Modern attacks and malware

Transcription

1 Modern attacks and malware Everything starts with an and web Dragan Novakovic Cisco Systems

2 New Cyber Threat Reality Your environment will get breached You ll most likely be infected via Hackers will likely command and control your environment via web

3 Cisco Security Solutions

4 is still the #1 threat vector

5 Phishing leaves businesses on the line Phishing $500M Spoofing Ransomware 30% 94% malicious attachments 1 are opened 1 of phish mail has of phishing messages Loss incurred due to phishing attacks in a year by US companies Cisco Annual Security Report Verizon Data Breach Report, Kerbs on Security Messages contain attachments and URL s Socially engendered messages are well crafted and specific Credential hooks give criminals access to your systems

6 Spoofing rates are on the rise Phishing Spoofing 270 % increase 1 $2.3B Ransomware In losses from spoofing FBI Warns of Dramatic Increase in Business scams, 2016 Forged addresses fool recipients Threat actors extensively research targets Money and sensitive information are targeted

7 Ransomware attacks are holding companies hostage Phishing Spoofing Ransomware 9,515 users are paying ransoms per month 2 Ransomware represents the biggest jump in occurrences of crimeware 1 $60M Cost to consumers and companies of a single campaign Verizon Data Breach Report, Kerbs on Security Cisco Annual Security Report Malware encrypts critical files Locking you out of your own system Extortion demands are made

8 Cisco Security Talos Cisco Before During Cloud Appliance After Virtual Inbound Reputation Mail Flow Policies Acceptance Controls Anti-Spam Anti-Virus File Reputation ThreatGrid Graymail Management Safe Unsubscribe Content Controls URL Rep & Cat Outbreak Filters Anti-Phish File Sandboxing & Retrospection Tracking User click Activity (Anti-Phish) X X X X X X X X Outbound Outbound Liability Before X X During X X HQ Admin Management Reporting Message Track Mail Flow Policies Anti-Spam and Anti-Virus Data Loss Protection Encryption Allow Warn Block Partial Block

9 Gain security backed by the most advanced threat intelligence 100 TB Of Data Received Daily 1.5 MILLION Daily Malware Samples 600 BILLION Daily Messages III00II 0II00II 0I0I0I0I 0I I0 I00 000II0 I0I0 0II0 00 III00II 0II00II I0I0II0II0 I0 I0 I00 00I0 I000 0II0 00 III00II 0II00II I0I000 0II0 00I0I00 I0 I000I0I 0II 0I0I0I 00I00 I00I0I II0I0I 0II0I I0I00I0I0 0II0I0II 0I00I0I I0 00 II0III0I 0II0II0I II00I0I0 0I00I0I00 I0I0 I0I0 I00I0I00 II0II0I0I0I I0I0I0I 0I0I0I0I 0I0I00I0 I0I0I0I 0II0I0I0I III00II I000I0I I000I0I I000I0I II 0I00 I0I000 0II I I0I0I0 I0I0III000 I0I00I0I 0II0I0 I00I0I0I0I 000 0II00 I00I0I0 0I00I0I I00I0I0 I0I0I0I 0I0I0I 0I0I0I0 00I0I0 0I0I0I0 I0I0I00I 0I0I 0I0I 0I0I I0I0I 0I00I0I 250+ Full Time Threat Intel Researchers MILLIONS Of Telemetry Agents 4 Global Data Centers 16 BILLION Daily Web Requests Operations Over 100 Threat Intelligence Partners Global scanning 30 years building the world s networks

10 Detect threats embedded in content Reputation filter Anti spam Graymail detection Threat outbreak filters Content filters CASE engine Optimize detection with machine and human intelligence Stop more than 99% of Spam Keep good s flowing with a < 1 in 1M false-positive rate?

11 Guard against malicious attachments Anti virus File reputation Advanced sandboxing Retrospective alerting Auto remediation for Office 365 Virus outbreak filters Track behavior with over 560 indicators Quickly neutralize threats with Zero Hour Malware Protection Continuously track files with retrospective security? Advanced Malware Protection (AMP)?

12 Reduce the hassle of compliance Protect intellectual property DLP prevents confidential information from leaving your network Ensure compliance with industry and government regulations RSA and Digital Guardian partnership Enable users to do business Encryption ensures your is confidential with complete control as the sender Send confidential mail Read receipts Recall ability Secure reply and forwarding ZIX or CRES or S/MIME or TLS

13 Move to the cloud with confidence Maintain peak performance with capacity assurance Ensure performance with continuous monitoring of system health Count on the stability and relatability of a strong tier one infrastructure Add capacity easily as message volumes increase Avoid downtime with availability Enjoy the highest levels of service availability with dedicated cloud infrastructure Receive dedicated IPs and storage Prevent shared-fate with compute instances

14 Expand with security that grows with you Grow in the cloud Expand geographically Gain full admin access Increase dedicated instances up to 50% of the originally sized environment at no cost Utilize Cisco s data center footprint as you grow into new regions Maintain full admin level access to your appliances at all times Easily orchestrate changes or access reports

15 Optimize security resources to focus on business outcomes Keep consistent policy as you shift to cloud Reduce investigations and response times Identify trends with scheduled and ad-hoc reporting

16 AsyncOS 10.0 Feature rich release Forged Detection Cisco Security AsyncOS 10.0 AMP Private Cloud Improved AMP Reporting Language Detection & Filter Actions SAML Authentication Malware Auto-Remediation for Office 365 Customers URL Logging & Message Tracking

17 Think Before You Click

18

19 With Cisco security, you can Reduce exposure Support growth Achieve agility with advanced threat protection with availability and assurance through operational efficiency

20 Cisco Web Security Solutions

21 Cisco Web Security Protects the Web Vector While Supporting Your Business Comprehensive Defense Advanced Threat Protection Superior Flexibility Cisco Web Security Appliance (WSA) Cisco Cloud Web Security (CWS)

22 Talos WSA Cisco Web Security After www Web Filtering Web Reputation Application Visibility and Control Webpage Anti- Malware File Reputation Outbreak Intelligence File Sandboxing Cognitive Threat Analytics DLP Integration File Retrospection X X X X X X Client Authentication Methods Traffic Redirection Methods CWS WSA ASA WCCP WSA Load Balancer Explicit/PAC Explicit/PAC ISR G2 PBR ISR 4K AnyConnect AnyConnect HQ Admin Reporting Management Log Extraction Key: CWS Only WSA/WSAv Only Hybrid Campus Office Branch Office Roaming User BYOD User Allow Warn Block Partial Block

23 It Starts with Usage Control and Active Defense Web Filtering Block over 50 million known malicious sites Web Reputation Restrict access to sites based on assigned reputation score Dynamic Content Analysis Categorize webpage content and block sites automatically Outbreak Intelligence Identify unknown malware and zero-hour outbreaks in real time Application Visibility and Control Regulate access to website components and apps DLP Integration Prevent confidential information from leaving your network Time and Bandwidth Quotas Set controls for users in terms of time on social media sites as well as bandwidth usage Roaming User Protection Protect users while away from the corporate network Available only on WSA/WSAv Available only on CWS

24 Extending Protection Beyond the Network Key Benefits WSA WWW Save network bandwidth CWS Browser Mobile User Improve user experience HQ WAN Remote Sites VPN Roaming User Defend against malware Protect your investment

25 And Extending User Identity and Context ISE Integration Who: Doctor What: Laptop Where: Office Acquires important context and identity from the network Who: Doctor What: ipad Where: Office Who: Guest What: ipad Where: Office Cisco Identity Service Engine Consistent Secure Access Policy WSA Confidential Patient Records Internal Employee Intranet Monitors and provides visibility into unauthorized access Provides differentiated access to the network Cisco TrustSec provides segmentation throughout the network Cisco Web Security Appliance provides web security and policy enforcement Internet Available only on WSA

26 Cisco Web Security Combats Evolving Threats Cisco Advanced Malware Protection (AMP) File Reputation File Sandboxing File Retrospection Increase the accuracy of threat detection by examining every aspect of a file Determine the malicious intent of a file before it enters the network Identify a breach faster by tracking a file s disposition over time

27 Updating Security to Meet Tomorrow s Challenges Talos Security Intelligence and Research Group Threat Intelligence Web Research Response Network Endpoint Get industry-specific threat intelligence tailored to your business Catch advanced threats endpoints miss with Cisco s reverse engineers and threat analysts Virtual Cloud 600+ Researchers Stay protected against the latest threats with regular updates pushed automatically Multi-tiered defense Industry-leading research

28 Identifying Unnamed Threats and Breaches Continuous Capabilities with Cisco Cognitive Threat Analytics (CTA) Anomaly Detection Detect infections faster by automatically scanning for symptoms of an attack Behavioral Analysis Identify unknown breaches by analyzing a user s behavior over time Machine Learning Automatically learn and adapt to threats with big-data algorithms

29 With Unified Reporting and Policy Management Unified Reporting Unified Policies Roaming User HQ Roaming User HQ WSA WSA ü ü ü ü Web Security Reporting Application Cloud Web Security Graphical User Interface

30 And Work with Your Existing Environment CWS Traffic Redirectors WSA Models Physical Appliance Perfect for small business branches Perfect for mid-size offices Perfect for large enterprises WSA-S190 WSA-S390 WSA-S690 ASA WSA Explicit/ PAC ISR G2/ ISR 4K* AnyConnect Virtual Appliance (WSAv) Respond instantly to traffic spikes and eliminate capacity planning by never shipping or installing a physical appliance *GRE over IPsec

31 Only Cisco Offers Web Security with Advanced Threat Protection Comprehensive Defense Advanced Threat Protection Superior Flexibility

32 Thank you