53
Story Tweedie-Yates Product Marketing Manager – Cloud Web Security August 2015 Protecting your environment against the top two attack vectors Cisco Web and Email Security

Cisco Web and Email Security Overview

Embed Size (px)

Citation preview

Page 1: Cisco Web and Email Security Overview

Story Tweedie-YatesProduct Marketing Manager – Cloud Web SecurityAugust 2015

Protecting your environment against the top two attack vectors

Cisco Web and Email Security

Page 2: Cisco Web and Email Security Overview

2© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

The Attack Landscape

Threats from a user’s perspective

Before, during and after: a security framework

Cisco Web and Email Security offerings

Newest product features & roadmap

What to do next

Agenda

   

Page 3: Cisco Web and Email Security Overview

3© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

The Attack Landscape

Page 4: Cisco Web and Email Security Overview

4© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Threats continue to evolve

1990 1995 2000 2005 2010 2015 2020

Viruses1990–2000

Viruses2000–2005

Spyware and Rootkits2005–Today

APTs CyberwareToday +

of large companies targeted by malicious traffic 95% of organizations interacted

with websites hosting malware 100%

Page 5: Cisco Web and Email Security Overview

5© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Users becoming complicit enablers of attacks

Untrustworthy sources

Clickfraud and Adware

Outdated browsers

10% 64%IE requests running latest version

Chrome requests running latest version

vs

Why Web Security?

Page 6: Cisco Web and Email Security Overview

6© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Attackers:

Shifts in the attack vectors

Java

Silverlight

PDF

Flash

Java drop 34%

Silverlight rise 228%

PDF and Flash steady

Log Volume

2015 Cisco Annual Security Report

Why Web Security?

Page 7: Cisco Web and Email Security Overview

7© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Attackers:

A growing appetite to leverage targeted phishing campaigns

Example: Snowshoe SPAM attack

SPAM up

250%

Why Email Security?

Page 8: Cisco Web and Email Security Overview

8© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Attackers:

Malvertising is on the rise: low-limit exfiltration makes infection hard to detect

In October 2014, there is a spike of

250%

More reason for Web Security

Page 9: Cisco Web and Email Security Overview

9© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Attack techniques: web and email

Approach

Tactic

Impact

Threat vector

Infect or inject a trusted site

Conduct reconnaissance on a target

Deliver an exploit that will attack

Target users through compromised links

Leverage social engineering

Deliver an exploit that will attack

Deliver malware with stealth and self-deleting programs

Gain access through DLL injection and control firewalls, antivirus, ect

Compromises system control, personal data and authorizations

DropperWatering hole Spear phishing

Page 10: Cisco Web and Email Security Overview

10© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Threats from a user’s perspective

Page 11: Cisco Web and Email Security Overview

11© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Web and email can be accessed anywhere

Mobile Coffee shop Corporate Home Airport

Page 12: Cisco Web and Email Security Overview

12© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Sample attacking: Joe CFOWaiting for his plane

Meet Joe. He is heading home for a well deserved vacation.

He’s catching up on email using the airport Wi-Fi while he waits for his flight.

Page 13: Cisco Web and Email Security Overview

13© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Sample attacking: Joe CFOChecks his email

Joe just got an email from his vacation resort.

Your Tropical Getaway

Joe,

Thank you for choosing us. We look forward to seeing you.

Before your arrival, please verify your information here: www.vacationresort.com

Best,Resort Team

Page 14: Cisco Web and Email Security Overview

14© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Sample attacking: Joe CFOInstinctively, he clicks on the link

No problem, right? Everything looks normal.

The site may even be a trusted site, or maybe a site that is newly minted.

Your Tropical Getaway

Joe,

Thank you for choosing us. We look forward to seeing you.

Before your arrival, please verify your information here: www.vacationresort.com

Best,Resort Team

Page 15: Cisco Web and Email Security Overview

15© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Sample attacking: Joe CFOJoe is now infected

Joe opens the link and the resort video plays.

Although he doesn’t know it, Joe’s machine has been compromised by a Silverlight based video exploit.

The malware now starts to harvest Joe’s confidential information:

• Passwords

• Credentials

• Company access authorizations

Page 16: Cisco Web and Email Security Overview

16© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Today’s cyber-threat reality

Hackers will likelycommand and control

your environment via web

You’ll most likely be infected via email

Your environmentwill get breached

Page 17: Cisco Web and Email Security Overview

17© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Before, during and after: a security framework

Page 18: Cisco Web and Email Security Overview

18© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

The Attack Continuum

Network Endpoint Mobile Virtual Cloud

Point in Time ContinuousThreat IntelligenceX

DURINGDetectBlockDefend

AFTERScopeContain

Remediate

BEFOREDiscoverEnforceHarden

Page 19: Cisco Web and Email Security Overview

19© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Key:

Cisco Web Security

BeforeAfterDuring

Outbreak Intelligence

Reporting

Log Extraction

Management

Allow Warn Block Partial Block

HQ

Client Authentication Methods

Talos

www

  

CWS Only WSA / WSAv Only

Web Filtering

Web Reputation

Application Visibility &

Control

Webpagewww.website.com

Anti-Malware

File Reputation

File Sandboxing

File Retrospection

Cognitive Threat

Analytics

DLP Integration

Hybrid

CWS

WSA

Roaming UserBranch Office

WCCP

ASA

Load Balancer

WSA

PBR

ISR G2 AnyConnect

AnyConnectExplicit/PAC

Explicit/PAC

Traffic Redirection Methods

Campus Office BYOD User

Admin

WSA

X X X X X X

Page 20: Cisco Web and Email Security Overview

20© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Cisco Email Security

ReportingMessage Track

Management

Allow Warn

AdminHQ

Anti-Spam and

Anti-Virus

Mail Flow Policies

Data Loss Protection

Encryption

Before DuringX XXX

Inbound Email

Outbound Email

Cisco

Appliance Virtual

Talos

BlockPartial Block

Outbound Liability

BeforeAfterDuring

Tracking User click Activity

(Anti-Phish)

File Sandboxing & Retrospection

X X XXX

Cloud

ContentControls

X

EmailReputation

AcceptanceControls

File Reputation

Anti-Spam Anti-Virus Outbreak

Filters

X

Mail FlowPolicies Graymail

Management

Safe Unsubscribe

X

Anti-PhishThreatGrid URL Rep & Cat

Page 21: Cisco Web and Email Security Overview

21© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

1.1 million file samples per day AMP community Advanced Microsoft

and industry disclosures Snort and ClamAV open source

communities AMP TG Intelligence AEGIS™ program Private and public threat feeds 10 million files per month - AMP

TG Dynamic analysis

Talos: before, during and after

10I000 0II0 00 0III000 II1010011 101 1100001 110110000III000III0 I00I II0I III0011 0110011 101000 0110 00

I00I III0I III00II 0II00II I0I000 0110 00

101000 0II0 00 0III000 III0I00II II II0000I II01100001110001III0 I00I II0I III00II 0II00II 101000 0110 00

100I II0I III00II 0II00II I0I000 0II0 00

Cisco®

Talos

Threat Intelligence

ResearchResponse

ESA/WSA/CWS

Email Endpoints Web Networks IPS Devices

WWW

1.6 millionglobal sensors

100 TBof data received per day

150 million+ deployed endpoints

600+engineers, technicians, and researchers

35% worldwide email traffic

13 billionweb requests

24x7x365 operations

40+languages

Page 22: Cisco Web and Email Security Overview

22© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Cisco Web and Email Security offerings

Page 23: Cisco Web and Email Security Overview

23© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Complete Solution

Pervasive

Continuous

Always On

23© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Finding a solution

Page 24: Cisco Web and Email Security Overview

24© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Cisco Web and Email Security offeringsCloud Web Security (CWS)

Web Security Appliance (WSA)

Email Security Appliance (ESA)

Cloud Email Security (CES)

Cloud Access Security

Cognitive Threat Analytics

Talos

AMP

Threat Grid

Unified Reporting

Visibility-Driven Threat-Focused Platform-Based

Page 25: Cisco Web and Email Security Overview

25© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Talos

Visibility-Driven

Page 26: Cisco Web and Email Security Overview

26© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

1.1 million file samples per day AMP community Advanced Microsoft

and industry disclosures Snort and ClamAV open source

communities AMP TG Intelligence AEGIS™ program Private and public threat feeds 10 million files per month - AMP

TG Dynamic analysis

Talos: processing power and visibility

10I000 0II0 00 0III000 II1010011 101 1100001 110110000III000III0 I00I II0I III0011 0110011 101000 0110 00

I00I III0I III00II 0II00II I0I000 0110 00

101000 0II0 00 0III000 III0I00II II II0000I II01100001110001III0 I00I II0I III00II 0II00II 101000 0110 00

100I II0I III00II 0II00II I0I000 0II0 00

Cisco®

Talos

Threat Intelligence

ResearchResponse

ESA/WSA/CWS

Email Endpoints Web Networks IPS Devices

WWW

1.6 millionglobal sensors

100 TBof data received per day

150 million+ deployed endpoints

600+engineers, technicians, and researchers

35% worldwide email traffic

13 billionweb requests

24x7x365 operations

40+languages

Page 27: Cisco Web and Email Security Overview

27© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Cloud Access Security

Visibility-Driven

Page 28: Cisco Web and Email Security Overview

28© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Shadow Data

Shadow IT

Visibility into Shadow IT and Shadow Data

??

??

?

?

??

? ?

PCI relatedcontent

Intellectual property

HR documents with SSN

PHI related documents

Page 29: Cisco Web and Email Security Overview

29© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Shadow IT Risk Assessment Report

Business Readiness Rating™

Audit Score

Shadow Data Risk Assessment

After

StreamIQ™

ThreatScore™

ContentIQ™

Reports & Analysis

Cisco Cloud Access Security

Cloud Apps ? ?

?? ?? ?

IO IOI

IO IOI

ProtectIO IOI

IO IOI

Cloud SOC Policy IO IOI

IO IOI

?

54541717

IO IOI

IO IOI

??

IO IOI

Audit

Detect

?

Investigate

WSA

Before

During

Elastica CloudSOC™

In collaboration with

Data Account User

SecurityOperations

CenterAnalyze &

ControlSecurlet™ Gateway

Page 30: Cisco Web and Email Security Overview

30© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Advanced Malware Protection (AMP)

Threat-Focused

Page 31: Cisco Web and Email Security Overview

31© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Layer 1

During After

Layer 2

AMP

CTA

CWS PREMIUM

AMP

CTALayer 3

File Reputation Anomaly detection

Trustmodeling

Event classification

Entity modeling

Dynamic MalwareAnalysis

File Retrospection

Relationship modeling

CTA

AMP Retrospection

Policy AVAMP File

Reputation

AMP delivers point-in-time, continuousand retrospective security

File Unknown!

Retrospective Incidents

1

3

AMP Cloud

Knowwhere itall started

OI

Understand how it entered the system

See everywhere that it has been

Determine what it has done

Learnhow tostop it

AMP Dynamic Malware Analysis

2

Page 32: Cisco Web and Email Security Overview

32© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Layer 1

During After

Layer 2

AMP

CTA

CWS PREMIUM

AMP

CTALayer 3

File Reputation Anomaly detection

Trustmodeling

Event classification

Entity modeling

Dynamic MalwareAnalysis

File Retrospection

Relationship modeling

CTA

Improve the accuracy of threat identification with File Reputation

Machine Learning decision tree

Confirmed malware

Confirmed clean file

Confirmed clean file

Confirmed malwarePossible

clean file

Possible malware

Collective User Base

Collective User Base

One-to-OneIdentifies specific instances of malware with a signature-based approach

Fuzzy FingerprintingAutomatically detects polymorphic variants of known malware

Machine LearningIdentifies new malware using statistical modeling and analytics engines

File Reputation

Page 33: Cisco Web and Email Security Overview

33© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Layer 1

During After

Layer 2

AMP

CTA

CWS PREMIUM

AMP

CTALayer 3

File Reputation Anomaly detection

Trustmodeling

Event classification

Entity modeling

Dynamic MalwareAnalysis

File Retrospection

Relationship modeling

CTA

Detect zero-day threats with Dynamic Malware Analysis

Collective User Base

Collective User Base

AMP Dynamic Malware Analysis

AMP Dynamic Malware Analysis

Dynamic AnalysisAnalyzes unknown malware and assigns a threat score within minutes

Advanced AnalyticsWorks in tandem with One-to-One, Fuzzy Fingerprinting and Machine Learning to identify malware that remains undetected

Dynamic Malware Analysis

Page 34: Cisco Web and Email Security Overview

34© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Layer 1

During After

Layer 2

AMP

CTA

CWS PREMIUM

AMP

CTALayer 3

File Reputation Anomaly detection

Trustmodeling

Event classification

Entity modeling

Dynamic MalwareAnalysis

File Retrospection

Relationship modeling

CTA

Get insight on what a file has done and where it has been with File Retrospection

Performs analysis the first time a file is seen1

Analyzes the file persistently over time to see if the disposition is changed

2Gives unmatched visibility into the path, actions or communications associated with a particular software

3

File Retrospection

Analyze Monitor Identify

Page 35: Cisco Web and Email Security Overview

35© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

AMP Everywhere

AMPAdvanced Malware

Protection

AMP for Networks

AMP on Web and Email Security Appliances

AMP on Cisco® ASA Firewall with FirePOWER Services

AMP for Endpoints

AMP for Cloud Web Security and Hosted Email

AMP Private Cloud Virtual Appliance

MAC OS

Windows OS Android Mobile

Virtual

CWS

AMP Threat Grid Malware Analysis + Threat

Intelligence EngineAppliance or Cloud

*AMP for Endpoints can be launched from AnyConnect

Page 36: Cisco Web and Email Security Overview

36© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Threat Grid

Threat-Focused

Page 37: Cisco Web and Email Security Overview

37© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

AMP Threat Grid

AMP Threat Grid platform

correlates the sample result

with millions of other samples

and billions of artifacts

Actionable threat content and intelligence is generated that can be utilized by AMP, or packaged and integrated into a variety of existing systems or used independently.

1100001110001110 1001 1101 1110011 0110011 101000 0110 00

101000 0110 00 0111000 111010011 101 1100001 110

1001 1101 1110011 0110011 101000 0110 00

Analyst or system (API) submits suspicious sample to Threat Grid

Low Prevalence Files

An automated engine observes, deconstructs, and analyzes using multiple techniques

Actionable threat content and intelligence is generated that can be packaged and integrated in to a variety of existing systems or

used independently.

AMP Threat Grid platform correlates the sample result with millions

of other samples and billions of artifacts

101000 0110 00 0111000 111010011 101 1100001 110

101000 0110 00 0111000 111010011 101 1100001 110

1001 1101 1110011 0110011 101000 0110 00

Threat Score / Behavioral IndicatorsBig Data Correlation Threat Feeds

Sample and Artifact Intelligence Database

Actionable Intelligence

Proprietary techniques for static and dynamic analysis

“Outside looking in” approach

350 Behavioral Indicators

Page 38: Cisco Web and Email Security Overview

38© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Cognitive Threat Analytics

Threat-Focused

Page 39: Cisco Web and Email Security Overview

39© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Here’s an example of how CTA works

Near real-time processing

1K-50K incidents per day10B requests per day +/- 1% is anomalous 10M events per day

HTTP(S)Request

Classifier X

Classifier A

Classifier H

Classifier Z

Classifier K

Classifier M

Cluster 1

Cluster 2

Cluster 3

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request HTTP(S)

Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

Cluster 1

Cluster 2

Cluster 3

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)RequestHTTP(S)

Request

HTTP(S)Request

HTTP(S)RequestHTTP(S)

Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)RequestHTTP(S)

Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

Anomaly Detection Trust Modeling Classification Entity Modeling Relationship Modeling

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)RequestHTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

HTTP(S)Request

CONFIRMED threats(spanning multiple users)

DETECTED threats (unique)

Page 40: Cisco Web and Email Security Overview

40© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Unified ReportingPlatform-Based

Page 41: Cisco Web and Email Security Overview

41© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Unified Reporting for Cisco Web Security

WSA

Log extraction feed

Web security reporting application

Web Security Essentials

Web Security Premium

CWSCWS

WSAWSA

Web usage controls

Malware scanning

Secure mobility

Web usage controls

Malware scanning

Web reporting application

Page 42: Cisco Web and Email Security Overview

42© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Security Management Appliance: reporting for Web and Email Security

Centralized ReportingCentralized Management

In-depth Threat Visibility

Extensive Forensic CapabilitiesCentralized Policy

ManagementDelegated

Administration

Page 43: Cisco Web and Email Security Overview

43© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Newest product features and roadmap

Page 44: Cisco Web and Email Security Overview

44© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Email

Page 45: Cisco Web and Email Security Overview

45© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Anti-SnowshoeSteps to take in battling spam

“Maintain leadership in anti-spam efficacy through ever-changing threat landscape to protect our customers and keep ahead of the competition”

Sensor footprint expansion for early awareness of snowshoe campaigns

Increase automation and auto-classification of emails for faster response

Better defense against Snowshoe spam through enhanced Contextual analysis

Page 46: Cisco Web and Email Security Overview

46© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Graymail management

Threat Defense Security Graymail Detection

BulkSocial

Network Marketing

Quarantine

• Whitelist – Allow Sender• Blacklist – Block Sender• Release – Safe unsubscribe

Block

Add Safe Unsubscribe Link

Verdict

RequestReputation

Filter

Anti-spam

Anti-virus

AdvancedMalwareProtection

Page 47: Cisco Web and Email Security Overview

47© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Web Interaction TrackingEnabling tracking of URLs rewritten by policy

G

App 1 App 2 App 5App 3

App 4

App 6 App 7

Rewritten URL: 2asyncfs.comClick Time: 09:23:25 12 Jan 2015Re-write reason: OutbreakAction taken: Blocked

Rewritten URL: 5asynxsf.comClick Time: 11:01:13 09 Mar 2015Re-write reason: PolicyAction taken: Allowed

Rewritten URL: 8esynttp.comClick Time: 16:17:44 15 Jun 2015Re-write reason: OutbreakAction taken: Blocked

User A

User B

User C

Potentially malicious URLs

Filtering

Rewritten URLs

Monitor users from a single pane of glass

Page 48: Cisco Web and Email Security Overview

48© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

WSA

Page 49: Cisco Web and Email Security Overview

49© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Acquires important context and identity from the network

Monitors and provides visibility into unauthorized access

Cisco® ISE provides differentiated access to the network; Cisco TrustSec® provides segmentation throughout the network; Cisco Web Security Appliance provides web security and policy enforcement

Consistent Secure Access Policy

Who: DoctorWhat: LaptopWhere: Office

Who: DoctorWhat: iPadWhere: Office

Who: GuestWhat: iPadWhere: Office

Cisco Identity Service Engine

WSA

Confidential Patient Records

Internal Employee Intranet

Internet

Combining the power of ISE with WSA

Page 50: Cisco Web and Email Security Overview

50© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Time and volume quotas

100100101001000100100100100001010101110110010100101001010010101001001001001001010010010010100011

101001010101001000100011110101010010010

101001010101001000100011110101010010010

101001010101001000100011110101010010010

• Control web usage to meet administrative policies, such as:

• Total bandwidth used during work hours

• Total bandwidth per day used for social media categories

• Configure polices to restrict access based on the amount of data (in bytes) and time

• Quotas are applicable to HTTP, HTTPS, and FTP traffic

• Configured under access policies and decryption policies

• Create custom end-user notifications of warnings when a quota is close, as well as when exceeded

Page 51: Cisco Web and Email Security Overview

51© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Cisco Web and Email Security roadmap

Visibility Driven Threat Focused Platform Based

Recent Releases

WSA & ISE Integration

WSA Time and Volume Quotas

Email Web Interaction Tracking

Email Graymail Management

CWS Premium with AMP & CTA

WSA with AMP & CTA

Email and TG Integration

WSA & CWS Unified Reporting

WSA CARP

Email TLS 1.2 Support

Current Projects

CWS & WSA Cloud Access Security

CWS & WSA Cloud Access Security

CWS ISR 4k IWAN

Future Email Url Tracking through Message Tracking

Email Shortlinks CWS & WSA Hybrid

Many of the products and features described herein remain in varying stages of development and will be offered on a when-and-if-available basis. This roadmap is subject to change at the sole discretion of Cisco, and Cisco will have no liability for delay in the delivery or failure to deliver any of the products or features set forth in this document.

Page 52: Cisco Web and Email Security Overview

52© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

What to do next

Cisco.com/go/websecurity

Cisco.com/go/emailsecurity

Presentation Posted on Cisco Slideshare account

Check out content on Cisco.com to learn more

Learn more

Free Eval : cisco.com/go/3waystotrycontent

Respond to Registration Email Follow-Up

Contact Cisco AM and try for free

Get started

Page 53: Cisco Web and Email Security Overview