How to Predict, Detect & Stop threats at the Edge and Behind the Perimeter even in encrypted traffic without decryption

Transcription

1 How to Predict, Detect & Stop threats at the Edge and Behind the Perimeter even in encrypted traffic without decryption Nikos Mourtzinos, CCIE #9763 Cisco Cyber Security Sales Specialist April 2018

2 New threat landscape Organizations are at risk 38% 81% 41% 64% 62% of organizations have been victims of a cyber attack of attackers used encryption to evade detection cannot detect malicious content in encrypted traffic Decrypt Do not decrypt New attack vectors Employees browsing over HTTPS: Malware infection, covert channel with command and control server, data exfiltration Employees on internal network connecting to DMZ servers: Lateral propagation of encrypted threats Source: Ponemon Report, 2016

3 Security Architecture 1. Firepower 1. Firepower 1. FMC Management, Reporting, Analytics

4 Security Architecture 1. Firepower 1. Firepower Perimeter Visibility SSL Decryption Automated NGIPS AMP - Sandboxing Indication of Compromise Correlation 1. FMC Management, Reporting, Analytics

5 IPS configuration Security Specialist to know customer environment Write down all vulnerabilities Select IPS signatures out of available Configure Achieve high security effectiveness to block attacks

6 September 2017 Kick off Mon Tue Wed Thu Fri Sat Sun Kick-off

7 September 2017 Know the environment Mon Tue Wed Thu Fri Sat Sun Kick-off

8 September 2017 Locate Vulnerabilities Mon Tue Wed Thu Fri Sat Sun Kick-off

9 September 2017 Select Signatures Mon Tue Wed Thu Fri Sat Sun Kick-off

10 September 2017 Configure Hardware & Software Mon Tue Wed Thu Fri Sat Sun Kick-off

11 IPS Tuning Security Effectiveness Without Automated Tuning Time

12 Environment Changes! June February January August March April July May Su Mo Tu We Th Fr Sa Su Mo Tu We Th Fr Sa

13 IPS Tuning is required!!!! NSS IPS Test Key Findings: Protection varied widely between 31% and 99,5%. Tuning is required, and is most important for remote attacks against servers and their applications. Complex Operations & Increases Costs

14 IPS Tuning Organizations that do not tune could be missing numerous catchable attacks Security Effectiveness Without Automated Tuning Time

15 Automated Tuning Adjust IPS policies automatically based on network changes Automated NGIPS Tuning Automated Recommended Rules based on Organization s Infrastructure Automated IPS Policies based on Changes Simplifies Operations & Reduces Costs

16 Automated NGIPS Tuning Security Effectiveness Without Automated Tuning With Automated Tuning Time

17 Security Architecture 1. Firepower 2. AMP for endpoint Remote Endpoints 2. AMP for Endpoints 1. Firepower 2. AMP for Endpoints 1. FMC Management, Reporting, Analytics Windows OS Android Mobile Virtual MAC OS AMP for Endpoints can be launched from Cisco AnyConnect CentOS, Red Hat Linux for servers and datacenters

18 What do you get with AMP for Endpoints? AV Engine Command Line Visibility File Reputation Exploit Prevention (File-less Attacks) Indications of Compromise Malicious Activity Protection (Ransomware) Sandboxing Machine Learning Continuous Analysis

19 What do you get with AMP for Endpoints? AV Engine Command Line Visibility File Reputation Exploit Prevention (File-less Attacks) Indications of Compromise Malicious Activity Protection (Ransomware) Sandboxing Machine Learning Continuous Analysis

20 Security Architecture 1. Firepower 2. AMP for endpoint 3. Stealthwatch Remote Endpoints 2. AMP for Endpoints 1. Firepower 2. AMP for Endpoints 1. FMC Management, Reporting, Analytics Windows OS Android Mobile Virtual MAC OS AMP for Endpoints can be launched from Cisco AnyConnect CentOS, Red Hat Linux for servers and datacenters 3. Stealthwatch

21 Organization with Only Perimeter Visibility Visibility available for traffic transiting through perimeter Many devices in your network without visibility / / / Internet

22 Enabling Visibility Inside Your Organization KNOW every host RECORD every conversation EVERYTHING on the network / / / Internet

23 Forrester s Zero Trust Framework Zero trust operates under the principle of never trust, always verify, which means that trust is never assumed for any device or user on the system.

24 Next Generation Cyber Threat Defense Cisco StealthWatch Aggregating, analyzing NetFlow Network Behavior - Baseline Anomaly Detection Algorithms Insider Threats Internal Network and Borders NetFlow Telemetry Switches, Routers, and Firewalls Cisco Identity Services Engine Identity, Device, Posture

25 Encryption Is Changing The Threat Landscape Straight line Projection 50% 60% 41% 34% 16% 20% 19% 22% 23% 23% 25% 27% 30% FY05 FY06 FY07 FY08 FY09 FY10 FY11 FY12 FY13 FY14 FY Source: Thales and Vormetric Extensive deployment of encryption

26 Encrypted Traffic Analytics Published research 18 patents filed Identifying Encrypted Malware Traffic with Contextual Flow Data AISec 16 Blake Anderson, David McGrew (Cisco Fellow)

27 Industry s first solution with ability to find threats in encrypted traffic without decryption Initial Data Packet Sequence of Packet Lengths and Times Threat Intelligence Map Initial Data Packet Data exfiltration Self-Signed certificate C2 message Broad behavioral information about the servers on the Internet.

28 Malware in Encrypted Traffic Cisco Stealthwatch NetFlow Machine Learning Malware detection and cryptographic compliance Telemetry for encrypted malware detection and cryptographic compliance

29 Malware in Encrypted Traffic

30 Cryptographic Compliance Flow search results

31 Encrypted Traffic Analytics receives Miercom Performance Verified Certification Key Conclusions 36% higher rate detection finding 100% of threats

32 Security Architecture 1. Firepower 2. AMP for endpoint 3. Stealthwatch 1. Firepower Remote Endpoints Perimeter 2. AMP for Endpoints Visibility Automated NGIPS AMP - Sandboxing Indication of Compromise Correlation 2. AMP for Endpoints Inside the Organization Know every host 1. FMC Management, Reporting, Analytics Windows OS Android Mobile Virtual MAC OS AMP for Endpoints can be launched from Cisco AnyConnect CentOS, Red Hat Linux for servers and datacenters Record every conversation Everything on the network

33 Cisco Integrated Security Portfolio It s our #1 differentiator It solves a vital customer problem: complexity 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

34 Cisco s Integrated Security Portfolio works in concert to prevent breaches, automate response, and detect and stop threats fast Stealthwatch Network ISR/ASR ISE Cloudlock Umbrella Event Threat Intel Policy Context Meraki Advanced Malware Threat Grid Web WWW NGFW/ NGIPS 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

35 automation Stealthwatch save time Network ISR/ASR see more ISE Cloudlock detect faster better protection Umbrella Meraki Advanced Malware Threat Grid Web WWW NGFW/ NGIPS 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

36 Ecosystem and Integration Vulnerability Management Packet Brokering Network Infrastructure & Policy Management Performance Management & Visualization Mobility Packet Capture & Forensics SIEM & Analytics Custom Detection Remediation & Incident Response IAM/SSO Firewall/Access Control

37 Threats blocked (daily) Vendor. Vendor. TALOS 20,000,000,000 Vendor. Vendor. Vendor. Vendor Cisco and/or its affiliates. All rights reserved. Cisco Confidential

38 Questions 1. Can your firewall talk to the rest of your security ecosystem to improve visibility, increase speed to detection and response, and automate tasks? 2. How do you protect yourself from traffic the firewall doesn t see? 3. How do you protect devices when they are off the corporate network? 4. Are you prepared for Ransomware infections? 5. What if you ARE breached What do you do next? 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

39 Get started with Cisco Security today 1 Learn more about how Cisco Security can work with your business 2 Schedule a Proof Of Value to identify areas in your business where visibility or control is lacking 39

40 Nikos Mourtzinos, CCIE #9763 Cyber Security Sales Specialist Linkedin nmourtzi