Cloud-based security tailored to fit MSSPs
Cisco Endpoint Security for MSSPs
Customers Need Help with Endpoint Security
Organizations lack the resources necessary to respond to advanced threats on the endpoint
Lack of
Available Budget
Over half of the security
professionals named cost
efficiency and unbiased
insight as the top reasons to
outsource security
Diverse Endpoint
Ecosystems
Mobile and flexible workforces
have introduced a diverse set of
endpoint types and increased
complexity of environment
Evasion Techniques
Advancing
Today’s threats employ advanced
evasion techniques designed
specifically to get around
preventative security tools
Lack of Available
Security Talent
(ISC)2 estimates that the number
of unfilled cybersecurity jobs will
rise to 1.8 million by 2022
Cloud-Based Endpoint Portfolio
Visibility
Gain visibility into file and Internet
activity across devices
Control
Manage and control all endpoint
devices and security policies.
Security
Prevent breaches, block malware,
and uncover stealthy attacks.
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Increasing Demand
for Managed
Security Services
Outsourcing security enables organizations to concentrate on
what matters most
0.0%
10.0%
20.0%
30.0%
40.0%
50.0%
60.0%
70.0%
80.0%
Yes - In the last
12 months
Plan to in the
next 12 months
Have not/No
Plans
US
WE
AP
Mexico
Q: Have you engaged with a security services
provider for Cloud Managed SaaS-security?
MSSP Market Transitioning to cloud
Cloud-based security service revenue totaled $9.1B in CY16
13%Up from $8.1B in CY15
43%The market will grow
over the next 5 years to
$13.1B in CY21
7.5%CY16 to CY21 CAGR
1995 2007 2009 2013 2014 2015 2016 2017
Cisco is Investing in Security Growth
Unrivaled Global Threat Research and Intelligence
Identify advanced threats Get specific intelligence Catch stealthy threats Stay protected with updates
Endpoints
Devices
Networks
NGIPS
WWW Web
250+
Researchers
24 x 7 x 365
Operations
Security Coverage Research ResponseThreat Intelligence
1.5M
daily malware
samples
600B
daily email
messages
16B
daily web
requests
120TB
data received
daily
Portfolio Benefits/Features
Multitenancy
Add, move, and change
customers while keeping client
environments separate
Centralized Reporting
Keep customers informed
through automated,
customizable reports
API integrations
Easily integrate Cisco
solutions with your portfolio
and management systems
Easy service creation
Deploy advanced cloud-based
security solutions quickly
The Portfolio
Umbrella
Provide protection against threats on the
Internet across all devices, even when users are
off the corporate network
AMP for Endpoints
Prevent, detect, and respond to advanced
threats while continuously monitoring file
behavior to uncover stealthy attacks
AMP for Endpoints
What is Cisco AMP for Endpoints?
Prevent
Prevent attacks and block malware
in real time
Detect
Continuously monitor to
reduce time to detection
Respond
Accelerate investigations and
remediate faster and more
effectively
What is Cisco AMP for Endpoints?
Next-generation endpoint security
Cloud managed across multitenant platform
Lightweight connector
Available for Windows, Mac, Linux, iOS, and Android
MSSP AMP for Endpoints Benefits
No hardware, all cloud managed (private cloud option available)
Reuse and redeploy licenses among your customers as
business requires.
Simply deploy software solutions when and where you need them
Post-paid OPEX utility based pricing with no up-front licensing costs
Managed AMP Endpoint Customer Deployments
Customer AMP
Endpoint
ThreatGrid File Analysis
Submission and Reports
AMP Endpoint
Management Services
Provisioning Users
Connector Deployment
Management & Monitoring
Response
Ongoing Support
MSSP AMP Solutions AMP MSSP Portal
AMP Public Cloud
Customer 1 Customer 2 Customer 3
AMP MSSP
(customer)
REST API
MSSP SOC
Customer 1
Endpoints
Customer 2
Endpoint
Customer 3
Endpoints
MSSP Provides A4E Connector download link
and/or installation package to individual customers
AMP for Endpoints MSSP Console
- Rick Chapman, CTO, InterVision Systems LLC
“AMP’s multitenant, cloud-based
delivery model has made it easier than
ever to introduce enhanced security
services to our customers with no
upfront costs.”
Umbrella
Cisco Umbrella
Built into the foundation of the internet
Intelligence to see attacks before launched
Visibility and protection everywhere
Enterprise-wide deployment in minutes
Integrations to amplify existing investments
208.67.222.222
Malware
C2 Callbacks
Phishing
Cloud Security platform
Centralized settings | MSSP admins | Centralized reports
MSSP Organization
Subscription Admin &
Settings
Reports
Customer 1 Customer 20K
Subscription Admin &
Settings
Reports
Centralized settings | MSSP admins | Centralized reports | Centralized S3 Log Management
Cisco Umbrella MSSP Offer
Umbrella Intelligence
Intelligence to stop threats earlier
Your Current
Security Stack
Integrations to amplify
existing security
MSSP Threat Analysis
and Intelligence
Maintain your intellectual
property secret
IOCs
MSSP threat analysis
and intelligence
Umbrella enforcement
and visibility
Domains
Automatically push newly discovered
malicious domains via API
Logs or blocks all internet activity
destined to these domains
Isolated only used for your customers
— no inspection or leakage
Intel uncovered by your teams remains your
secret sauce
Leverage our APIs to enforce your intelligence
Protect your customers while keeping your intellectual property secret
Available Packages Professional Insights Platform
Coverage: on-network
Any network device (by external IP)
Cisco ISR4K and WLAN (by VLAN/SSID)
Umbrella Virtual Appliance (by internal IP)
Coverage: anywhere
AnyConnect roaming module (for Win/Mac)
Umbrella roaming client (for Win/Mac)
Cisco Security Connector (for iOS)
Identity
External IP, VLAN/SSID*, host name/serial*
Internal IP*
Active Directory integration*
Enforcement
DNS-layer enforcement
IP-layer enforcement*
Enforcement: intelligence proxy
Malicious URL blocking
Custom URL blocking
File inspection (AV)
File inspection (Cisco AMP)
Enforcement: integrations
Partner integrations (pre-built)
Custom integrations (enforcement API)
Visibility: inside Umbrella
Basic logging and reports
Destination and identity reports
Cloud services reports
Visibility: outside Umbrella
Reporting API MSSP-only* MSSP-only* MSSP-only*
Log management (Amazon S3)
Centralized log management (Amazon S3) MSSP-only MSSP-only MSSP-only
Threat intelligence
Investigate console Sold separately Sold separately
Investigate API Sold separately Sold separately
Management Management API In production, not yet available
Support Basic support
*Available to *MSSPs but not end customer | In the future, will be available to end customers as well
MSSP
Umbrella for MSSPs Console
What sets Umbrella apart from Competitors
Fastest
And most reliable cloud infrastructure
Most Open
Platform for integration
Most Predictive
Intelligence to stop
threats earlier
Easiest
Connect-to-cloud
deployment
Broadest
Coverage of malicious
destinations and files
Cisco Endpoint Security for MSSPs

Cisco Endpoint Security for MSSPs

  • 1.
    Cloud-based security tailoredto fit MSSPs Cisco Endpoint Security for MSSPs
  • 2.
    Customers Need Helpwith Endpoint Security Organizations lack the resources necessary to respond to advanced threats on the endpoint Lack of Available Budget Over half of the security professionals named cost efficiency and unbiased insight as the top reasons to outsource security Diverse Endpoint Ecosystems Mobile and flexible workforces have introduced a diverse set of endpoint types and increased complexity of environment Evasion Techniques Advancing Today’s threats employ advanced evasion techniques designed specifically to get around preventative security tools Lack of Available Security Talent (ISC)2 estimates that the number of unfilled cybersecurity jobs will rise to 1.8 million by 2022
  • 3.
    Cloud-Based Endpoint Portfolio Visibility Gainvisibility into file and Internet activity across devices Control Manage and control all endpoint devices and security policies. Security Prevent breaches, block malware, and uncover stealthy attacks.
  • 4.
    © 2017 Ciscoand/or its affiliates. All rights reserved. Cisco Confidential Increasing Demand for Managed Security Services Outsourcing security enables organizations to concentrate on what matters most 0.0% 10.0% 20.0% 30.0% 40.0% 50.0% 60.0% 70.0% 80.0% Yes - In the last 12 months Plan to in the next 12 months Have not/No Plans US WE AP Mexico Q: Have you engaged with a security services provider for Cloud Managed SaaS-security?
  • 5.
    MSSP Market Transitioningto cloud Cloud-based security service revenue totaled $9.1B in CY16 13%Up from $8.1B in CY15 43%The market will grow over the next 5 years to $13.1B in CY21 7.5%CY16 to CY21 CAGR
  • 6.
    1995 2007 20092013 2014 2015 2016 2017 Cisco is Investing in Security Growth
  • 7.
    Unrivaled Global ThreatResearch and Intelligence Identify advanced threats Get specific intelligence Catch stealthy threats Stay protected with updates Endpoints Devices Networks NGIPS WWW Web 250+ Researchers 24 x 7 x 365 Operations Security Coverage Research ResponseThreat Intelligence 1.5M daily malware samples 600B daily email messages 16B daily web requests 120TB data received daily
  • 8.
    Portfolio Benefits/Features Multitenancy Add, move,and change customers while keeping client environments separate Centralized Reporting Keep customers informed through automated, customizable reports API integrations Easily integrate Cisco solutions with your portfolio and management systems Easy service creation Deploy advanced cloud-based security solutions quickly
  • 9.
    The Portfolio Umbrella Provide protectionagainst threats on the Internet across all devices, even when users are off the corporate network AMP for Endpoints Prevent, detect, and respond to advanced threats while continuously monitoring file behavior to uncover stealthy attacks
  • 10.
  • 11.
    What is CiscoAMP for Endpoints? Prevent Prevent attacks and block malware in real time Detect Continuously monitor to reduce time to detection Respond Accelerate investigations and remediate faster and more effectively
  • 12.
    What is CiscoAMP for Endpoints? Next-generation endpoint security Cloud managed across multitenant platform Lightweight connector Available for Windows, Mac, Linux, iOS, and Android
  • 13.
    MSSP AMP forEndpoints Benefits No hardware, all cloud managed (private cloud option available) Reuse and redeploy licenses among your customers as business requires. Simply deploy software solutions when and where you need them Post-paid OPEX utility based pricing with no up-front licensing costs
  • 14.
    Managed AMP EndpointCustomer Deployments Customer AMP Endpoint ThreatGrid File Analysis Submission and Reports AMP Endpoint Management Services Provisioning Users Connector Deployment Management & Monitoring Response Ongoing Support MSSP AMP Solutions AMP MSSP Portal AMP Public Cloud Customer 1 Customer 2 Customer 3 AMP MSSP (customer) REST API MSSP SOC Customer 1 Endpoints Customer 2 Endpoint Customer 3 Endpoints MSSP Provides A4E Connector download link and/or installation package to individual customers
  • 15.
    AMP for EndpointsMSSP Console
  • 16.
    - Rick Chapman,CTO, InterVision Systems LLC “AMP’s multitenant, cloud-based delivery model has made it easier than ever to introduce enhanced security services to our customers with no upfront costs.”
  • 17.
  • 18.
    Cisco Umbrella Built intothe foundation of the internet Intelligence to see attacks before launched Visibility and protection everywhere Enterprise-wide deployment in minutes Integrations to amplify existing investments 208.67.222.222 Malware C2 Callbacks Phishing Cloud Security platform
  • 19.
    Centralized settings |MSSP admins | Centralized reports MSSP Organization Subscription Admin & Settings Reports Customer 1 Customer 20K Subscription Admin & Settings Reports
  • 20.
    Centralized settings |MSSP admins | Centralized reports | Centralized S3 Log Management Cisco Umbrella MSSP Offer Umbrella Intelligence Intelligence to stop threats earlier Your Current Security Stack Integrations to amplify existing security MSSP Threat Analysis and Intelligence Maintain your intellectual property secret IOCs
  • 21.
    MSSP threat analysis andintelligence Umbrella enforcement and visibility Domains Automatically push newly discovered malicious domains via API Logs or blocks all internet activity destined to these domains Isolated only used for your customers — no inspection or leakage Intel uncovered by your teams remains your secret sauce Leverage our APIs to enforce your intelligence Protect your customers while keeping your intellectual property secret
  • 22.
    Available Packages ProfessionalInsights Platform Coverage: on-network Any network device (by external IP) Cisco ISR4K and WLAN (by VLAN/SSID) Umbrella Virtual Appliance (by internal IP) Coverage: anywhere AnyConnect roaming module (for Win/Mac) Umbrella roaming client (for Win/Mac) Cisco Security Connector (for iOS) Identity External IP, VLAN/SSID*, host name/serial* Internal IP* Active Directory integration* Enforcement DNS-layer enforcement IP-layer enforcement* Enforcement: intelligence proxy Malicious URL blocking Custom URL blocking File inspection (AV) File inspection (Cisco AMP) Enforcement: integrations Partner integrations (pre-built) Custom integrations (enforcement API) Visibility: inside Umbrella Basic logging and reports Destination and identity reports Cloud services reports Visibility: outside Umbrella Reporting API MSSP-only* MSSP-only* MSSP-only* Log management (Amazon S3) Centralized log management (Amazon S3) MSSP-only MSSP-only MSSP-only Threat intelligence Investigate console Sold separately Sold separately Investigate API Sold separately Sold separately Management Management API In production, not yet available Support Basic support *Available to *MSSPs but not end customer | In the future, will be available to end customers as well MSSP
  • 23.
  • 24.
    What sets Umbrellaapart from Competitors Fastest And most reliable cloud infrastructure Most Open Platform for integration Most Predictive Intelligence to stop threats earlier Easiest Connect-to-cloud deployment Broadest Coverage of malicious destinations and files