際際滷

際際滷Share a Scribd company logo

Cisco Secure X

S.E. CTS CERT-GOV-MD
S.E. CTS CERT-GOV-MD

Cisco Cyber Threat Defense Mikhail Rodionov Business Development Manager

1 of 42
Downloaded 55 times
Cisco Cyber Threat Defense Mikhail Rodionov Business Development Manager mrodiono@cisco.com
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 2 Discuss the growing security problem customers are facing that is not addressed by traditional security products and technologies Define Ciscos unique approach to this problem Describe the Cisco Cyber Threat Defense Solution and explain why Cisco can provide the security telemetry Show why the solution provides unique differentiated value
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2012 亞. 亠 仗舒于舒 亰舒亳亠仆. 仂仆亳亟亠仆亳舒仍仆舒 亳仆仂仄舒亳 Cisco 3
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 4
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 5 Mobility Threat Cloud Megatrends require innovative approach to advanced cyber threats Android malware increased by 2577% in 2012 SaaS & B2B apps 11x more malicious than counterfeit software Threats are morphing
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 6 Defense: Anti-Virus, Firewalls Viruses (1990s) Defense: Intrusion Detection & Prevention Worms (2000s) Defense: Reputation, DLP, App.- aware Firewalls Botnets (late 2000s to current) Strategy: Visibility and Context Directed Attacks (APTs) (today) ILOVEYOU Melissa Anna Kournikova Nimda SQL Slammer Conficker Tedroo Rustock Conficker Aurora Shady Rat Duqu
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 7 keep our doors locked to stop good people from coming in Firewall IPS Web Sec N-AV Email Sec Customized Threat Bypasses Security Gateways Threat Spreads Inside Perimeter Once inside the perimeter, a command and control channel that'll open up Only the network can have the appropriate level visibility and intelligence to detect these threats Servers
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 8 Network Reconnaissance Data Leakage Internally Propagating Malware Botnet Command And Control
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 9 Mandiant 2012 survey Organizations were compromised ~ 416 days before attackers were discovered In 100% of cases, the bad guys used valid credentials Each incident was discovered by 3rd party only X X X X O X X X O O
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 10 What Our Customers are Telling Us: We assume were already compromised Over 50% of threats are customized to my environment We had a single actor gaining access by three different methods all in a days work I have enough storage for 30 days, my adversary went to sleep for 31 days. When I increased my storage to 60 days, they figured it out and changed their attack to match my storage capability
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 11 弌舒仆舒? 仂仆从亠仆? 丼舒仆亠 仍亳舒?Who? 丼仂 磦仍磳 亠仍?What? 仂亞亟舒 舒舒从舒 仆舒亳弍仂仍亠亠 舒从亳于仆舒 亳 亠仄 仂 于磶舒仆仂?When? 亟亠 舒舒从ﾑ亳亠? 亟亠 仂仆亳 仆舒亳弍仂仍亠亠 仗亠仆?Where? 舒亠仄 仂仆亳 舒舒从ﾑ 仂 从仂仆从亠仆仂 亳 亠仍?Why? 舒从 仂仆亳 舒舒从ﾑ Zero-day? 亰于亠仆亠 磶于亳仄仂亳? 仆舒亶亟亠?How?
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 12 仂 于 仄仂亠亶 亠亳? Who? 丼仂 亟亠仍舒ﾑ 仗仂仍亰仂于舒亠仍亳? 亳仍仂亢亠仆亳? 丼仂 亳舒 仆仂仄舒仍仆仄 仗仂于亠亟亠仆亳亠仄?What? 丕仂亶于舒 于 亠亳? 丼仂 亳舒 仆仂仄舒仍仆仄 仂仂礌亳亠仄?When? 亟亠 亳 仂从亟舒 仗仂仍亰仂于舒亠仍亳 仗仂仗舒亟舒ﾑ 于 亠? 仆亠仆仆亳亠? eCommerce? 仆亠仆亳亠?Where? 舒亠仄 仂仆亳 亳仗仂仍亰ﾑ 从仂仆从亠仆亠 仗亳仍仂亢亠仆亳?Why? 舒从 于 仂 仗仂仗舒亟舒亠 于 亠? How?
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2012 亞. 亠 仗舒于舒 亰舒亳亠仆. 仂仆亳亟亠仆亳舒仍仆舒 亳仆仂仄舒亳 Cisco 13
Workload s Apps / Services Infrastruc ture public tenan hybrid private Any-To-Any Network Gloval and Local Threat Detection Blending of Personal & Business Use Access Assets through Multiple Medians Services Identity Awareness Sees All Traffic Routes All Requests Sources All Data Controls All Flows Handles All Devices Touches All UsersShapes All Streams Behavioral Analysis Encryption Device Visibility Policy Enforcement Access Control Threat Defense
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2012 亞. 亠 仗舒于舒 亰舒亳亠仆. 仂仆亳亟亠仆亳舒仍仆舒 亳仆仂仄舒亳 Cisco 15
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 16 Intrusion Detection System 仆舒 仂仆仂于亠 亳亞仆舒 仗舒亳于仆亶 弍仂 仗亠于亳仆亶 亳仂仆亳从 仂仗仂于亠亠仆亳 Syslog journal 亳仆仄亠仆 亞仍弍仂从仂亞仂 舒仆舒仍亳亰舒 于仂亰仄仂亢仆仂 亳仍舒亳亳 仂亞舒仆亳亠仆仆仂亠 于仂亰亟亠亶于亳亠 仆舒 亳亠仄 Network Flow Analysis 仍舒弍仂亠 于仂亰亟亠亶于亳亠 仆舒 仂亶于舒 仂仆仂于仆仂亶 亳仆仄亠仆 亳仍亠亟仂于舒仆亳 仆亠弍仂仍仂亶 亠弍亠仄亶 仂弍亠仄 仗舒仄亳
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 17 Signature/Reputation -based Threat Detection Behavioral-based Threat Detection Network Perimeter Firewalls IPS/IDS Honeypots Network Interior Email Content Inspection Web Content Inspection Ciscos Cyber Threat Defense Solution
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 18 Private Cloud Hybrid Cloud SaaS ANY DEVICE ANY CLOUD Secure Access Firewall IPS Web Gateway Email Gateway Policy VPN Data Center Next Gen Applia nce Cloud #1 Market Share Applia nce Attach ed Applia nce Hosted
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 19 A B C C B A CA B We can see: - source address, - destination address, - number of packets transferred during that session, - and a timestamp of the session
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 20
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 21 Sampled Net Flow Incomplete Visibility Less than 5% of traffic used to generate NetFlow telemetry Insufficient telemetry for threat detection Full Unsampled Net Flow No Blind Spots All traffic is used to generate NetFlow telemetry Pre-requisite for effective threat detection Only a Cisco Catalyst Switch Can Deliver Unsampled NetFlow at Line- Rate Without Any Data Plane Performance Impact
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2012 亞. 亠 仗舒于舒 亰舒亳亠仆. 仂仆亳亟亠仆亳舒仍仆舒 亳仆仂仄舒亳 Cisco 22
Cisco Cyber Threat Defense Solution Components Identity and Policy StealthWatch Cisco ISE Policy Enforcement Flow Attribution Security Analysis Flow Monitoring
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 24 The most complex, custom-written, dangerous security threats (e.g. APTs) Threats that lurk in networks for months or years stealing vital information and disrupting operations Data leakage Network reconnaissance Network interior malware proliferation Command and control traffic Cisco Cyber Threat Defense (CTD) focuses on: Focus of this class of threats and Cisco CTD use cases:
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 25 Netflow Telemetry Cisco Switches, Routers and ASA 5500 Internal Network & Borders Threat Context Data Cisco Identity, Device, Posture, NAT, Application Unified View Threat Analysis & Context in Lancope StealthWatch Leveraging NetFlow, Identity, Reputation andApplication Cisco SolutionsPlus product
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 26 Cisco Network StealthWatch FlowCollector StealthWatch Management Console NetFlow StealthWatch FlowSensor StealthWatch FlowSensor VE Users/Devices Cisco ISE NetFlow StealthWatch FlowReplicator 亞亳亠 从仂仍仍亠从仂 https https NBAR NSEL
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 27 High Concern Index indicates a significant number of suspicious events that deviate from established baselines Host Groups Host CI CI% Alarms Alerts Desktops 10.10.101.118 338,137,280 8,656 % High Concern index Ping, Ping_Scan, TCP_Scan Monitor and baseline activity for a host and within host groups.
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 28 Whats about 10.10.101.89? Policy Start Active time Alarm Source Source Host Groups Target Details Desktops & Trusted Wireless Jan 3, 2013 Suspect Data Loss 10.10.101.89 Atlanta, Desktops Multiple Hosts Observed 4.82 Gbytes. Policy maximum allows up to 500Mbytes.
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 29
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 30 C I2 I4 A Local intelligence Who What How Where When From your network Cisco Security Intelligence Operations From Ciscos global threat analysis system 亠仗舒亳 亰舒亳仄仂- 亟亠亶于亳 APP 亳仍仂亢亠仆亳 URL 弌舒亶 SecurityIntelligenceOperations
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 31 Users/Devices Cisco Identity Services Engine (ISE) Network Based Application Recognition (NBAR) NetFlow Secure Event Logging (NSEL) Link flows with user identity Dig out key application information from a stream while data flows through it A special form of log event helps identify accepted and rejected connections
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 32 Policy Start Active Time Alarm Source Source Host Groups Source User Name Device Type Target Deskto ps & Trusted Wireles s Jan 3, 2013 Suspect Data Loss 10.10.101 .89 Atlanta, Desktops John Chambers Apple- iPad Multiple Hosts Attribute flows and behaviors to a user and device
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 33 Flow Action field can provide additional context State-based NSEL reporting is taken into consideration in StealthWatchs behavioral analysis Concern Index points accumulated for Flow Denied events
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 34
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 35 弍仆舒亢亠仆亳亠 舒亰仆 亳仗仂于 舒舒从, 于从仍ﾑ舒 DDoS 亠舒仍仆舒 舒亳亳从舒 仂 于亠 舒舒从舒, 仂弍仆舒亢亠仆仆 于 亠亳
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 36 Devices Access Catalyst速 3750-X BranchCampus Catalyst速 3560-X Catalyst速 4500 Catalyst速 4500 Access Point Access Point Distribution Catalyst速 3750-X Stack WLC Catalyst 速 6500 Edge Site- to- Site VPN ASA ISR Catalyst 速 6500 Remote Access Cisco ISE Management StealthWatch Management Console StealthWatch FlowCollector NetFlow Capable Correlate and display Flow and Identity Info Cisco TrustSec: Access Control, Profiling and Posture NetFlow Identity AAA services, profiling and posture assessment Collect and analyze NetFlow Records Scalable NetFlow Infrastructure 3
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 37 CRISIS REGION ImpacttotheBusiness($) Time credit card data compromised * attack identified * vulnerability closed * CRISIS REGION Security Problems Worm outbreaks can impact revenue by up to $250k per hour. StealthWatch pays for itself in 30 minutes. F500 Media Conglomerate attack onset * StealthWatch Reduces MTTK *attack thwarted *early warning *attack identified * vulnerability closed Company with StealthWatch Company with Legacy Monitoring Tools
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 38
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 39 CEC website: wwwin.cisco.com/stg/cyber/ For EBC/TDM decks, design and how-to guides, and training VoD links CCO website: www.cisco.com/go/threatdefense/ Customer-facing versions of the DIG and how-to guides (Note: Need to scroll about halfway down the page) Cyber Threat Defense area on Highwire For training decks, VMware images, other demo supporting information Demo pods available via http://securitytme.cisco.com Aliases: cyber-pm and cyber-tm
Thank you! mrodiono@cisco.com
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 46 Identifying BotNet Command & Control Activity. BotNets are implanted in the enterprise to execute commands from their Bot herders to send SPAM, Denial of Service attacks, or other malicious acts. Revealing Data Loss. Code can be hidden in the enterprise to export of sensitive information back to the attacker. This Data Leakage may occur rapidly or over time. Detecting Sophisticated and Persistent Threats. Malware that makes it past perimeter security can remain in the enterprise waiting to strike as lurking threats. These may be zero day threats that do not yet have an antivirus signature or be hard to detect for other reasons. Finding Internally Spread Malware. Network interior malware proliferation can occur across hosts for the purpose gathering security reconnaissance data, data exfiltration or network backdoors. Uncovering Network Reconnaissance. Some attacks will probe the network looking for attack vectors to be utilized by custom- crafted cyber threats.
息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 47 Devic es Internal Network Use NetFlow Data to Extend Visibility to the Access Layer Unify Into a Single Pane of Glass for Detection, Investigation and Reporting Enrich Flow Data With Identity, Events and Application to Create Context WHO WHAT WHERE WHEN HOW Hardware- enabled NetFlow Switch Cisco ISE Cisco ISR G2 + NBAR Cisco ASA + NSEL Cont ext

More Related Content

Cisco Secure X

  • 1. Cisco Cyber Threat Defense Mikhail Rodionov Business Development Manager mrodiono@cisco.com
  • 2. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 2 Discuss the growing security problem customers are facing that is not addressed by traditional security products and technologies Define Ciscos unique approach to this problem Describe the Cisco Cyber Threat Defense Solution and explain why Cisco can provide the security telemetry Show why the solution provides unique differentiated value
  • 3. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2012 亞. 亠 仗舒于舒 亰舒亳亠仆. 仂仆亳亟亠仆亳舒仍仆舒 亳仆仂仄舒亳 Cisco 3
  • 4. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 4
  • 5. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 5 Mobility Threat Cloud Megatrends require innovative approach to advanced cyber threats Android malware increased by 2577% in 2012 SaaS & B2B apps 11x more malicious than counterfeit software Threats are morphing
  • 6. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 6 Defense: Anti-Virus, Firewalls Viruses (1990s) Defense: Intrusion Detection & Prevention Worms (2000s) Defense: Reputation, DLP, App.- aware Firewalls Botnets (late 2000s to current) Strategy: Visibility and Context Directed Attacks (APTs) (today) ILOVEYOU Melissa Anna Kournikova Nimda SQL Slammer Conficker Tedroo Rustock Conficker Aurora Shady Rat Duqu
  • 7. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 7 keep our doors locked to stop good people from coming in Firewall IPS Web Sec N-AV Email Sec Customized Threat Bypasses Security Gateways Threat Spreads Inside Perimeter Once inside the perimeter, a command and control channel that'll open up Only the network can have the appropriate level visibility and intelligence to detect these threats Servers
  • 8. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 8 Network Reconnaissance Data Leakage Internally Propagating Malware Botnet Command And Control
  • 9. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 9 Mandiant 2012 survey Organizations were compromised ~ 416 days before attackers were discovered In 100% of cases, the bad guys used valid credentials Each incident was discovered by 3rd party only X X X X O X X X O O
  • 10. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 10 What Our Customers are Telling Us: We assume were already compromised Over 50% of threats are customized to my environment We had a single actor gaining access by three different methods all in a days work I have enough storage for 30 days, my adversary went to sleep for 31 days. When I increased my storage to 60 days, they figured it out and changed their attack to match my storage capability
  • 11. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 11 弌舒仆舒? 仂仆从亠仆? 丼舒仆亠 仍亳舒?Who? 丼仂 磦仍磳 亠仍?What? 仂亞亟舒 舒舒从舒 仆舒亳弍仂仍亠亠 舒从亳于仆舒 亳 亠仄 仂 于磶舒仆仂?When? 亟亠 舒舒从ﾑ亳亠? 亟亠 仂仆亳 仆舒亳弍仂仍亠亠 仗亠仆?Where? 舒亠仄 仂仆亳 舒舒从ﾑ 仂 从仂仆从亠仆仂 亳 亠仍?Why? 舒从 仂仆亳 舒舒从ﾑ Zero-day? 亰于亠仆亠 磶于亳仄仂亳? 仆舒亶亟亠?How?
  • 12. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 12 仂 于 仄仂亠亶 亠亳? Who? 丼仂 亟亠仍舒ﾑ 仗仂仍亰仂于舒亠仍亳? 亳仍仂亢亠仆亳? 丼仂 亳舒 仆仂仄舒仍仆仄 仗仂于亠亟亠仆亳亠仄?What? 丕仂亶于舒 于 亠亳? 丼仂 亳舒 仆仂仄舒仍仆仄 仂仂礌亳亠仄?When? 亟亠 亳 仂从亟舒 仗仂仍亰仂于舒亠仍亳 仗仂仗舒亟舒ﾑ 于 亠? 仆亠仆仆亳亠? eCommerce? 仆亠仆亳亠?Where? 舒亠仄 仂仆亳 亳仗仂仍亰ﾑ 从仂仆从亠仆亠 仗亳仍仂亢亠仆亳?Why? 舒从 于 仂 仗仂仗舒亟舒亠 于 亠? How?
  • 13. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2012 亞. 亠 仗舒于舒 亰舒亳亠仆. 仂仆亳亟亠仆亳舒仍仆舒 亳仆仂仄舒亳 Cisco 13
  • 14. Workload s Apps / Services Infrastruc ture public tenan hybrid private Any-To-Any Network Gloval and Local Threat Detection Blending of Personal & Business Use Access Assets through Multiple Medians Services Identity Awareness Sees All Traffic Routes All Requests Sources All Data Controls All Flows Handles All Devices Touches All UsersShapes All Streams Behavioral Analysis Encryption Device Visibility Policy Enforcement Access Control Threat Defense
  • 15. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2012 亞. 亠 仗舒于舒 亰舒亳亠仆. 仂仆亳亟亠仆亳舒仍仆舒 亳仆仂仄舒亳 Cisco 15
  • 16. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 16 Intrusion Detection System 仆舒 仂仆仂于亠 亳亞仆舒 仗舒亳于仆亶 弍仂 仗亠于亳仆亶 亳仂仆亳从 仂仗仂于亠亠仆亳 Syslog journal 亳仆仄亠仆 亞仍弍仂从仂亞仂 舒仆舒仍亳亰舒 于仂亰仄仂亢仆仂 亳仍舒亳亳 仂亞舒仆亳亠仆仆仂亠 于仂亰亟亠亶于亳亠 仆舒 亳亠仄 Network Flow Analysis 仍舒弍仂亠 于仂亰亟亠亶于亳亠 仆舒 仂亶于舒 仂仆仂于仆仂亶 亳仆仄亠仆 亳仍亠亟仂于舒仆亳 仆亠弍仂仍仂亶 亠弍亠仄亶 仂弍亠仄 仗舒仄亳
  • 17. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 17 Signature/Reputation -based Threat Detection Behavioral-based Threat Detection Network Perimeter Firewalls IPS/IDS Honeypots Network Interior Email Content Inspection Web Content Inspection Ciscos Cyber Threat Defense Solution
  • 18. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 18 Private Cloud Hybrid Cloud SaaS ANY DEVICE ANY CLOUD Secure Access Firewall IPS Web Gateway Email Gateway Policy VPN Data Center Next Gen Applia nce Cloud #1 Market Share Applia nce Attach ed Applia nce Hosted
  • 19. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 19 A B C C B A CA B We can see: - source address, - destination address, - number of packets transferred during that session, - and a timestamp of the session
  • 20. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 20
  • 21. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 21 Sampled Net Flow Incomplete Visibility Less than 5% of traffic used to generate NetFlow telemetry Insufficient telemetry for threat detection Full Unsampled Net Flow No Blind Spots All traffic is used to generate NetFlow telemetry Pre-requisite for effective threat detection Only a Cisco Catalyst Switch Can Deliver Unsampled NetFlow at Line- Rate Without Any Data Plane Performance Impact
  • 22. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2012 亞. 亠 仗舒于舒 亰舒亳亠仆. 仂仆亳亟亠仆亳舒仍仆舒 亳仆仂仄舒亳 Cisco 22
  • 23. Cisco Cyber Threat Defense Solution Components Identity and Policy StealthWatch Cisco ISE Policy Enforcement Flow Attribution Security Analysis Flow Monitoring
  • 24. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 24 The most complex, custom-written, dangerous security threats (e.g. APTs) Threats that lurk in networks for months or years stealing vital information and disrupting operations Data leakage Network reconnaissance Network interior malware proliferation Command and control traffic Cisco Cyber Threat Defense (CTD) focuses on: Focus of this class of threats and Cisco CTD use cases:
  • 25. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 25 Netflow Telemetry Cisco Switches, Routers and ASA 5500 Internal Network & Borders Threat Context Data Cisco Identity, Device, Posture, NAT, Application Unified View Threat Analysis & Context in Lancope StealthWatch Leveraging NetFlow, Identity, Reputation andApplication Cisco SolutionsPlus product
  • 26. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 26 Cisco Network StealthWatch FlowCollector StealthWatch Management Console NetFlow StealthWatch FlowSensor StealthWatch FlowSensor VE Users/Devices Cisco ISE NetFlow StealthWatch FlowReplicator 亞亳亠 从仂仍仍亠从仂 https https NBAR NSEL
  • 27. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 27 High Concern Index indicates a significant number of suspicious events that deviate from established baselines Host Groups Host CI CI% Alarms Alerts Desktops 10.10.101.118 338,137,280 8,656 % High Concern index Ping, Ping_Scan, TCP_Scan Monitor and baseline activity for a host and within host groups.
  • 28. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 28 Whats about 10.10.101.89? Policy Start Active time Alarm Source Source Host Groups Target Details Desktops & Trusted Wireless Jan 3, 2013 Suspect Data Loss 10.10.101.89 Atlanta, Desktops Multiple Hosts Observed 4.82 Gbytes. Policy maximum allows up to 500Mbytes.
  • 29. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 29
  • 30. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 30 C I2 I4 A Local intelligence Who What How Where When From your network Cisco Security Intelligence Operations From Ciscos global threat analysis system 亠仗舒亳 亰舒亳仄仂- 亟亠亶于亳 APP 亳仍仂亢亠仆亳 URL 弌舒亶 SecurityIntelligenceOperations
  • 31. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 31 Users/Devices Cisco Identity Services Engine (ISE) Network Based Application Recognition (NBAR) NetFlow Secure Event Logging (NSEL) Link flows with user identity Dig out key application information from a stream while data flows through it A special form of log event helps identify accepted and rejected connections
  • 32. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 32 Policy Start Active Time Alarm Source Source Host Groups Source User Name Device Type Target Deskto ps & Trusted Wireles s Jan 3, 2013 Suspect Data Loss 10.10.101 .89 Atlanta, Desktops John Chambers Apple- iPad Multiple Hosts Attribute flows and behaviors to a user and device
  • 33. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 33 Flow Action field can provide additional context State-based NSEL reporting is taken into consideration in StealthWatchs behavioral analysis Concern Index points accumulated for Flow Denied events
  • 34. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 34
  • 35. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 35 弍仆舒亢亠仆亳亠 舒亰仆 亳仗仂于 舒舒从, 于从仍ﾑ舒 DDoS 亠舒仍仆舒 舒亳亳从舒 仂 于亠 舒舒从舒, 仂弍仆舒亢亠仆仆 于 亠亳
  • 36. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 36 Devices Access Catalyst速 3750-X BranchCampus Catalyst速 3560-X Catalyst速 4500 Catalyst速 4500 Access Point Access Point Distribution Catalyst速 3750-X Stack WLC Catalyst 速 6500 Edge Site- to- Site VPN ASA ISR Catalyst 速 6500 Remote Access Cisco ISE Management StealthWatch Management Console StealthWatch FlowCollector NetFlow Capable Correlate and display Flow and Identity Info Cisco TrustSec: Access Control, Profiling and Posture NetFlow Identity AAA services, profiling and posture assessment Collect and analyze NetFlow Records Scalable NetFlow Infrastructure 3
  • 37. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 37 CRISIS REGION ImpacttotheBusiness($) Time credit card data compromised * attack identified * vulnerability closed * CRISIS REGION Security Problems Worm outbreaks can impact revenue by up to $250k per hour. StealthWatch pays for itself in 30 minutes. F500 Media Conglomerate attack onset * StealthWatch Reduces MTTK *attack thwarted *early warning *attack identified * vulnerability closed Company with StealthWatch Company with Legacy Monitoring Tools
  • 38. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 38
  • 39. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 39 CEC website: wwwin.cisco.com/stg/cyber/ For EBC/TDM decks, design and how-to guides, and training VoD links CCO website: www.cisco.com/go/threatdefense/ Customer-facing versions of the DIG and how-to guides (Note: Need to scroll about halfway down the page) Cyber Threat Defense area on Highwire For training decks, VMware images, other demo supporting information Demo pods available via http://securitytme.cisco.com Aliases: cyber-pm and cyber-tm
  • 41. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 46 Identifying BotNet Command & Control Activity. BotNets are implanted in the enterprise to execute commands from their Bot herders to send SPAM, Denial of Service attacks, or other malicious acts. Revealing Data Loss. Code can be hidden in the enterprise to export of sensitive information back to the attacker. This Data Leakage may occur rapidly or over time. Detecting Sophisticated and Persistent Threats. Malware that makes it past perimeter security can remain in the enterprise waiting to strike as lurking threats. These may be zero day threats that do not yet have an antivirus signature or be hard to detect for other reasons. Finding Internally Spread Malware. Network interior malware proliferation can occur across hosts for the purpose gathering security reconnaissance data, data exfiltration or network backdoors. Uncovering Network Reconnaissance. Some attacks will probe the network looking for attack vectors to be utilized by custom- crafted cyber threats.
  • 42. 息 仂仄仗舒仆亳 Cisco 亳 (亳仍亳) 亠亠 亟仂亠仆亳亠 从仂仄仗舒仆亳亳, 2013 亞. 亠 仗舒于舒 亰舒亳亠仆. 47 Devic es Internal Network Use NetFlow Data to Extend Visibility to the Access Layer Unify Into a Single Pane of Glass for Detection, Investigation and Reporting Enrich Flow Data With Identity, Events and Application to Create Context WHO WHAT WHERE WHEN HOW Hardware- enabled NetFlow Switch Cisco ISE Cisco ISR G2 + NBAR Cisco ASA + NSEL Cont ext