Protecting the Device: Cisco Trustworthy Systems & Embedded Security
|
|
|
- Darren May
- 6 years ago
- Views:
Transcription
1
2 BRKSEC-1010 Protecting the Device: Cisco Trustworthy Systems & Embedded Security David Lapier Senior Product Stephen Lynn Consulting Architect CCIE 5507 (R&S/WAN/Security) CCDE
3 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#brksec Cisco and/or its affiliates. All rights reserved. Cisco Public
4 David lives in Palo Alto CA Likes to sailboat race. Reads too much Sci Fi. Stephen Live in Washington DC Like skiing and scuba diving Cisco and/or its affiliates. All rights reserved. Cisco Public
5 Abstract Malware installed on network devices is a real threat. This presentation addresses how Cisco builds trust into its products to mitigate attacks on the infrastructure. We also introduce best practices for the network administrator for securing the device 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
6 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
7 Security Landscape How do we trust the network and devices? How do we verify it? DDoS TAm Secure Storage Chip Guard MACsec Protocol Security Security Secure Asset Transfer Image Signing BIOS / Boot Loader Protection Secure Boot IPC Authentication Remote Attestation Run time Defense Certifications Detection and Recovery BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 7
8 Agenda Anatomy of an Attack Trustworthy Systems Built-In Security and Trust Cisco Cloud Offerings Trustworthy Technologies Image Signing and Secure Boot Trust Anchor Module Hardware Authenticity Check Integrity Verification Secure Zero-Touch Deployment Best Practices Runtime Defenses Quality Crypto Summary
9 Anatomy of an Attack
10 Anatomy of An Attack Recon Infiltration Compromise Data Exfiltration Cleanup Attacker looks for weakness Attacker uses info from recon to exploit the network device Network device is accessed Data is acquired from target devices Attacker cleanup evidence of compromise BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 10
11 The Attack IOS Modifications Malware: 6 Observed Variants Incident 0 Static infection Crypto (DH keys) Incident 1 Static infection Crypto (DH keys) Incident 2 Runtime infection C&C data exfil. Incident 3 Runtime infection C&C; data exfil. multi-arch Line cards Incident 4 Runtime infection C&C data exfil. ROMMON modular Synful Knock Static infection C&C; modular BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 13
12 Today s Products for Todays Threats Risk Attackers are Professional Nation-State Criminal Political Insider Physical Isolation Locked Cabinets Limited staff access Proprietary HW & SW Staff Related Breaches Grow Physical Barriers Break Down Social Engineering Outsourcing Internet Cloud Virtualization Open-Source 10 Years Ago Today BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 14
13 Trustworthy Systems
14 Security is and will remain one of our absolute highest priorities. Chuck Robbins, CEO Cisco Systems 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
15 Security Culture Platform Integrity Protect the Network Cisco Trustworthy Systems Levels Device Level Attack Protection Solution Level Attack Protection DHCP Snooping Port Security urpf Intrusion Detection IP Source Guard ACLs TrustSec ISE Stealthwatch FnF Secure Boot Image Signing Counterfeit Protections Hardware Trust Anchor Runtime Defenses OS Validation Modern Crypto Secure Device Onboarding Supply Chain Management Open Source Registration Security Training Threat Modeling Product Security Baseline PSIRT Advisories BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 17
16 Trust for Cisco Cloud Offerings SaaS IaaS Users Data Apps PaaS HQ Roaming user Branch BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 18
17 Cloud Services Vulnerability Attack Types The first line of defense against threats on the Internet wherever users go XSS Web Front Ends Remote Code Execution Backdoors Command Injections Web based attacks XSS, CSRF, Unprotected API s, Misconfigured ACL Backdoors through unknown service accounts or hardcoded default credentials. Command Injection through input validation weakness. BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 19
18 Trustworthy Cloud From Product to Service Continuous Security Hosting Infrastructure Share responsibilities Ongoing operations DevOps Model Scale & Responsiveness Automate Security Build, operate, and monitor with trust BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 20
19 Continuous Security Validate Regularly BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 21
20 Cisco Meraki Trust BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 22
21 Administrative Tools & Best Practices Two Factor Authentication for Admin Access Password strengthening Role Based Access Alerting on configuration change Audit of configuration and logging SSL Certificate verification Idle Timeouts Security Rewards Program BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 23
22 Image Signing and Secure Boot
23 Software Modification on Network Elements In a troubling new development, threat actors looking for different ways to break into and remain undetected on enterprise networks appear to have begun targeting routers connecting businesses to the Internet. Jay Vijajan, DARKReading Cisco and/or its affiliates. All rights reserved. Cisco Public
24 Mitigations at Boot Time Malware: 6 Observed Variants Incident 0 Static infection Crypto (DH keys) Incident 1 Static infection Crypto (DH keys) Incident 2 Runtime infection C&C data exfil. Incident 3 Runtime infection C&C; data exfil. multi-arch Line cards Incident 4 Runtime infection C&C data exfil. ROMMON modular Synful Knock Static infection C&C; modular BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 26
25 Mitigations at Boot Time Malware: 6 Observed Variants Incident 0 Static infection Crypto (DH keys) Incident 1 Static infection Crypto (DH keys) Incident 2 Runtime infection C&C data exfil. Incident 3 Runtime infection C&C; data exfil. multi-arch Line cards Incident 4 Runtime infection C&C data exfil. ROMMON modular Synful Knock Static infection C&C; modular BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 27
26 Mitigations at Boot Time Malware: 6 Observed Variants Incident 0 Static infection Crypto (DH keys) Incident 1 Static infection Crypto (DH keys) Incident 2 Runtime infection C&C data exfil. Incident 3 Runtime infection C&C; data exfil. multi-arch Line cards Incident 4 Runtime infection C&C data exfil. ROMMON modular Synful Knock Static infection C&C; modular BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 28
27 SynFul Knock Synful Knock Persistent malware that relies on stolen admin credentials to install cunning backdoor Gaining access to the ROMMON boot loader allows the malware to persist through reboots Modified image allows hacker to install independent executables on routers Attacker manipulates infected device behavior via HTTP C&C packets sent to the targeted device Found on ISR G1 1841/2811/3825 Static Infection to modify Cisco IOS. BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 29
28 Image Signing: How It Works Signing Hash Function Signing Hash With Cisco Private Key Embed Signature to the Software BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 30
29 Image Signing: How It Works Verification Hash Function Hash is Compared to Verify Authenticity Verify Signature Hash With Cisco Public Key BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 31
30 Generic Boot Sequence Bootloader Fetch Hardware Instruction set. Initialize Basic Input/Output System (BIOS) Operating System Start-up Operating System BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 32
31 Infection Points to Generic Boot Sequence Bootloader Fetch Hardware Instruction set. Initialize Basic Input/Output System (BIOS) Operating System Start-up Operating System Changing the boot interface Booting from alternate device Bypassing Integrity checks Adding persistent code BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 33
32 Secure Boot Starts from Protected Code Hardware Instruction Set (Boot Code) must be protected against an unauthorized modification from outside BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 34
33 Trust Anchor for Secure Boot Stores the initial instructions securely Point of trust where validation can begin. Cryptographically validates the integrity of ROMMON Ensures integrity for the boot sequence BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 35
34 Cisco Secure Boot Anchors Secure Boot in Hardware to Create a Chain of Trust Cisco Secure Boot Boot Code Integrity Anchored in Hardware Step 1 Step 2 Step 3 Step 4 Software Authenticity: Hardware Anchor Microloader CPU Microloader Microloader checks bootloader CPU Bootloader Bootloader checks OS CPU OS OS launched Only authentic signed Cisco software boots up on a Cisco platform The boot process stops if any step fails to authenticate IOS show software authenticity command illustrates the results BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 36
35 Cisco Secure Boot and UEFI Secure Boot Hardware-anchored Secure Boot UEFI Step 1 Step 2 Step 3 Step 4 * Hardware Anchor Microloader CPU Microloader CPU Bootloader CPU OS Microloader checks Bootloader Bootloader checks OS OS launched Cisco Secure Boot Anchors Secure Boot process to hardware Resists supply chain and physical possession-based firmware tampering attacks - More difficult to modify hardware than software - More expensive - Hardware modification is more visible Unified Extensible Firmware Interface (UEFI) Not anchored in hardware Nothing validates Bootloader - Susceptible to Bootloader rootkits - Susceptible to easy modifications in supply chain or with physical possession BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 37
36 Trust Anchor Module (TAm)
37 Cisco Trust Anchor Module (TAm) Integrity Applications TAM Services Libraries HW Authenticity Check Secure PnP Integrity Verification Crypto Functions Tamper-Proof Storage Boot Measurements SUDI Anti-Tamper Chip Design Built-In Crypto Functions Secure Storage BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 39
38 Platform Integrity: TPM and TAm Compared TPM & TAm Capabilities Anti-tamper Non-volatile secure storage Crypto engine Key storage Random number generation Policy & Configuration Cisco Trust Anchor Module Hardware designed to provide both enduser and supply chain protections Ideal for specialized network devices Trusted Platform Module (TPM) Typically focused on providing enduser capabilities Ideal for general purpose computing BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 40
39 Secure Unique Device Identification (SUDI) Tamperproof ID for the device Binds the hardware identity to a key pair in a cryptographically secure X.509 certificate PID during manufacturing Connections with the device can be authenticated by the SUDI credential IEEE 802.1AR Compliant BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 41
40 Uses for SUDI Internal checks in the box Authentication Bootstrap Identity Remote Attestation BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 42
41 Cisco Trust Anchor Module Tamper Proof Storage Embedded Crypto Functions Applications Built-In Security Hardware Authenticity Check Integrity Verification Secure Zero-Touch Provisioning BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 43
42 Hardware Authenticity Check Integrity Verification
43 Counterfeiting is Real 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
44 Cisco Secure Boot and Trust Anchor Module Validating the Authenticity of Software Followed by Hardware Step 5 Step 6 Step 1 Step 2 Step 3 Step 4 Trust Anchor module Trust Anchor module * CPU CPU CPU CPU CPU Microloader Bootloader OS OS OS Microloader Microloader checks Bootloader Bootloader checks OS OS launched Authenticity and license checks * The first instructions that run on a CPU are either stored in immutable hardware so that they cannot be tampered with or are validated by the hardware * Hardware authenticity check Software authenticity check BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 47
45 Verifying that I can trust the device 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
46 Boot Integrity Visibility Store Boot Measurements Step 1 Step 2 Step 3 Step 4 Hardware Anchor CPU Microloader CPU Bootloader CPU OS Microloader Microloader checks bootloader Bootloader checks OS OS launched Write Measurements TAm Tamper Proof Storage BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 50
47 Boot Integrity Visibility = Remote Attestation Report Results Securely Client Integrity Verification App Known Good Values (KGV) Request SUDI [Nonce] SUDI is. Request Integrity Measures Values Are. TAm Crypto Functions Tamper-Proof Storage Boot Measurements SUDI BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 51
48 Boot Integrity Visibility Attestation of the Identity and Boot Status Cisco Development Cycle Software Development Known Good Value Collection Secure Boot Network Device Extract & Sign Measurements with SUDI Measurements Trust Anchor Nonce to prevent re-play attacks Integrity Verification App Decrypt & Verify Measurements Verifies: Identity of the device running authenticate Cisco SW on authentic Cisco HW. CCO BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 52
49 Integrity Verification Demo
50 Secure Zero-Touch Deployment
51 Step 1: SUDI unique device identifier and serial number installed at manufacturing 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
52 Step 2: Secure boot of signed images at start-up verifies platform integrity 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
53 Step 3: Verification of device authenticity and integrity 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
54 Step 4: Network device sends its credentials to the Plug and Play server 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
55 Step 5: Plug and Play server verifies the identity of the device to be provisioned 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
56 Step 6: Two-way trust and secure communications established 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
57 Step 7: Secure provisioning of Cisco network device 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
58 Cisco SD-WAN Platform for Digital Transformation Cloud Delivered Analytics Automation Virtualization USERS SDWAN Cloud. IoT DC DEVICES Cisco SD-WAN Fabric IaaS SaaS APPLICATIONS THINGS SECURE SCALE OPEN vdc BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 63
59 Cisco SD-WAN Zero Touch Provisioning Certificate-Based Trust Signed vedge List vmanage Administrator Defined Controllers Bi-directional certificate-based trust between all elements - Public or Enterprise PKI White-list of valid vedges and controllers - Certificate serial number as unique identification vbond vsmart vedge BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 64
60 Best Practices
61 Best Practices For Securing Infrastructure Devices Monitor Cisco Security Advisories and Responses Strength Login credential by leveraging Authentication, Authorization, and Accounting (AAA) Centralized Log Collection and Monitoring Establish baseline and instrument the network to gain traffic visibility with NetFlow Control Plane & Management Plane Hardening 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
62 PSIRT Cisco Security Advisories and Response Vulnerability Management Evaluate and drive resolution of Cisco product & Cloud Services vulnerabilities Incident Response Assist customers with networkimpacting security events Proactive Engagement Provide feedback and influence product design BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 68
63 Cisco PSIRT Openvuln API Stay informed about security vulnerabilities BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 69
64 A Modern Approach to Security Vulnerability Disclosures This API allows technical staff and programmers to build tools that help them do their job more effectively. In this case, it enables them to easily keep up with security vulnerability information specific to their network. Open Source Tools Access our GitHub Repository and open source tools at: CISCO PSIRT OPENVULN API Community Support Collaborate, learn, share and interact with Cisco PSIRT and other industry experts at the Cisco PSIRT Developer Community: Cisco Security Center Access numerous security resources, white papers, vulnerability reports, blog posts, RSS feeds, and other information at: BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 70
65 Phishing for login credentials Attackers Use Stolen Credentials to Hack Cisco Networking Devices SecurityWeek August 13, percent of companies expect to suffer a breach due to compromised credentials 2016, Cloud Security Alliance 81% of hacking-related breaches leveraged either stolen and/or weak passwords 2017 Verizon Data Breach Investigations Report
66 Prevent Unauthorized Access Better and Stronger Authentication Better / stronger Password Using enable secret (single factor) Public/private key (single factor) One Time Password/Token System(2-factor) CAC/smartcard with X.509v3 certificate RFC 6187 (2-factor) BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 72
67 CAC/smartcard with X.509v3 SSH Authentication Pragma Fortress CL SSH Client Cisco SSH Server Feature Cisco ACS (AAA) X.509 Authentication SSH Session Establishment User Authorization CAC card reader Most secure access to command line Two-factor authentication X.509v3 certificate & PIN Government Certified Standard RFC-6187 First End-to-end solution with Cisco and Pragma Systems BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 73
68 Gain visibility and intelligence of your network Network as a Sensor Stealthwatch Leverage information from other solutions to gain complete network visibility and security analytics Provides unique visibility into what s happening across your entire network Company Host Access Audit Posture Detect Detects anomalies and threats faster with real-time analysis and advanced forensics capabilities Everything must touch the network Know every host Record every conversation Understand what s normal Get alerted to change Generates notifications automatically when anomalies are detected on the network Stealthwatch BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 74
69 Hardening the Device Enable SSH and Disable Telnet hostname <hostname> ip domain-name <domainname> crypto key generate rsa general-keys modulus 2048 ip ssh time-out 60 ip ssh source-interface <Source Interface> ip ssh logging events ip ssh version 2 ip ssh dh min size 2048! line vty 0 15 access-class 100 in transport input ssh transport output ssh!!!control access to VTY terminal!!!specify SSH as the only!!!access to VTY BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 75
70 Hardening the Device Enable Data at Rest Protection with AES-128 Algorithm service password-encryption password encryption aes Disable Unused Services no service pad no service config no ip source-route no ip gratuitous-arps no service dhcp no ip http server no ip http secure-server no ip source-route no ip gratuitous-arps no ip bootp server BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 76
71 Hardening the Device Protect routed interfaces from spoofing and probing no ip proxy arp no ip unreachable no ip redirects ip verify unicast source reachable-via rx no ipv6 unreachables no ipv6 redirects ipv6 verify unicast source reachable-via rx BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 77
72 Hardening the Device Use SNMPv3 to secure access to devices by authenticating and encrypting data packets snmp-server group <group name> v3 priv snmp-server trap-source <interface> snmp-server enable traps <trap type> snmp-server group <Group Name> v3 priv snmp-server view <View Name> iso included snmp-server trap-source <Source Interface> snmp-server host <Ipv4 address> version 3 priv admin snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart snmp-server enable traps config BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 78
73 Runtime Defenses
74 Vulnerabilities in Running Software Attacker wants to exploit the Operating System when the software is running. Build software so that the possibility for exploitation is reduced. Use Compiler, kernel, and HW capabilities to provide protections 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
75 Mitigations at Runtime Malware: 6 Observed Variants Incident 0 Static infection Crypto (DH keys) Incident 1 Static infection Crypto (DH keys) Incident 2 Runtime infection C&C data exfil. Incident 3 Runtime infection C&C; data exfil. multi-arch Line cards Incident 4 Runtime infection C&C data exfil. ROMMON modular Synful Knock Static infection C&C; modular BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 81
76 Heartbleed: Buffer Overflow Attack BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 84
77 Computer Scientists Take Over Electronic Voting Machine Return Oriented Programming Attack Overrun data buffers to bypass normal execution Method of Code Reuse Attack Use libc gadgets to manipulate the system UC San Diego, August 11, 2009 Stephen Checkoway, Ph.D. BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 85
78 Cisco Runtime Defenses Address Space Layout Randomization (ASLR) Object-Size Checking X-Space Hardware, Operating System, Compiler, and Development Best Practices To protect against Buffer-Overflow and Return-Oriented Programming Attacks BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 86
79 Quality Cryptography
80 Why Quality Crypto Matters Compatibility Privacy Efficient Drivers Data Protection Secure Cryptography Secure Storage Simplification Enablers BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 88
81 Quality Crypto - CiscoSSL OpenSSL Hardened Crypto Library Feature Enhancements Certification Support BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 89
82 Quality Crypto - CiscoSSL Hardened Crypto Library Feature Enhancements Certification Support industry best practices improving security and usability compliance for public sector RC4 TLS cipher suites disabled GOST ciphers disabled SP800-90A DRBG enabled by default SSLv2 and SSLv3 are disabled Improved ECC performance with FEC deprecation International ECC support IETF Curve25519 Deterministic ECDSA enhancements to improve security posture. Side-channel attack mitigation for ECDSA signature generation Entropy Enhancements RDRAND support A DRBG FIPS Object Module Support FIPS mode Includes support for updated NIST requirements Common Criteria Support CC mode Alignment with new NIAP and Protection Profile requirements BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 90
83 Quality Crypto - CiscoSSL Hardened Crypto Library Feature Enhancements Certification Support industry best practices improving security and usability compliance for public sector RC4 TLS cipher suites disabled GOST ciphers disabled SP800-90A DRBG enabled by default SSLv2 and SSLv3 are disabled Improved ECC performance with FEC deprecation International ECC support IETF Curve25519 Deterministic ECDSA enhancements to improve security posture. Side-channel attack mitigation for ECDSA signature generation Entropy Enhancements RDRAND support A DRBG FIPS Object Module Support FIPS mode Includes support for updated NIST requirements Common Criteria Support CC mode Alignment with new NIAP and Protection Profile requirements BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 91
84 Quality Crypto - CiscoSSL Hardened Crypto Library Feature Enhancements Certification Support industry best practices improving security and usability compliance for public sector RC4 TLS cipher suites disabled GOST ciphers disabled SP800-90A DRBG enabled by default SSLv2 and SSLv3 are disabled Improved ECC performance with FEC deprecation International ECC support IETF Curve25519 Deterministic ECDSA enhancements to improve security posture. Side-channel attack mitigation for ECDSA signature generation Entropy Enhancements RDRAND support A DRBG FIPS Object Module Support FIPS mode Includes support for updated NIST requirements Common Criteria Support CC mode Alignment with new NIAP and Protection Profile requirements BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 92
85 Summary
86 Direct attacks on network devices are a real threat Keep Malware Out Block Tampering Stop Counterfeiting SYNful Knock Exploit the Network Steal Intellectual Property Steal Customer Data Money Laundering Insider Trading Identity Theft Attack Customers Ransomware Brand Damage BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 94
87 Trustworthy Systems Holistic Approach Built for Today s Threats Evidence of Trust Security Expertise and Innovation Organizations require a secure, resilient network foundation for digitization BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 95
88 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#brksec Cisco and/or its affiliates. All rights reserved. Cisco Public
89 Please complete your Online Session Evaluations after each session Complete 4 Session Evaluations & the Overall Conference Evaluation (available from Thursday) to receive your Cisco Live T-shirt All surveys can be completed via the Cisco Live Mobile App or the Communication Stations Complete Your Online Session Evaluation Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at Cisco and/or its affiliates. All rights reserved. Cisco Public
90 Continue Your Education Demos in the Cisco campus Walk-in Self-Paced Labs Tech Circle Meet the Engineer 1:1 meetings Related sessions BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 98
91 Thank you
92
93 Backup Slides
94 Feature Support
95 Feature Support Feature Support ASR 1001-HX ASR 1002-HX ASR 1000-RP3 ASR 1001-X ASR 1002-X ASR 1000-RP2 Image Signing Yes Yes Yes Yes Yes Yes HW-Anchored Secure Boot Yes Yes Yes Yes Yes No Trust Anchor Module Yes Yes Yes Yes No No HW Authenticity Assurance Yes Yes Yes Yes Yes Yes Boot Integrity Visibility Yes Yes Yes Yes Yes No Runtime Defenses Yes Yes Yes Yes Yes Yes Simplified Factory Reset Yes (16.7.1) Yes (16.7.1) Yes (16.7.1) Yes (16.7.1) Yes (16.7.1) Yes (16.7.1) Secure Storage No No No No No No Secure Guest Shell Yes (16.7.1) Yes (16.7.1) Yes (16.7.1) Yes (16.7.1) Yes (16.7.1) Yes (16.7.1) Solution Support SUDI authentication for Cisco Network PnP* Yes Yes Yes Yes No APIC EM Integrity Visibility App Support Yes Yes Yes Yes Yes *See Release Notes for Network Plug and Play ** For specific models, see Cisco 800 Series Integrated Services Routers Software Configuration Guide BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 103
96 Feature Support Feature Support ISR 4451-X ISR 4431 ISR 4351 ISR 4331 ISR 4321 ISR 4221 CSR 1000V ENCS-5400 Image Signing Yes Yes Yes Yes Yes Yes Yes Yes HW-Anchored Secure Boot Yes Yes Yes Yes Yes Yes No Yes Trust Anchor Module Yes Yes Yes Yes Yes Yes No Yes HW Authenticity Assurance Yes Yes Yes Yes Yes Yes No No Boot Integrity Visibility Yes Yes Yes Yes Yes Yes No No Runtime Defenses Yes Yes Yes Yes Yes Yes Yes No Simplified Factory Reset Yes (16.6.1) Yes (16.6.1) Yes (16.6.1) Yes (16.6.1) Yes (16.6.1) Yes (16.6.1) No No Secure Storage Yes (16.6.1) Yes (16.6.1) Yes (16.6.1) Yes (16.6.1) Yes (16.6.1) Yes (16.6.1) No No Secure Guest Shell Yes (16.5.1) Yes (16.5.1) Yes (16.5.1) Yes (16.5.1) Yes (16.5.1) Mar '18 (16.8.1) Nov '17 (16.7.1) No Solution Support SUDI authentication for Cisco Network PnP* Yes Yes Yes Yes Yes Yes No Yes APIC EM Integrity Visibility App Support Yes Yes Yes Yes Yes Yes *See Release Notes for Network Plug and Play ** For specific models, see Cisco 800 Series Integrated Services Routers Software Configuration Guide BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 104
97 Feature Support Feature Support IR 809 ISR 819 ISR 829 ISR 840 ISR 860 ISR 880 ISR 890 ISR 1900 ISR 2900 ISR 3900 Image Signing Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes HW-Anchored Secure Boot Yes No Yes No No No No No No No Trust Anchor Module Yes No Yes No No No No No No No HW Authenticity Assurance Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Boot Integrity Visibility No No No No No No No No No No Runtime Defenses Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Simplified Factory Reset No No No No No No No No No No Secure Storage No No No No No Yes** Yes** No No No Secure Guest Shell No No No No No No No No No No Solution Support SUDI authentication for Cisco Network PnP* No Yes No No No No No No No No APIC EM Integrity Visibility App Support *See Release Notes for Network Plug and Play ** For specific models, see Cisco 800 Series Integrated Services Routers Software Configuration Guide BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 105
98 Feature Support & Roadmap Feature Support Cat 9500 Cat 9400 Cat 9300 Cat 3850 Cat 3850 Fiber Cat 3650 Image Signing Yes Yes Yes Yes Yes Yes HW-Anchored Secure Boot Yes Yes Yes Yes Yes Yes Trust Anchor Module Yes Yes Yes Yes Yes Yes HW Authenticity Assurance Yes Yes Yes Yes Yes Yes Boot Integrity Visibility Mar '18 (16.8.1) Mar '18 (16.8.1) Mar '18 (16.8.1) Yes Yes Yes Runtime Defenses Yes Yes Yes Yes Yes Yes Simplified Factory Reset Mar '18 (16.8.1) Mar '18 (16.8.1) Mar '18 (16.8.1) Yes (16.6.1) Yes (16.6.1) Yes (16.6.1) Secure Storage Mar '18 (16.8.1) Mar '18 (16.8.1) Mar '18 (16.8.1) Mar '18 (16.8.1) Mar '18 (16.8.1) Mar '18 (16.8.1) Secure Guest Shell Yes (16.5.1) Yes (16.6.1) Yes (16.5.1) Yes (16.5.1) Yes (16.5.1) Yes (16.5.1) Solution Support SUDI authentication for Cisco Network PnP* Yes Yes Yes Yes Yes Yes APIC EM Integrity Visibility App Support Yes Yes Yes Yes Yes Yes *See Release Notes for Network Plug and Play BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 106
99 Feature Support Feature Support Cat 6800 Cat 6800 Cat 4500 Cat 4500 Cat 4500 Cat 3750-X Cat 3560-X Cat 3560-CX Sup6T Sup2T Sup8E Sup7E/LE Cat 4500-X Sup6E/LE Cat 2960-X Cat 2960-L Cat 2960-CX Image Signing Yes - Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes 15.3(1)E Yes HW-Anchored Secure Boot Yes Yes Yes Yes No Yes Yes Yes No Yes No Yes Trust Anchor Module Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No Yes HW Authenticity Assurance Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Boot Integrity Visibility No No No No No No No No No No No No Runtime Defenses Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Simplified Factory Reset No No No No No No No No No No No No Secure Storage No No No No No No No No No No No No Secure Guest Shell No No No No No No No No No No No No Solution Support SUDI authentication for Cisco Network PnP* No No No No No Yes Yes Yes No No No No APIC EM Integrity Visibility App Support BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 107
100 Feature Support Feature Aironet 1560 Aironet 1815 Aironet 2800 Aironet 3800 Aironet 1830 Aironet 1850 Image Signing Yes Yes Yes Yes Yes Yes HW-Anchored Secure Boot Yes Yes Yes Yes Yes Yes Trust Anchor Module Yes No Yes Yes No No HW Authenticity Assurance Yes No Yes Yes Yes Yes Boot Integrity Visibility No No No No No No Runtime Defenses No No No No No No Solution Support SUDI authentication for Cisco Network PnP* No No No No No APIC EM Integrity Visibility App Support No No No No No BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 108
101 Feature Support Feature 8500 Series WLC Cisco 5500 Series WLC Cisco 3504 WLC Cisco 2500 Series WLC Image Signing Yes Yes Yes Yes HW-Anchored Secure Boot No No No No Trust Anchor Module Yes Yes Yes Yes HW Authenticity Assurance Yes Yes Yes Yes Boot Integrity Visibility No No No No Runtime Defenses No No No No Solution Support SUDI authentication for Cisco Network PnP* No No No APIC EM Integrity Visibility App Support Yes Yes Yes *See Release Notes for Network Plug and Play BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 109
102 Feature Support Features Cisco Identity Services Engine (ISE) Cisco Security Appliance (ESA) Cisco Adaptive Security Appliance (ASA) Firepower Security Appliances AMP for Networks Cisco Web Security Appliance (WSA) Image Signing Yes yes Yes for Most Yes Yes Yes Models++ Runtime Defenses Yes Yes Yes yes Yes Yes HW-Anchored Secure Boot ** No No Yes for Most 2100 Series No No Models++ Trust Anchor Module ** No Yes Yes for Most Yes No Yes Models++ HW Authenticity Check ** No Yes Yes Yes No Yes ** Applies to HW / Appliances only ++ Except 5525-X, 5545-X, 5555-X, and 5585-X BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 110
103 Feature Support Questions Ask your acct team BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 111
104 Further Reading Cisco IOS Software Integrity Assurance Methods to compromise Cisco devices, best practices to protect against attempts to modify HW or SW Cisco Guide to Harden Cisco IOS Devices Telemetry Based Infrastructure Device Integrity Monitoring Cisco Security Response Center Home BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 112
105 Further Reading Cisco Event Response: SYNful Knock Malware Digitally Signed Cisco Software 3s/sysimgmgmt-xe-3s-book/sysimgmgmt-dgtly-sgnd-sw.pdf Cisco IOS Software Integrity Assurance Methods to compromise Cisco devices, best practices to protect against attempts to modify HW or SW BRKSEC Cisco and/or its affiliates. All rights reserved. Cisco Public 113
106
Cisco Secure Boot and Trust Anchor Module Differentiation
Solution Overview Cisco Secure Boot and Trust Anchor Module Differentiation Cisco Trust Anchor Technologies provide the foundation for Cisco Trustworthy Systems. Cisco Secure Boot helps ensure that the
Designing Network Encryption for the Future Emily McAdams Security Engagement Manager, Security & Trust Organization BRKSEC-2015
Designing Network Encryption for the Future Emily McAdams Security Engagement Manager, Security & Trust Organization BRKSEC-2015 What Could It Cost You? Average of $0.58 a record According to the Verizon
Agenda: Insurance Academy Event
Agenda: Insurance Academy Event Drs Ing René Pluis MBA MBI Cyber Security Lead, Country Digitization Acceleration program the Netherlands The Hague, Thursday 16 November Introduction Integrated Security
Security+ SY0-501 Study Guide Table of Contents
Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators
Implementing Cisco Network Security (IINS) 3.0
Implementing Cisco Network Security (IINS) 3.0 COURSE OVERVIEW: Implementing Cisco Network Security (IINS) v3.0 is a 5-day instructor-led course focusing on security principles and technologies, using
Connecting Securely to the Cloud
Connecting Securely to the Cloud Security Primer Presented by Enrico Gregoratto Andrew Marsh Agenda 2 Presentation Speaker Trusting The Connection Transport Layer Security Connecting to the Cloud Enrico
DNA Automation Services Offerings
DNA Automation Services Offerings Jamie Owen, Solutions Architect, Cisco Advanced Services Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session
Secure Development Lifecycle
Secure Development Lifecycle Strengthening Cisco Products The Cisco Secure Development Lifecycle (SDL) is a repeatable and measurable process designed to increase Cisco product resiliency and trustworthiness.
Serviceability of SD-WAN
BRKCRS-2112 Serviceability of SD-WAN Chandrabalaji Rajaram & Ali Shaikh Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live
Layer Security White Paper
Layer Security White Paper Content PEOPLE SECURITY PRODUCT SECURITY CLOUD & NETWORK INFRASTRUCTURE SECURITY RISK MANAGEMENT PHYSICAL SECURITY BUSINESS CONTINUITY & DISASTER RECOVERY VENDOR SECURITY SECURITY
Cisco SD-WAN. Securely connect any user to any application across any platform, all with a consistent user experience.
Cisco Securely connect any user to any application across any platform, all with a consistent user experience. Introduction Moving applications to the cloud requires faster, more reliable connectivity.
Authentication Technology for a Smart eid Infrastructure.
Authentication Technology for a Smart eid Infrastructure. www.aducid.com One app to access all public and private sector online services. One registration allows users to access all their online accounts
Cisco SD-Access Hands-on Lab
LTRCRS-2810 Cisco SD-Access Hands-on Lab Larissa Overbey - Technical Marketing Engineer, Cisco Derek Huckaby - Technical Marketing Engineer, Cisco https://cisco.box.com/v/ltrcrs-2810-bcn2018 Password:
Security: The Key to Affordable Unmanned Aircraft Systems
AN INTEL COMPANY Security: The Key to Affordable Unmanned Aircraft Systems By Alex Wilson, Director of Business Development, Aerospace and Defense WHEN IT MATTERS, IT RUNS ON WIND RIVER EXECUTIVE SUMMARY
Cisco Cyber Range. Paul Qiu Senior Solutions Architect
Cisco Cyber Range Paul Qiu Senior Solutions Architect Cyber Range Service A platform to experience the intelligent Cyber Security for the real world What I hear, I forget What I see, I remember What I
Cisco Desktop Collaboration Experience DX650 Security Overview
White Paper Cisco Desktop Collaboration Experience DX650 Security Overview Cisco Desktop Collaboration Experience DX650 Security Overview The Cisco Desktop Collaboration Experience DX650 (Cisco DX650)
Routing Underlay and NFV Automation with DNA Center
BRKRST-1888 Routing Underlay and NFV Automation with DNA Center Prakash Rajamani, Director, Product Management Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session
Enhancing the Cybersecurity of Federal Information and Assets through CSIP
TECH BRIEF How BeyondTrust Helps Government Agencies Address Privileged Access Management to Improve Security Contents Introduction... 2 Achieving CSIP Objectives... 2 Steps to improve protection... 3
Key Threats Melissa (1999), Love Letter (2000) Mainly leveraging social engineering. Key Threats Internet was just growing Mail was on the verge
Key Threats Internet was just growing Mail was on the verge Key Threats Melissa (1999), Love Letter (2000) Mainly leveraging social engineering Key Threats Code Red and Nimda (2001), Blaster (2003), Slammer
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS WHITE PAPER INTRODUCTION BANKS ARE A COMMON TARGET FOR CYBER CRIMINALS AND OVER THE LAST YEAR, FIREEYE HAS BEEN HELPING CUSTOMERS RESPOND
Big and Bright - Security
Big and Bright - Security Big and Bright Security Embedded Tech Trends 2018 Does this mean: Everything is Big and Bright our security is 100% effective? or There are Big security concerns but Bright solutions?
Get Hands On With DNA Center APIs for Managing Intent
DEVNET-3620 Get Hands On With DNA Center APIs for Managing Intent Adam Radford Distinguished Systems Engineer Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session
PrecisionAccess Trusted Access Control
Data Sheet PrecisionAccess Trusted Access Control Defeats Cyber Attacks Credential Theft: Integrated MFA defeats credential theft. Server Exploitation: Server isolation defeats server exploitation. Compromised
Exam : Title : Security Solutions for Systems Engineers(SSSE) Version : Demo
Exam : 642-565 Title : Security Solutions for Systems Engineers(SSSE) Version : Demo 1. SomeCompany, Ltd. wants to implement the the PCI Data Security Standard to protect sensitive cardholder information.
Understanding Cisco Cybersecurity Fundamentals
210-250 Understanding Cisco Cybersecurity Fundamentals NWExam.com SUCCESS GUIDE TO CISCO CERTIFICATION Exam Summary Syllabus Questions Table of Contents Introduction to 210-250 Exam on Understanding Cisco
Cloud Mobility: Meraki Wireless & EMM
BRKEWN-2002 Cloud Mobility: Meraki Wireless & EMM Emily Sporl Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile
BraindumpsVCE. Best vce braindumps-exam vce pdf free download
BraindumpsVCE http://www.braindumpsvce.com Best vce braindumps-exam vce pdf free download Exam : SY0-501 Title : CompTIA Security+ Certification Exam Vendor : CompTIA Version : DEMO Get Latest & Valid
BlackVault Hardware Security Platform SECURE TRUSTED INTUITIVE. Cryptographic Appliances with Integrated Level 3+ Hardware Security Module
BlackVault Hardware Security Platform SECURE TRUSTED INTUITIVE Cryptographic Appliances with Integrated Level 3+ Hardware Security Module The BlackVault hardware security platform keeps cryptographic material
Data Security and Privacy : Compliance to Stewardship. Jignesh Patel Solution Consultant,Oracle
Data Security and Privacy : Compliance to Stewardship Jignesh Patel Solution Consultant,Oracle Agenda Connected Government Security Threats and Risks Defense In Depth Approach Summary Connected Government
Windows IoT Security. Jackie Chang Sr. Program Manager
Windows IoT Security Jackie Chang Sr. Program Manager Rest Physical access to a device will not give access to data Data & Control Execution Data owner has full control over data processing Motion Transport
Cisco Container Platform
Cisco Container Platform Pradnesh Patil Suhail Syed Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click
Cisco Ransomware Defense The Ransomware Threat Is Real
Cisco Ransomware Defense The Ransomware Threat Is Real Seguridad Integrada Abril 2018 Ransomware B Malicious Software Encrypts Critical Data Demands Payment Permanent Data Loss Business Impacts Ramifications
Compare Security Analytics Solutions
Compare Security Analytics Solutions Learn how Cisco Stealthwatch compares with other security analytics products. This solution scales easily, giving you visibility across the entire network. Stealthwatch
Cisco SD-WAN (Viptela) Migration, QoS and Advanced Policies Hands-on Lab
Cisco SD-WAN (Viptela) Migration, QoS and Advanced Policies Hands-on Lab Ali Shaikh Technical Leader Faraz Shamim Sr. Technical Leader Mossaddaq Turabi Distinguished ENgineer Cisco Spark How Questions?
Cloud Customer Architecture for Securing Workloads on Cloud Services
Cloud Customer Architecture for Securing Workloads on Cloud Services http://www.cloud-council.org/deliverables/cloud-customer-architecture-for-securing-workloads-on-cloud-services.htm Webinar April 19,
THE NETWORK. INTUITIVE. Powered by intent, informed by context. Rajinder Singh Product Sales Specialist - ASEAN August 2017
THE NETWORK. INTUITIVE. Powered by intent, informed by context. Rajinder Singh Product Sales Specialist - ASEAN August 2017 The Network. Intuitive. Constantly learning, adapting and protecting. L E A R
The Next Generation Security Platform. Domenico Stranieri Pre- Sales Engineer Palo Alto Networks EMEA Italy
The Next Generation Security Platform Domenico Stranieri Pre- Sales Engineer Palo Alto Networks EMEA Italy The Next Generation Enterprise Security Platform Core Value Proposition An Enterprise Security
Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V3.0, MAY 2017 Multiple Layers of Protection Overview Password Salted-Hash Thank you
AlgoSec: How to Secure and Automate Your Heterogeneous Cisco Environment
BRKPAR-2488 AlgoSec: How to Secure and Automate Your Heterogeneous Cisco Environment Edy Almer How to Secure and Automate Your Heterogeneous Cisco Environment Yogesh Kaushik, Senior Director Cisco Doug
PnP Deep Dive Hands-on with APIC-EM and Prime Infrastructure
LTRNMS-2007 PnP Deep Dive Hands-on with APIC-EM and Prime Infrastructure Thomas Gerneth, Julian Mueller,Tobias Huelsdau Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after
Next generation branch with SD-WAN and NFV
Next generation branch with SD-WAN and NFV Kiran Ghodgaonkar, Senior Manager, Enterprise Marketing Mani Ganeson, Senior Product Manager PSOCRS-2004 @ghodgaonkar Cisco Spark How Questions? Use Cisco Spark
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
Cisco TrustSec How-To Guide: Universal Configuration for the Cisco Wireless LAN Controller
Cisco TrustSec How-To Guide: Universal Configuration for the Cisco Wireless LAN Controller For Comments, please email: howtoguides@external.cisco.com Current Document Version: 3.0 August 27, 2012 Table
CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001)
CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001) Gregg, Michael ISBN-13: 9781118083192 Table of Contents Foreword xxi Introduction xxvii Assessment Test xliv Chapter 1 Cryptographic
How to Predict, Detect & Stop threats at the Edge and Behind the Perimeter even in encrypted traffic without decryption
How to Predict, Detect & Stop threats at the Edge and Behind the Perimeter even in encrypted traffic without decryption Nikos Mourtzinos, CCIE #9763 Cisco Cyber Security Sales Specialist April 2018 New
Encrypted Traffic Analytics
Encrypted Traffic Analytics Introduction The rapid rise in encrypted traffic is changing the threat landscape. As more businesses become digital, a significant number of services and applications are using
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM OVERVIEW The Verizon 2016 Data Breach Investigations Report highlights that attackers are regularly outpacing the defenders.
ATTIVO NETWORKS THREATDEFEND PLATFORM INTEGRATION WITH CISCO SYSTEMS PROTECTS THE NETWORK
PARTNER BRIEF ATTIVO NETWORKS THREATDEFEND PLATFORM INTEGRATION WITH CISCO SYSTEMS PROTECTS THE NETWORK INTRODUCTION Attivo Networks has partnered with Cisco Systems to provide advanced real-time inside-the-network
Cisco ASA 5500-X NGFW
Cisco ASA 5500-X NGFW Sieťová ochrana pre malé a stredné podniky pred modernými hrozbami Peter Mesjar CCIE 17428, Systémový Inžinier, Cisco What are we going to talk about Problem is THREATS How today
AMP for Endpoints & Threat Grid
AMP for Endpoints & Threat Grid Response & Prevention Dean De Beer & Eric Hulse BRKSEC-2029 AMP Threat Grid Malware Analysis Engines & Techniques A little background Malware Analysis & Threat Intelligence
Cloud-Ready WAN For IAAS & SaaS With Cisco s Next- Gen SD-WAN
BRKCRS-2113 Cloud-Ready WAN For IAAS & SaaS With Cisco s Next- Gen SD-WAN Sumanth Kakaraparthi Product Leader SD-WAN Manan Shah Director Of Product Management Cisco Spark How Questions? Use Cisco Spark
Transforming the Network for the Digital Business
Transforming the Network for the Digital Business Driven by Software Defined Platforms Hugo Padilla Prad Enterprise Networks Digital Acceleration Team CCIE Emeritus #12444 Cisco Forum Kiev, November 14
Cisco SD-Access Building the Routed Underlay
Cisco SD-Access Building the Routed Underlay Rahul Kachalia Sr. Technical Leader Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the
SECURING DEVICES IN THE INTERNET OF THINGS
SECURING DEVICES IN THE INTERNET OF THINGS WHEN IT MATTERS, IT RUNS ON WIND RIVER EXECUTIVE SUMMARY Security breaches at the device level in the Internet of Things (IoT) can have severe consequences, including
Securing Network Communications
Securing Network Communications Demonstration: Securing network access with Whitenoise Labs identity management, one-time-pad dynamic authentication, and onetime-pad authenticated encryption. Use of Whitenoise
Hidden Figures: Securing what you cannot see
Hidden Figures: Securing what you cannot see TK Keanini, Distinguished Engineer Stealthwatch, Advanced Threat Solutions CID-0006 Hello My Name is TK Keanini Keanini (Pronounced Kay-Ah-Nee-Nee) TK: The
IMPLEMENTING A SOLUTION FOR ASSURING KEYS AND CERTIFICATES
IMPLEMENTING A SOLUTION FOR ASSURING KEYS AND CERTIFICATES Introduction Almost all enterprises have rogue or misconfigured certificates that are unknown to operations teams without a discovery tool they
Privileged Account Security: A Balanced Approach to Securing Unix Environments
Privileged Account Security: A Balanced Approach to Securing Unix Environments Table of Contents Introduction 3 Every User is a Privileged User 3 Privileged Account Security: A Balanced Approach 3 Privileged
Threat Centric Network Security
BRKSEC-2056 Threat Centric Network Security Ted Bedwell, Principal Engineer Network Threat Defence Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this
2018 Cisco and/or its affiliates. All rights reserved. Cisco Public
2018 Cisco and/or its affiliates. All rights reserved. Cisco Public PSODCN-1030 Intent Based Systems Deliver Automation Dave Malik Cisco Fellow and Chief Architect Advanced Services @dmalik2 2018 Cisco
10 FOCUS AREAS FOR BREACH PREVENTION
10 FOCUS AREAS FOR BREACH PREVENTION Keith Turpin Chief Information Security Officer Universal Weather and Aviation Why It Matters Loss of Personally Identifiable Information (PII) Loss of Intellectual
Exam : Title : Security Solutions for Systems Engineers. Version : Demo
Exam : 642-566 Title : Security Solutions for Systems Engineers Version : Demo 1. Which one of the following elements is essential to perform events analysis and correlation? A. implementation of a centralized
Designing and Building a Cybersecurity Program
Designing and Building a Cybersecurity Program Based on the NIST Cybersecurity Framework (CSF) Larry Wilson lwilson@umassp.edu ISACA Breakfast Meeting January, 2016 Designing & Building a Cybersecurity
Building Trustworthy Systems with SDL
Building Trustworthy Systems with SDL Chris Shenefiel 1 Agenda The Threat Problem The SDL Wheel SDL Implementation Across Cisco SDL Value The Threat Problem Increasing Threats via the Networked Infrastructure
Implementing Cisco Edge Network Security Solutions ( )
Implementing Cisco Edge Network Security Solutions (300-206) Exam Description: The Implementing Cisco Edge Network Security (SENSS) (300-206) exam tests the knowledge of a network security engineer to
Autonomic Networking BRKGEN Michael Behringer
Autonomic Networking BRKGEN-2999 Michael Behringer Autonomic Networking Intro How We Got Here Our First Goal Was: Automatic Network Security External NOC External How to Distinguish inside from outside
Cisco Cloud Security. How to Protect Business to Support Digital Transformation
Cisco Cloud Security How to Protect Business to Support Digital Transformation Dragan Novakovic Cybersecurity Consulting Systems Engineer January 2018. Security Enables Digitization Digital Disruption,
HOLISTIC NETWORK PROTECTION: INNOVATIONS IN SOFTWARE DEFINED NETWORKS
HOLISTIC NETWORK PROTECTION: INNOVATIONS IN SOFTWARE DEFINED NETWORKS Danielle M. Zeedick, Ed.D., CISM, CBCP Juniper Networks August 2016 Today s Objectives Goal Objectives To understand how holistic network
Endpoint Protection : Last line of defense?
Endpoint Protection : Last line of defense? First TC Noumea, New Caledonia 10 Sept 2018 Independent Information Security Advisor OVERVIEW UNDERSTANDING ENDPOINT SECURITY AND THE BIG PICTURE Rapid development
PKI Credentialing Handbook
PKI Credentialing Handbook Contents Introduction...3 Dissecting PKI...4 Components of PKI...6 Digital certificates... 6 Public and private keys... 7 Smart cards... 8 Certificate Authority (CA)... 10 Key
Cybersecurity in Data Centers. Murat Cudi Erentürk ISACA CISA, ISO Lead Auditor Gandalf Consulting and Software Ltd.
Cybersecurity in Data Centers Murat Cudi Erentürk ISACA CISA, ISO 27001 Lead Auditor Gandalf Consulting and Software Ltd. What is Cybersecurity? Information Security IT Systems Security Physical Security
DATA SHEET RISK & CYBERSECURITY PRACTICE EMPOWERING CUSTOMERS TO TAKE COMMAND OF THEIR EVOLVING RISK & CYBERSECURITY POSTURE
DATA SHEET RISK & CYBERSECURITY PRACTICE EMPOWERING CUSTOMERS TO TAKE COMMAND OF THEIR EVOLVING RISK & CYBERSECURITY POSTURE EXECUTIVE SUMMARY ALIGNING CYBERSECURITY WITH RISK The agility and cost efficiencies
ExamTorrent. Best exam torrent, excellent test torrent, valid exam dumps are here waiting for you
ExamTorrent http://www.examtorrent.com Best exam torrent, excellent test torrent, valid exam dumps are here waiting for you Exam : 400-251 Title : CCIE Security Written Exam (v5.0) Vendor : Cisco Version
Cisco Firepower NGFW. Anticipate, block, and respond to threats
Cisco Firepower NGFW Anticipate, block, and respond to threats You have a mandate to build and secure a network that supports ongoing innovation Mobile access Social collaboration Public / private hybrid
Secure Application Development. OWASP September 28, The OWASP Foundation
Secure Application Development September 28, 2011 Rohini Sulatycki Senior Security Consultant Trustwave rsulatycki@trustwave.com Copyright The Foundation Permission is granted to copy, distribute and/or
CS System Security 2nd-Half Semester Review
CS 356 - System Security 2nd-Half Semester Review Fall 2013 Final Exam Wednesday, 2 PM to 4 PM you may bring one 8-1/2 x 11 sheet of paper with any notes you would like no cellphones, calculators This
Network Visibility and Segmentation
Network Visibility and Segmentation 2019 Cisco and/ or its affiliates. All rights reserved. Contents Network Segmentation A Services Approach 3 The Process of Segmentation 3 Segmentation Solution Components
Whose Cloud Is It Anyway? Exploring Data Security, Ownership and Control
Whose Cloud Is It Anyway? Exploring Data Security, Ownership and Control SESSION ID: CDS-T11 Sheung-Chi NG Senior Security Consulting Manager, APAC SafeNet, Inc. Cloud and Virtualization Are Change the
Wi-Fi Security for Next Generation Connectivity. Perry Correll Aerohive, Wi-Fi Alliance member October 2018
Perry Correll Aerohive, Wi-Fi Alliance member October 2018 1 Value of Wi-F1 The value Wi-Fi provides to the global economy rivals the combined market value of Apple Inc. and Amazon. The fact that Wi-Fi
Objectives. Classes of threats to networks. Network Security. Common types of network attack. Mitigation techniques to protect against threats
ITE I Chapter 6 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Objectives Enterprise Network Security Describe the general methods used to mitigate security threats to Enterprise networks
The IINS acronym to this exam will remain but the title will change slightly, removing IOS from the title, making the new title.
I n t r o d u c t i o n The CCNA Security IINS exam topics have been refreshed from version 2.0 to version 3.0. This document will highlight exam topic changes between the current 640-554 IINS exam and
PROTECTING INFORMATION ASSETS NETWORK SECURITY
PROTECTING INFORMATION ASSETS NETWORK SECURITY PAUL SMITH 20 years of IT experience (desktop, servers, networks, firewalls.) 17 years of engineering in enterprise scaled networks 10+ years in Network Security
Borderless Networks. Tom Schepers, Director Systems Engineering
Borderless Networks Tom Schepers, Director Systems Engineering Agenda Introducing Enterprise Network Architecture Unified Access Cloud Intelligent Network & Unified Services Enterprise Networks in Action
Stop Threats Before They Stop You
Stop Threats Before They Stop You Gain visibility and control as you speed time to containment of infected endpoints Andrew Peters, Sr. Manager, Security Technology Group Agenda Situation System Parts
Cyber Criminal Methods & Prevention Techniques. By
Cyber Criminal Methods & Prevention Techniques By Larry.Boettger@Berbee.com Meeting Agenda Trends Attacker Motives and Methods Areas of Concern Typical Assessment Findings ISO-17799 & NIST Typical Remediation
On Demand Cryptographic Resources for Your Virtual Data Center and the Cloud: Introducing SafeNet s Crypto Hypervisor
On Demand Cryptographic Resources for Your Virtual Data Center and the Cloud: Introducing SafeNet s Crypto Hypervisor Ugo Piazzalunga SafeNet Italy Technical Manager, IT Security ugo.piazzalunga@safenet-inc.com
Securing Devices in the Internet of Things
AN INTEL COMPANY Securing Devices in the Internet of Things WHEN IT MATTERS, IT RUNS ON WIND RIVER EXECUTIVE SUMMARY Security breaches at the device level in the Internet of Things (IoT) can have severe
Managing Your Privileged Identities: The Choke Point of Advanced Attacks
Managing Your Privileged Identities: The Choke Point of Advanced Attacks Shirief Nosseir EMEA Alliances Director Identity & API Management Tuesday, 16 May 2017 Agenda Why Privileged Access Management Why
Course overview. CompTIA Security+ Certification (Exam SY0-501) Study Guide (G635eng v107)
Overview This course is intended for those wishing to qualify with CompTIA Security+. CompTIA's Security+ Certification is a foundation-level certificate designed for IT administrators with 2 years' experience
TPM v.s. Embedded Board. James Y
TPM v.s. Embedded Board James Y What Is A Trusted Platform Module? (TPM 1.2) TPM 1.2 on the Enano-8523 that: How Safe is your INFORMATION? Protects secrets from attackers Performs cryptographic functions
Cisco Wireless LAN Controller Module
Cisco Wireless LAN Controller Modules Simple and secure wireless deployment and management for small and medium-sized businesses (SMBs) and enterprise branch offices Product Overview Cisco Wireless LAN
Gladiator Incident Alert
Gladiator Incident Alert Allen Eaves Sabastian Fazzino FINANCIAL PERFORMANCE RETAIL DELIVERY IMAGING PAYMENT SOLUTIONS INFORMATION SECURITY & RISK MANAGEMENT ONLINE & MOBILE 1 2016 Jack Henry & Associates,
Security Hardening Checklist for Cisco Routers/Switches in 10 Steps
Security Hardening Checklist for Cisco Routers/Switches in 10 Steps Network infrastructure devices (routers, switches, load balancers, firewalls etc) are among the assets of an enterprise that play an
CYBER RESILIENCE & INCIDENT RESPONSE
CYBER RESILIENCE & INCIDENT RESPONSE www.nccgroup.trust Introduction The threat landscape has changed dramatically over the last decade. Once the biggest threats came from opportunist attacks and preventable
Who s Protecting Your Keys? August 2018
Who s Protecting Your Keys? August 2018 Protecting the most vital data from the core to the cloud to the field Trusted, U.S. based source for cyber security solutions We develop, manufacture, sell and
Operationalizing the Three Principles of Advanced Threat Detection
SESSION ID: SDS2-R08 Operationalizing the Three Principles of Advanced Threat Detection ZULFIKAR RAMZAN, PH.D Chief Technology Officer RSA @zulfikar_ramzan Dealing with Traffic Congestion Singapore: Major
Teradata and Protegrity High-Value Protection for High-Value Data
Teradata and Protegrity High-Value Protection for High-Value Data 12.16 EB7178 DATA SECURITY Table of Contents 2 Data Centric Security: Providing High-Value Protection for High-Value Data 3 Visibility:
Implementing Cisco Cybersecurity Operations
210-255 Implementing Cisco Cybersecurity Operations NWExam.com SUCCESS GUIDE TO CISCO CERTIFICATION Exam Summary Syllabus Questions Table of Contents Introduction to 210-255 Exam on Implementing Cisco
Privilege Security & Next-Generation Technology. Morey J. Haber Chief Technology Officer
Privilege Security & Next-Generation Technology Morey J. Haber Chief Technology Officer mhaber@beyondtrust.com Agenda The Next-Gen Threat Landscape o Infomatics, Breaches & the Attack Chain o Securing
CISCO NETWORKS BORDERLESS Cisco Systems, Inc. All rights reserved. 1
CISCO BORDERLESS NETWORKS 2009 Cisco Systems, Inc. All rights reserved. 1 Creating New Business Models The Key Change: Putting the Interaction Where the Customer Is Customer Experience/ Innovation Productivity/