Upload
others
View
17
Download
0
Embed Size (px)
Citation preview
Cisco Security Everywhere
Cluj-Napoca
Dan Gavojdea – Security Specialist – Cisco Systems
© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2
50 billionnew networkeddevices by 2020
3/4of employees uses
MULTIPLE DEVICES for work
56%of information workers
spend time workingOUTSIDE THE OFFICE
100%of IT staff
STRUGGLEto keep up withmobile needs
Demand for Mobility
There are two types of
customers…
How would you do
security differently if you
knew you were going to
be hacked?
© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9
Cisco Security Architecture
ADMIN
NGFW
Filter
URL
Leading Threat Intelligence
Research Group
I0I00I00I0I 0II0 I00I0 00I0II0 00I0I00I 0I0II00I0 I00I 0I00 I0I00 II0I 0 II0 I I0I00I0II0I I0II 00I 0I0
00II0I0II0I0I0II 0I00II
II0I 00I0
0 I00000I0
0
00I00I0I00I00I0I00I0II00II00I0 I00I 000 I0I 0I0II000I0 0I00 I0II00 I0I000I00I0
0I 0
00I0
0I0
I00I
Roaming User
00II0
I 0I0
0II0
0I0
0I 0
00I0
0I0
II0I0I00I00I 000I00I00 I0I00I0II0 0II00I0 I00I 0I00 I0I00 00I00I0I00I00I0I00I0II00II00I0 I00I 0I00 I0I00 II0I0II0II 00II0III0I 0II0I00I 0II0II0I0I 0I0II0I 00I00I000II0I II0I0II0
000I0II0II0I 00I0I0
00II0
I00
I
0I0
0I0
0 III0I 00I00I 000I00I0II0I I0I0 00 I0I I00I0II 00I00I0I 00I0I00I0 00II0I0I 00II0II0I
00I0II0I0 0II
AMP for Endpoints
00I00I0I00I00I0I00I0II00II00I0 I00I 0I00 I00I 0I0 I000I I0 0I00II 00I0 I0I 00I I0I 00 I0I0I 00I I0I 00 I0I0 0I I0I0I 0 0I0II0 I00 I0I0I0I00 I0I0 I0I0 0I0 I0I00 I00 I0I I00 0I0II 00II00I 0 I00I0 0I0I0 00I0I0 I00I I0I 0I0I 0I I0 0 I00I I0I0 I00I 0I0I 0I0 0I0I0 I0 0 I0 0 I 0I0 0 I 0 I0I0 0I0I I0I0 I0 0 I00 I0 0I0 0 I0 I00 I 00 I0 0 I 0I0 0I0 0 I0 0 I 0 0I 0I
0I0 I00 I0I0I 00I I0I 00 I0I0 0I I0I0I 0 0I0II0 I00 I0I0I0I00 I0I0 I00 I0I0I 00I I0I 00 I0I0 0I I0I0I 0 0I0II0 I00II0 0I0I0I00 I0I0 I0I0I0I 00I I0I 00 I0I0 0I I0I0I 0 0I0II0 I00 I0I0I0I00 I0I0 I00 I0I0I 00I I0I 00 I0I0 0I I0I0I 0 0I0II0 I00 I0I0I0I00 I0I0 I00 I0I0I 00I I0I 00 I0I0 0I I0I0I 0 0 I0I0I 00I I0I 00 I0I0 0I I0I0I 0 0I0II0 I00 0II0I000II0I0I 0I0II0
I00 I0I0I0I00 I0I0 I00 I0I0I 00I I0I 00 I0I0 0I 0I0II0 I00 I0I0I0I00 I0I0 I00 I0I0I 00I I0I 00 I0I0 0I 0I0II0 I00 I0I0I0I00 I0I0 I00 I0I0I 00I I0I 00 0I0I 0I00 00II0I 00I00I I00I0 00I 0000I00I00II0I 00I00I 00I00II0I I00I I0I0 I00I 0I0I 0I0 0I0I0 I0 0 I0 0 I 0I0 0 I 0 I0I0 0I0I I0I0 I0 0 I00 0
I00I0II00I0I00II0I0
0II0II0I000I0I000II
0I00I00I0I00I00I0
00II0 II0I 00I0
0I 0I0
0I
00I0
I0I0
I00I0
00II0I 00II0I0II0 0II0II0I 00I0I)I00II0I0 00I0I00 00II0II0I 0I0I 00II0II000I00I
000I00I00 I0I00
CTA
II00I0
I00I 0
I00 I0
I00 II0
I 0 II0
I I0I0
0I0
II0I I0
00I0
0I
0I0
I0II0
0I0
I0III0
0I0
I0I0
I0I0
I0I0
0II0
I0II
000II0
II00I0
0I0
I II0 II0II 0II II00I0 I00I 0I00 I0I00 II0I 0 II0 I I0I00I0II0I I0I00I 0II0I 0II0 0II0I I00I0I 000II0I 00II00I I0II00I
00II0I0III000I 0I0I II00I0 I00I 0I00 I0I00 II0I 0 II0 I I0I00I0II0I I0I00I 0I0I 00II 0II0I 0II0I0II00I00 00II0I0II0I0I
00I000I0I00I 0000I
II0I0
II 00II0
I00 0
0I0
0I0
0I
I0I0I0 I0I00III0 0I
0II II0I00 0I00II0
AMP for
Endpoints
Endpoint User
I00I0II00I0I00II0I0
0II0II0I000I0I000II
0I00I00I0I00I00I0
00II0
VPN
DATACENTER
I00I
00I0
II0
II000II
0 0
0II
0II
0I0
000I0
0I 00I0
I II
0000I0
I0I0
00I0
I000I0
I0I
0II
II0
I0 II0
0I0
I0000 0
000 II0
II0 0
0II
0I 000000II
I
0II
II0
I0 II0
0I0
I0000 0
000 II0
II0 0
0II
0I 000000II
I
I0I II0II0
0I
000II0
00I0
I
000II0
00I0
I
0I 0I0I0 II00I0
I0II00I0 II00I0
NGFW
AMP for Network
00I0 0000I 00 00I 0I I0II I00I I0I00I
I0II0I
I0I0I0 I0I00II0 I0I0I0 0I0I00 I0II0 0I0I
00I0II II0I00 0I0I 000II0I 00I00 I0I00 000
I00
Block
Warn
Allow
Cloud Option
Network Traffic
Flow
Analysis
Vector TRAFFIC
AMP for Content
I00I0II00I0I00II0I0
0II0II0I000I0I000II
0I00I00I0I00I00I0
00II0
Web & Email Security
Dynamic Malware
Analysis
NGIPS
NGIPS
0I0II0I00II0
I
Cloud Access Security
CLOUD APPS
Intelligent cybersecurity to protect against advanced threats
Identity
Services
Trustsec
PEOPLE & DEVICES
Vector
CLOUD APPS
Vector
ASAv
Vector
CES ESA
Lancope
Stealthwatch
ASA
AnyConnect VPN
Cloud Access Security
AMP Threat Grid
CWS WSA
ASA
ISE
0I0I0 II0I0
PEOPLE & DEVICES
WEB & EMAIL CLOUD APPSWEB & EMAIL
AMP for Endpoints
AMP for Content
AMP for Network
AMP for
Endpoints
NGIPSv
NGIPS
NGIPS
The Security Problem
New Business Models
Dynamic Threat Landscape
Complexity of security solutions
The Industrialization of Hacking
20001990 1995 2005 2010 2015 2020
Viruses1990–2000
Worms2000–2005
Spyware and Rootkits2005–Today
APTs CyberwareToday +
Hacking Becomesan Industry
Sophisticated Attacks, Complex Landscape
Phishing, Low Sophistication
Cisco and/or its affiliates. All rights reserved.Presentation_ID Cisco Public
Security Challenges
Changing
Business Models
Dynamic
Threat Landscape
Complexity
and Fragmentation
A community that hides in plain sight avoids detection and attacks swiftly
50%Of attacks last year
were basic attacks
54%of breaches remain
undiscovered for
MONTHS
YEARSMONTHSWEEKSHOURSSTART
85%intrusions
aren’t discovered for
WEEKS
51%increase of companies
reporting a $10M loss
or more in the last
YEAR
Dangerous Times
Nation State
Political
Insider
Criminal
Confidential
Data
A Security Executives’ business challengesWho, What, Where, When…
Game the
Stock Price
Steal Customer
Data
Damage
the Brand
Fraud
Industrial Espionage
Pivot Through Us To
Attack Customers
Exploit the
Network
Steal IP
HOW
What are the acceptable
risks?
Where do you think your
greatest vulnerabilities lie?
Are you compliant?
19
© 2015 Cisco and/or its affiliates. All rights reserved. Cisco
Confidential
Who is responsible ?
Cisco and/or its affiliates. All rights reserved.Presentation_ID Cisco Public
Point-in-Time Malware Detection Alone is not 100% Effective
It will catch But only takes
99% 1%of threats to cause a breach
Cisco and/or its affiliates. All rights reserved.Presentation_ID Cisco Public
AMP provides contextual awareness and visibility that allows you to take control of an attack before it causes damage
Who
What
Where
When
How
Focus on these
users first
These applications
are affected
The breach impacted
these areas
This is the scope of
exposure over time
Here is the origin and
progression
of the threat
Cisco and/or its affiliates. All rights reserved.Presentation_ID Cisco Public
Cisco’s AMP Everywhere Strategy Means Protection Across the Extended Network
MAC
AMP for
Networks
PC
AMP for
Cloud Web Security
& Hosted Email
CWS
Virtual
AMP on Web & Email
Security Appliances
Mobile
AMP on ASA Firewall
with FirePOWER
Services
AMP for Endpoints
AMP Private Cloud
Virtual ApplianceAMP Threat Grid
Dynamic Malware Analysis +
Threat Intelligence Engine
Mapping to the Holistic Threat Continuum
ControlEnforceHarden
DetectBlock
Defend
ScopeContain
Remediate
Infrastructure
and Protocols
Network
Firewall
Next-Generation
Firewall (NGFW)Next-Generation
IPS (NGIPS)
Web Security
Content Filtering
Mobile Users
Remote Access
VPN
Email Security
SSL Decryption
and Inspection
Network ForensicsAdvanced Malware
Protection (AMP)
Incident Response
Open Source
Custom Tools
Context-Awareness Attribution
CLUS:
AMP
Data Center
Cisco Security Investment & Innovation(2013-2015)
Sourcefire
Acquisition closed
Security
for ACI
RSAC:
AMP Everywhere
OpenAppID
Managed Threat
Defense
Black Hat:
2014 MSR & Talos
2014 ASR
Global Security
Sales Organization
Neohapsis
Acquired
AMP Everywhere
Incident Response
Service
Cisco ASA with
FirePOWER Services
for Mid-Size, Branch
Offices and Industrial
environments
ThreatGRID
acquired
Cisco ASA with
FirePOWER Services
Security & Trust
Organization
InterOp NY:
ISE 1.3 / AC 4.0 / CTD 2.0
EN integrations
Intent
OpenDNS
Cisco and/or its affiliates. All rights reserved.Presentation_ID Cisco Public
NSS Labs ReportComparative Testing on Breach Detection Systems
Who is NSS Labs?NSS Labs, one of the best and most thorough independent
testing bodies in the industry, performed comparative
testing on Breach Detection Systems.
What was measured?
Security Effectiveness of Breach Detection Systems
• HTTP/Email Malware, Exploits, Evasions, and False
Positive Rate
Total Cost of Ownership per protected Mbps
What Cisco-Sourcefire
products were tested?
AMP Everywhere
• AMP for Networks and AMP for Endpoints (TCO
calculations include this set of FireAMP connectors)
• FirePOWER 8120 (with AMP subscription)*
What competitor
products were
evaluated?
FireEye, AhnLab, Fortinet, TrendMicro, Fidelis
BDS Methodology v1.5
[The methodology] utilizes real threats
and attack methods that exist in the
wild and are actually being used by
cyber-criminals and other threat
actors. This is the real thing, not
facsimile; systems under test (SUT)
are real stacks connected to a live
internet feed.
--NSS Labs
*Dedicated AMP Appliances (AMP8150/AP7150) were not shipping at the time of the test, otherwise one would have been used
Cisco and/or its affiliates. All rights reserved.Presentation_ID Cisco Public
Se
cu
rity
Eff
ec
tive
ne
ss
TCO per Protected-Mbps
The ResultsCisco AMP is a Leader in Security Effectiveness and TCO and offers Best Protection Value
Cisco Advanced Malware
Protection
Best Protection Value
99.0% Breach Detection
Rating
Lowest TCO per Protected-
Mbps
Other Products Do Not Provide
Retrospective Security After a
Breach
NSS Labs Security Value Map (SVM) for Breach Detection Systems
Cisco and/or its affiliates. All rights reserved.Presentation_ID Cisco Public
AMP Case Studies
Cisco and/or its affiliates. All rights reserved.Presentation_ID Cisco Public
Block Threats Before They Breach
Challenge
Experienced security team of 7 supporting over
120 locations needed greater intelligence to
quickly identify and stop threats. Current
defenses alerted personnel and logged details
but did nothing to aid investigation of the issue.
SolutionAugmented intrusion prevention systems with
FireAMP for Endpoint.
Result
After installation of FireAMP, a targeted attack
was identified and remediated in half a day. 7
days after the initial attack, new business
processes and intelligences implemented by
FireAMP resulted in the immediate mitigation of a
second targeted attack.
BEFORE
Bank Case Study
2106 Security Report
• Blocked threats: 19,692,200,000 threats per day
• Blocked threats w/ spam: 2,557,767 blocks/sec
Talos Detection Content
Talos
NGFW
ESA
Threat
GRID
AMP
Cloud
WSA
NGIPS
Security Bundles
Securitatea informatica pentru dezvoltatorii de aplicații si soluții
Bogdan Voiculescu
Net Brinel - Presales Consultant
2 Martie 2016
About sandboxing technology
Sandbox definition
A sandbox has the objective of detecting malware by executing the suspicious code in a protected environment and to analyze its behavior.
It’s used for zero-day and stealthy attacks.
Stalling code
Execution of code is delayed so that the sandbox times out. Malware doesn’t just sleep, it gives the appearance of activity – useless operation, everything is normal –Malware Analysis System Blind SPOT.
Blind spot in a Sandbox
“Hooks” are inserted into a program to get notifications (callbacks) – whenever certain functions or library are called. This forces program modifications that is identified by malware. Also, sandbox is not able to see any instruction that malware execute between calls.
Where is the Human ?
User behavioral monitoring allows Malware to detect user interaction before execution. Activities done by a human have random character that are very hard to replicate – page scrolling, mouse movement, mouse clicks etc. – suspicious unnatural behavior DETECTED.
Diagnosing the Sandbox
Malware is able to scan for• VM registry keys• running processes• disk size• remote communication and other specific VM characteristics
About Antivirus Solution
https://media.blackhat.com/bh-us-12/Briefings/Flynn/bh-us-12-Flynn-intrusion-along-the-kill-chain-WP.pdf
Don’t believe us…
Let’s test it !
Cisco PxGrid – Platform Exchange
Thank you !