Yes, You can protect your endpoints! Szilard Csordas, Security Consultant scsordas [at] cisco.com

Transcription

1 Yes, You can protect your endpoints! Szilard Csordas, Security Consultant scsordas [at] cisco.com

2 Endpoint Footprint Problem: TOO MANY AGENTS! Anti-Virus/Anti-Spyware agent IPSec/SSLVPN agent Host IPS/FW agent 802.1x authentication supplicant Data Loss Prevention(DLP) agent Malware Prevention agent Web Filtering agent Behavior/Heuristics agent More? 2

3 Everything is Encrypted! 3

4 Introducing Anyconnect Latest version is AnyConnect 4.3 See table in Appendix for OS Support 4

5 AnyConnect Module Installation Options Package for your Favorite Deployment Tool Mobile installed via App Store Group Policy 5

6 AnyConnect Module Installation Options Client Provisioning ISE posture required for any module to be installed Automatic Upgrades from cisco.com with 4.3* * Can be disabled some or all Users via VPN/ISE configuration 6

7 Deployment Use Cases Remote Access VPN with Centralized Controls Prevention / Detection Network Visibility Endpoint Compliance Enterprise Access Admin/Troubleshooting (not covered) 7

8 Remote Access VPN

9 Recommended for Centralized Controls Manual requiring the enduser to manually connect to VPN. Automatic using Always-On and Trusted Network Detection, requires little interaction. 9

10 Protection / Detection Advance Malware Protection for Endpoint (AMP4E) Umbrella Roaming Security

11 What is Advanced Malware Protection for Endpoint (AMP4E) Cloud connected & managed Focused on two modes of operation Something I know à Prevention = Security Mode Something I don t know yet à Retrospection = Incident Response Mode Supported on Deployed Standalone or AnyConnect Enabled - ISE or VPN 11

12 AMP4E - How does it work? Connector records activity related to file executions TCP 443 AMP Cloud Visibility of Executions (History to Current) 12

13 AMP4E Right Click on File Is it known by Cisco? Compare with 3 rd party Dig Deeper Analyze with AMP ThreatGrid File Details and Network Profile Retrieve File Take action Detect Block Allow 13

14 AMP4E Detailed File Analysis from ThreatGrid AMP Easy classification by using Severity (95+ Bad, 70+ suspicious) and Confidence Threat Scoring 14

15 AMP4E Other ways to parse Prevalence Low Execution Count (unique files worth investigation) Analyze will trigger Fetch if file not already in repository Vulnerable Software - Application <-> CVE 15

16 AMP4E Integration with AMP for Networks AMP4E detected threat reported in FMC > IoCs and can include OpenIoCs 16

17 AMP4E Installed, Quarantine 17

18 AMP4E Deployment Through ISE or ASA or Directly from Portal AMP Enabler Profile Editor Direct from Portal / Via URL 18

19 What is Umbrella Roaming Client? Off Trusted network protection across all ports for both Domain and IP Added layer of protection for existing security controls AnyConnect 4.3 (Windows / Mac) Existing Roaming Client (Windows / Mac) 19

20 How does it work? First Match Rule Table by Identity Encrypted Authenticated DNS/IP Security Filtered Cisco Umbrella On Trusted Network Client goes dormant Network is Protected Root/SP DNS Local Corp DNS 20

21 Am I by protected by Umbrella? Phishing testing - > Adult Content Testing -> 21

22 Umbrella Provides Visibility Identify Cloud services being used (Shadow IT) Filtered by Identity, Service and Date for easy data mining and reporting 22

23 Umbrella Provides Protection Detailed Reports by Identity, Time, Domain etc Overview Security Activity Dashboard highlighting protections Integration with Cisco and 3 rd parties Internal IP available via Virtual Appliance* 23

24 Network Visibility

25 Network Visibility Module User Visibility Application Visibility Network Visibility Device Visibility Location/Network Domain for 4.2MR Supported on Windows and Mac devices Apex License Required Integration with Lancope 6.8, LiveAction, Splunk (Enterprise 6.0 with Collector 64-bit Linux) and Plixer 25

26 NVM with Stealthwatch WORK AWAY SMC-manager Endpoint Collector Network NetFlow/NSEL Flow Collector Context Included: User Application Device Location: To / From to Existing Alarms and Flow Data 26

27 <?xml version="1.0" encoding="utf-8"?> <NVMProfile xsi:nonamespaceschemalocation="nvmprofile.xsd" xmlns:xsi= LSchem a-instance> NVM Configuration Template Suppression and Throttling Throttling so not to overwhelm VPN Broadcast and Multicast Suppression 27

28 NVM Configuration Template Flexible Data Collection Policy 28

29 DataLoss is just one alarm Suspect Data Loss: 3 29

30 Insider Threat Bad Behavior Discovery 30

31 HTTPS Unclassified now Known AnyConnect NVM with Lancope Stealthwatch Application Identified Dropbox Application Hash Who else is running? Identity nedzaldivar (even without ISE or Identity, from non domain asset) 31

32 Verify Application is Correct AnyConnect NVM with Cisco Stealthwatch 32

33 Corporate Assets Network Access Manager (NAM)

34 What is Network Access Manager (Windows Only) 802.1x Supplicant EAP-Chaining Single Authentication/Authorization Session MacSEC AES-128 Un-Encrypted Encrypted 802.1AE replay protection for every packet 34

35 EAP-Chaining ISE Log Example User and Machine Tied together EAP-FAST Required 35

36 MacSec ISE Configuration Example ISE Authorization Result is MacSEC ISE Authorization Policy 36

37 Compliance (Posture) BRKS

38 Compliance (Posture) Provides deep inspection in OS, File, Certificate, Registry, Anti-Virus, Anti- Spyware, Person Firewall, Ports open, Running processes etc AC Anyconnect Apex license required! Options Hostscan with VPN connecting to an ISE Posture with connecting to Wired, Wireless or VPN using 38

39 ISE Posture Registry check for Machine joined to Domain With ASA 9.2, inline Posture node is not required. Change of Authorization is natively supported option 39

40 Endpoint Visibility ASA Hostscan ISE Posture Policy Framework DAP ISE+VPN Updates Every 3 months Dynamically IP, Hostname, Mac address Yes Yes Certificate Fields Yes Yes BIOS Serial Number Yes No Personal Firewall Yes No File CRC32 Check Yes Yes Disk Encryption No Yes SHA256 File Check No Yes USB Check No Yes* OS Support Windows, Mac, Linux Windows, Mac BRKSEC

41 Summary AnyConnect reduces Agent Sprawl! Added Security with each module Provides Visibility and Control Complexity of networks is equal on endpoints 41

42 Thank you