visibility and intelligence to detect and allow our customers to defend themselves against these threats. Author's Original Notes:
- #9 Interesting things to note: Each data breach results in companies losing ~3.7% of customers and 100% of these breaches the perpetrators used perfectly valid credentials!2012 PonemonAverage global cost to an organization for data breach is $3.4 MSony 2011 PlayStation Network breach cost $170 MEach data breach results in companies losing ~3.7% of customers2012 Verizon Data Breach Investigations Report 96% of attacks investigated were not highly difficult97% were avoidable through simple or intermediate controls85% of breaches took weeks or more to discoverMandiant 2012 survey Organizations were compromised ~ 416 days before attackers were discovered In 100% of cases, the bad guys used valid credentialsEach incident was discovered by 3rd party only
- #14 An added benefit is that the integration of security into the network also enables and supports the consolidation of the network infrastructure. As the network transitions to a broad and dynamic business environment, security based on that network moves from an overlay solutions to an actual security architecture integrated into the network environment.
- #15 Embedding Security within the infrastructure of the network achieves comprehensive visibility and scalable enforcement. Visibility from the network drives up into the organization’s policy. Cloud-Based Global Threat Intelligence with the absolutely latest threat landscape is applied and enforcement is pushed back down into the network. The network is changing from a source of information to a series of enforcement points.
- #17 The first step in defending against these attacks is to adopt a different strategy. This table categorizes common defense systems by where they are deployed – at the perimeter or network interior, and by their detection strategy – signature/reputation-based or behavioral-based.Cisco has traditionally positioned security products at the network perimeter using signature and reputation-based methods. On the network interior, application-oriented security products such as email and web content inspection can also use signature and reputation-based methods.All of these products are very good at eliminating known threats. However, advanced persistent threats are typically not known in advance. Signature-based security solutions are not usually very effective against them.The alternative to this type of detection is behavior-based detection. This method uses pattern recognition technologies to determine when network traffic patterns are abnormal, signaling a possible attack.In order to defend against against advanced persistent threats, behavior-based detection technology provides an edge because it doesn’t require foreknowledge of the attack – just recognition of the attack pattern.At the network perimeter, the traditional behavior-based security product is the Honeypot. This is an interesting technology but used mostly for forensics and is beyond the scope of our discussion.Cisco’s Cyber Threat Defense Solution operates on the network interior and is specifically designed to use of behavior-based threat detection.
- #19 Notes:Cisco’s portfolio is broader than any other. That helped build our market share and deployment coverage but those devices are very old.Furhter we recognize that we are trying to sell stand-alone IPSs that extend too far down in the speed continuum and not high enough.In March we replace the 4240 / 4255 / and 4260 with the 4345 and 4360. We drive lower level IPS to the integrated FW/IPS offerings that are in the 55xx family.The 4270 continues to be the only stand-alone IPS with 10G interfaces and fail-over. We continue to sell that until we deliver the Glen Rose product in the summer.
- #20 In conjunction with IDS, Netflow is one of our top two data sources.We process 13 billion netflow records each day across the enterprise.So what is it?Netflow is analogous to a phone record in that it shows who communicated with whom at what time, and for how long. We can therefore see: source address, destination address, number of packets transferred during that session, and a timestamp of the session.
- #21 The key to Cisco’s Cyber Threat Defense Solution is NetFlow. NetFlow is a very simple technology that Cisco created in the early 90s as a way of providing visibility into the network.As data flows between a source and destination, Cisco equipment collects key information about that data and sends it to a device called a NetFlow Collector.This exchange of data is called a “flow”. Flows can tell you what kind of data was exchanged, how much, and at what rate. The information in a flow can be used to describe network behaviors, and by applying the correct analysis, can also be used to detect threats.
- #22 The key to Cisco’s Cyber Threat Defense Solution is NetFlow. NetFlow is a very simple technology that Cisco created in the early 90s as a way of providing visibility into the network.As data flows between a source and destination, Cisco equipment collects key information about that data and sends it to a device called a NetFlow Collector.This exchange of data is called a “flow”. Flows can tell you what kind of data was exchanged, how much, and at what rate. The information in a flow can be used to describe network behaviors, and by applying the correct analysis, can also be used to detect threats.
- #29 There are several key pieces of this solution.The solution starts with NetFlow enabled switches and routers providing flow data, NBAR, and NSEL events to a flow collector. This flow collector analyzes NetFlow for the tell-tale signs of threats propagating inside the network.The Lancope StealthWatch console then displays the data along with with any alerts about suspicious activity.<Next>If you have a place in your network where you can’t generate NetFlow data, a supplemental device called a FlowSensor solves that problem for you.It generates NetFlow from a raw packet stream. There is even a version of a FlowSensor for use in virtualized environments.<Next>One really clever part of the solution is the FlowReplicator. This device sends one stream of NetFlow data to multiple destinations. This is really handy if you have multiple different NetFlow analysis systems.<Next>Finally, the StealthWatch Management Console polls the Cisco ISE appliance for user identity, device, and profile information, and unifies all of this data in a single console.
- #32 Transcript: They themselves have been a NetFlow collector for close to 10 years now. They most likely will support previous versions of NetFlow, and older versions of Cisco equipment other than the ones that are on this chart. These are the tested components that Cisco has tested. There is a design and implementation guide that can fall into a Cisco validated design category, using these versions of devices. Now, when we talk with the Identity Services Engine integration into the solution, it does require this release, the ISE 1.1.1 release with StealthWatch 6.3 release. 1.2 has not yet been tested. When we get to testing ISE 1.2, it will be with StealthWatch 6.4. And that will be Cyber Threat Defense Solution 1.2 release. Author's Original Notes:
- #33 Context helps put information into perspective. Is this the letter B or the number 13?
- #34 Context helps us determine whether information is important.We gather local intelligence - the Who, What, How, Where, and When – from the network: Who is on my network, what is the device, how is the user coming on to the network – wired, wireless, or VPN, where is it coming from - inside or outside of the network, where are they going once they are on the network, and when are they coming in? For example, is it 2PM or 2AM? And we gather critical information from Cisco’s global threat analysis system called the Cisco Security Intelligence Operations.
- #35 But what about context? What if we want to know who generated a specific flow? Or what application data is responsible for it? What if we need to know that flow is leaving the enterprise, and if it violates any firewall rules?Cisco adds additional context to NetFlow data with three key technologies.First, Cisco uses a product called Identity Services Engine to link flows with user identity. ISE tracks users as they connect to the network, profiles their devices, and restricts their access to only what is approved. Next, we gain application context through the use of routers that support Network Based Application Recognition. This technology can dig out key application information from a stream while data flows through it.Finally, we collect additional information from ASA firewalls that support NetFlow Secure Event Logging. This is a special form of log event that is reported using NetFlow and helps identify accepted and rejected connections.
- #39 Flow Action field can provide additional contextState-based NSEL reporting is taken into consideration in StealthWatch’s behavioral analysisConcern Index points accumulated for Flow Denied eventsNAT stitching
- #40 Transcript: Breaking down those components in the architecture, we start with the access layer. So inside the access layer, which is actually, in the BYOD world, the new network edge. This is where the device is actually coming into the network now and where threats are arriving. We're looking at trying to add security telemetry right down to the access layer. And with the changes throughout switching the line over the last year and half, it actually has become possible, as Mark was talking about, to do this in a non-performance-impacting way. So you can get this visibility as threats enter the network and when they even never leave the access switch. So let's say you've got an attack that comes into this access switch and then moves over to the next access switch without ever leaving that switch, you can still get a source of telemetry and still be able to see that propagation of that particular piece of malware throughout the network. And then, of course, it's scaled throughout the entire network infrastructure so you have complete visibility, access, core, edge, and end. So what is now new edge through old edge, complete visibility. So we get NetFlow goes to the FlowCollector, which, again, is where collecting and analyzing happens. And I know many of you are looking at this diagram, and you go, Matt, you've got NetFlow at three different layers of the network. That collector's going to get a flow record for a flow from many different devices. So let's say you've got a client server versus three devices between that flow, you'll get three NetFlow records to the collector. Now, one of the very key components that differentiates StealthWatch flow system from most other vendors, and particularly any open-source vendor, is something called flow deduplication. A significant amount of engineering has gone into this. And what that means is when you get those three records, it creates one database entry for that flow. Now, it doesn't just ignore all the details. Because if it goes from this switch to this switch to this router, you're going to have interface statistics that traces the path of that packet through the network, it saves those. So it's kind of exclusive ors whatever records it sees, saves all relevant information, puts that in the database. And what's also really interesting, if you've got an NetFlow Version 9 record with some fields, NetFlow Version 5 with some fields, NetFlow Version 9 with other fields, again, exclusive or, full set put into the database. Another very important piece that FlowCollector does that, again, also differentiates it from any competitors, is the flow-stitching capability. So NetFlow is uni-directional-- client to server, server to client. You get a record for each direction. Inside the FlowCollector, they're stitched together, one record in the database. Also kind of a lot of engineering required to do this correctly. So we'll have the Cisco ISE down here, which we've already talked about, and again, the StealthWatch Management Console, which is where you're going to be able to view flow data and attribution data, and you're going to run your queries, reports, and actually visualize the data that we've talked about, the security telemetry. Author's Original Notes:All of these components are available today
- #43 Flow Action field can provide additional contextState-based NSEL reporting is taken into consideration in StealthWatch’s behavioral analysisConcern Index points accumulated for Flow Denied eventsNAT stitching
- #44 CSIRT utilizes a tool called Lancope that allows us to query netflow data as well as setup alerts and special monitoring based off of flow traffic
- #53 Transcript: So identifying opportunities-- generally, customers that have a security operation center. I like to use an analogy that you're looking at a customer that has private security firms. If they have somebody driving a truck in a campus or a security guard, what they've done is basically look at security as a cost center to the organization. They see the need to invest in security, and it's relatively easy to position these products there. It's harder to position at places that don't see security is a constant center, and see it as a hindrance or an annoyance to their operation. Any time there is an ISE opportunity, you can help position this as additional value that an ISE might offer, being able to take advantage of the telemetry that ISE offers, in addition to its policy management. Every time there's a core refresh, this is to help drive the value of the physical infrastructure. Talk about our ability to do NetFlow over our competitors. This solution offers unique advantage to higher education customers. Many higher education customers are faced with daily complaints from the RIAA saying, your IP address space is doing illegal file sharing, and they're unable to investigate this because it's their global IP address and they have no visibility through their NAT translations. This solution helps to provide visibility there. But generally, any customers with the listed use cases, which is advanced persistent threats, internally spreading malware, botnets, data leakage, network reconnaisance, BYOD problems, being able to get visibility into the internal network. Author's Original Notes:Identifying potential customers is actually a fairly straightforward process.Primarily, you’re looking for customers with any of the problems listed here. The good news is, most customers have at least one of these problems that they have not been able to solve.In addition, certain verticals will be immediately drawn to the solution because they are subject to regulatory compliance, or are worried about legal liability issues, especially for student behavior in Higher Ed.
- #54 Transcript: So as an example configuration of what we see, this is an example using a large enterprise. So a large enterprise, for example, might be Cisco. Cisco is a Lancope StealthWatch user-- one of their largest customers, actually. So a for example might be a flow volume of up to 150,000 flows per second. Now, the StealthWatch system is licensed on flows per second. Much like Security Information Event Management or SIM solutions are licensed on events per second, StealthWatch is licensed on flows per second. So most of the cost in the solution is going to be in the flows per second license. This is how they sell the software solution. So this example over all this large enterprise, flow volume of about 150,000 flows per second. The network is segmented into geographical regions. Some of them will generate traffic bursts of over 70,000 flows per second at peak traffic, but it's not all at the same time. Now, this particular example has a legacy network monitoring tool already established, meaning that they have somebody already collecting NetFlow for network management. And this solution has seen up to 35,000 flows per second in this particular spot. So this example requires that a flow replicator be in place to help maintain the value that the customer already has in that legacy tool. This customer also has ESX hosts, and they require monitoring of a VM network. They also want to have a redundant deployment in their management console. Author's Original Notes:
- #55 Transcript: So this is an example bill of materials that would show up, total of about $1.8 million. A significant portion that cost, like I mentioned, will be in the flow per second licensing. They'll also, in this case, because they wanted a redundant SMC, purchased two SMCs, multiple different flow collectors for their geographic regions. Because of the scale of the deployments-- up to 70,000-- we went with the largest physical flow collector that they had available, the flow collector 4000. We've also added some virtual sensors to monitor the VM environment, and the flow replicator, as mentioned. Author's Original Notes:
- #66 Cisco combines all of these capabilities into a single integrated security solution designed to answer the “who” “what” “where” “when” and “how” of advanced persistent threats.To bring this solution to market, Cisco has partnered with Lancope to unite the flow data and context of a Cisco network infrastructure, with the threat analysis and visibility of Lancope’s StealthWatch system.<Next>In this solution, Cisco provides the network infrastructure that delivers flow data and rich security context. We begin by deploying access layer switches. These switches have Cisco’s hardware-enabled NetFlow capability. That means they can keep up with even the most demanding traffic loads. As devices connect to the network, these access layer switches “track” all of this data as “flows”<Next>Next, we collect some additional context surrounding these flows using the key Cisco security context technologies we just discussed. This includes user identity data, firewall events, and application identity data. <Next>Finally, we unite all of this information into a rich security context that links the flow data with the user identity and applications that generated it.Using the Lancope StealthWatch system, all of this information is expressed in a single pane of glass.<Next> The result is an integrated network security solution that provides the correct level of threat visibility, context and control needed to combat today’s sophisticated threats.