Next Generation Firewall · Cisco Firepower® 2100 Series Cisco Firepower 4100 Series Cisco...

Luc Billot

Cyber Security Technical Architect - Cisco

April 2019

Anticipate, block, and respond to threats

Next Generation Firewall

Why Cisco BoughtSourceFire ?

It is a 2.7 Billion $ question…

• SNORT

• VRT

• Immunet

• ClamAV

• FirePower

• FireSight

3rd Party Vuln Data

Security is an Integration Game

Firepower Management Center

AMP for Endpoints

DataThreatgrid

Stealthwatch

Web Security

Umbrella

EmailSecurity

LoggingSEIM

Orchestration

Investigate

TetrationAD

Sending Datato SEIM

API transaction

Identity from ISE

3rd Party ThreatIntelligence

PRODUCTS & INTELLIGENCE

Talos is the intelligence backbone for all Cisco Security Products and Services.

P R O D U C T S

D E T E C T I O N S E R V I C E S

ESA | ClamAV

SpamCop

SenderBase

Email Reputation

Malware

Protection

URL, Domain, IP

Reputation

Phishing

Protection

Spam Detection

Open Source

Snort Rules

ClamAV Sigs

ClamAV

Vulnerability

Protection

Malware

Protection

Policy & Control

End Point

ClamAV

Cloud & End

Point IOCs

Malware

Protection

IP Reputation

OpenDNS

URL, Domain, IP

Reputation

Malware

Protection

URL, Domain, IP

Reputation

Malware

Protection

Network

FirePower/ASA

Meraki

Policy & Control

Malware

Protection

URL, Domain, IP

Reputation

Vulnerability

Protection

Services

Cloud & End

Point IOCs

Malware

Protection

URL, Domain, IP

Reputation

Vulnerability

Protection

Custom

Protection

Intelligence

ThreatGrid

Cloud & End

Point IOCs

Malware

Protection

URL, Domain, IP

Reputation

Network

Protection

Product Protection Protection Protection

CWS N/A

Firewall

Threat Grid

Umbrella N/A

WSA N/A

NotPetyaJune 2017

WannaCryMay 2017

VPNFilterMay 2018

Cisco Firewalls have you covered

Automatic Threat Prevention

Security Intelligence, URL Filtering, DNS Sinkhole

Block or allow access to URLs and domains

Classify 280M+ URLs Filter sites using 80+ categories Manage Acceptable Use Policy Block latest malicious URLs

Category-based

Policy Creation

Allow Block

DNS Sinkhole

Security feeds

URL | IP | DNS

NGFWFiltering

BlockAllow

Safe Search

gambling

Next-Generation Intrusion Prevention System (NGIPS)

Understand threat details and quickly respond

Communications

App & Device Data

010111010010

10 010001101

010010 10 10

Data packets

Prioritize

response

Blended threats

• Network profiling

• Phishing attacks

• Innocuous payloads

• Infrequent callouts

Accept

Automate

policies

Scan network traffic Correlate data Detect stealthy threats Respond based on priority

Automated Impact Assessment

Correlates all intrusion events

to an impact of the attack against the target

Impact Flag Administrator Action Why

1 Act immediately; vulnerable

Event corresponds

to vulnerability mapped to

2Investigate;

potentially vulnerable

Relevant port open

or protocol in use,

but no vulnerability mapped

3Good to know; currently not

vulnerable

Relevant port not open or

protocol

not in use

4Good to know; unknown

target

Monitored network, but

unknown host

0Good to know; unknown

networkUnmonitored network

Indications of Compromise (IoCs) Detection & Threat Correlation

IPS Events

Malware Backdoors CnC Connections

Exploit KitsAdmin Privilege

Escalations

Web App Attacks

Security IntelligenceEvents

Connections to Known CnC IPs; DNS Servers,

Suspect URLs

MalwareEvents

Malware Detections Malware Executions

Office/PDF/Java Compromises

Dropper Infections

Firepower Recommendations Knows what I Do Not

0001110 1001 1101 1110011 0110011 101000 0110 00 0111000 111010011 101 1100001 110

1000111010011101 1100001110001110 1001 1101 1110011 0110011 101000 0110 00

0100001100001 1100 0111010011101 1100001110001110 1001 1101 1110011 0110011 101000 0110 00

Endpoints NetworkEmail DevicesIPS

File Fingerprint and Metadata

Process Information

Continuous feed

Continuous analysis

File and Network I/O

Breadth and Control points:

Telemetry Stream

Talos + Threat Grid Intelligence

TrajectoryBehavioral

Indications

of Compromise

Threat

Hunting

Retrospective

Detection

Advanced Malware Protection (AMP)

Uncover hidden threats in the environment

AMP in Action

Focus on these users first

These applications are affected

The breach impacted

these areas

This is the scope of exposure

over time

Here is the origin and

progression

of the threat

Network and Endpoint CorrelationIN FIREPOWER MANAGEMENT CENTER

4.6 HoursMedian time to detection

with Cisco security*

WeeksIndustry average time

to detection

The results speak for themselves

* Source: Cisco 2018 Annual CyberSecurity Report

Network and Security

Visibility and Analysis

• Visibility into threat activity

across users, hosts, networks,

and infrastructure

• Network file trajectory maps

how hosts transfer files,

including malware files, across

your network to scope an

attack, set outbreak controls,

and identify the source of the

threat

• Centralized management

provides contextual threat

analysis and reporting, with

consolidated visibility into

security and network

operations

See more and detect

threats faster

More visibility equals faster time to detection

“You can’t protect against what you can’t see”

Gain more insight with increased visibility

Malware

Client applications

Operating systems

Mobile devices

VoIP phones

Routers and switches

Printers

Command

and control

servers

Network servers

File transfers

Web applications

Application

protocols

Threats

Typical IPS

Typical NGFW

Cisco Firepower™ NGFW

OpenAppID

Application Visibility & Control

Provide next-generation visibility into app usage

See and understand risks Enforce granular access control Prioritize traffic and limit rates Create detectors for custom apps

Cisco database

• 4,000+ pre-defined

Network & users

Prioritize traffic

OpenAppID - Crowdsourcing Application Detection

Extend AVC to proprietary and custom apps

Easily customize application detectors Detect custom and proprietary applications Share detectors with other users

Open-SourceSelf-Service

Decrypt traffic in hardware and software

TLS/SSL decryption engine

Uncover hidden threats at the edge

decryption engine

Enforcement

decisions

Encrypted Traffic

https://www.%$&^*#$@#$.com

Inspect deciphered packets Track and log all TLS sessions

gambling

elicit

https://www.%$*#$@#$.com

Visibility Provides Context

Detailed Threat Analytics

Customizable Monitoring and Reporting

Closing

Products https://www.cisco.com/c/en/us/products/security/firewalls/index.html#~products

Cisco Firepower®

2100 Series

Cisco Firepower

4100 Series

Cisco Firepower 9300

Security Appliance

• Internet edge,

high-performance

enterprise environments

• Firewall throughput and

threat inspection from

20 to 60 gigabytes

• Stateful firewall, AVC,

NGIPS, AMP, URL filtering,

DDoS (Radware vDP)

• Internet edge to small data

center environments.

Better security, more

visibility

• Firewall throughput and

sustained performance with

threat inspection from 2.0

to 8.5 gigabytes

• Stateful firewall, AVC,

NGIPS, AMP, URL filtering

• Service provider,

data center

• Firewall throughput up to

225 gigabytes and threat

inspection up to 90

gigabytes

• Firewall, AVC, NGIPS,

AMP, URL filtering, DDoS

(Radware vDP)

To learn more, visit Cisco Next-Generation Firewalls

Virtual and Cloud Solutions

Firewall

(IPSEC and SSL)

Managed by FMC and FDM

Next Generation Firewall · Cisco Firepower® 2100 Series Cisco Firepower 4100 Series Cisco...

Documents

Reimage the Cisco ASA or Firepower Threat Defense DeviceReimage the Cisco ASA or Firepower Threat Defense Device Reimage from ASA to Firepower Threat Defense 2. Download the Firepower

Cisco Firepower NGFW - NATO

SSL Insight and Cisco FirePOWER Deployment Guide · PDF fileDeploment ide SSL Insight and Cisco FirePOWER ... with Cisco ASA with FirePOWER. The A10 SSL Insight technology helps eliminate

Cisco Firepower 7000 and 8000 Series Installation … · Connecting the Firepower 8140 4-14 Connecting the Firepower 82xx Family and Firepower and AMP 83xx Family 4-15 Using the 8000

Cisco Cyber Security - INAGE · • Available on Cisco Firepower 4100 Series and Firepower 9300 platforms Data Packet 1001 000101 111000 101110 DDoS FW NGIPS AMP Maximum Protection

Cisco Firepower 1000 Series · ⬤ Cisco Firepower 1000 Series supports Cisco Cisco Adaptive Security Appliance (ASA) & Cisco Firepower Threat Defense (FTD) software images ... NGIPS

Обзор Cisco ASA с FIREPOWER сервисами

Cisco ASA с сервисами FirePOWER · 2016-07-06 · Cisco ASA с сервисами FirePOWER представляет собой интегрированное решение,

ASA FirePOWER (SFR) Module - · PDF file26-2 Cisco ASA Series Firewall ASDM Configuration Guide Chapter 26 ASA FirePOWER (SFR) Module The ASA FirePOWER Module How the

Cisco Firepower Threat Defense Virtual クイックス …...1 Cisco Systems, Inc. Cisco Firepower Threat Defense Virtual クイックスタートガイド（Microsoft Azure クラウド向け）

Cisco ASA com FirePOWER · Cisco ASA com FirePOWER vs. NGFW existentes Características Cisco ASA FirePOWER NGFW existentes Proteção Proativa baseada em reputação Superior Não

Cisco ASA Firepower

Cisco ASA with FirePOWER Services Data Sheet - …utmlab.com/wp...Cisco-ASA-with-FirePOWER-Services.pdf · Cisco ASA with FirePOWER Services Meet the industry’s first adaptive,

Cisco Firepower NGFW Data Sheet - Centralpoint · 2020. 10. 15. · The Cisco Firepower Device Manager is available for local management of 2100 Series and select 5500-X Series devices

Cisco ASA с сервисами FirePOWER

The F5 SSL Orchestrator and Cisco Firepower Solution · 2019-06-05 · The Cisco Firepower Threat Defense solution may be delivered using several combinations of Cisco Firepower and

Regulatory Compliance and Safety Information Cisco Firepower … · Regulatory Compliance and Safety Information—Cisco Firepower 4100 Series Information sur la réglementation de

Getting Started With Firepower - securenetworkers.com · Cisco ASA with FirePOWER Services. 7000 & 8000 ASA FirePOWER NGIPSv Classic License Series Feature or Capability externalauthentication

Cisco Firepower NGFW Data Sheet

Cisco Firepower NGFW - ZSIS · Cisco Firepower NGFWs may be managed in a variety of ways depending on the way you work, your environment, and your needs. The Cisco Firepower Management