Cisco Security Intelligence Operations Defense in Depth

Transcription

1 Cisco Security Intelligence Operations Defense in Depth Scott Simkin, Cisco Security Product and Solutions Marketing May

2 Agenda Threat Evolution Cisco Security Framework Cisco Security Intelligence Operations (SIO) Portal Overview Breadth and Context Cisco SIO Portal Defense Threat Example 2

3 Threats Response Threat Landscape Evolution Host-based (antivirus) 2000 Network perimeter (IDS and IPS) 2005 Global reputation and sandboxing 2010 Intelligence and analytics Tomorrow Increased attack surface (mobility and cloud) Spyware and rootkits Advanced persistent threats (APTs) and cyberwar Salesforce Mac ios icloud Chat Worms Wireless Application Yahoo Laptop Google Chrome Internet Explorer Server Adobe PDF Users USB Java Application Firefox Flash Network Digg Myspace RSS Technorati Flickr VMWare Netvibes Facebook Youtube Reddit Newsvine StumbleUpon Delicious MobileMe Twitter Blackberry mobile Amazon ipad Gmail Cisco WebEx Dropbox Android iphone Nokia mobile Box net Microsoft Office 3

4 Advanced Cyber Threats Users and applications Compromise site and exploit server 4

5 Advanced Cyber Threats Cisco Network Collector Users and applications Compromise site and exploit server WWW Data exfiltration Extend attack surface Lateral movement Control Infiltrate 5

6 Cloud-based threat intelligence and defense Attacks Global Third-party feeds Reputation And rules Local Malware analysis Infrastructure Common policy, management, and context Common management Shared policy Analytics Compliance Partner API Identity Application Device Location Time Applications and services Hybrid Public Tenants Networkenforced policy Access Firewall IPS VPN Web Appliances Routers Switches Wireless Virtual Workloads Private 6

7 Defend with Intelligence Blocklists and reputation Spam traps, honeypots, and crawlers Domain registration Cisco Security Intelligence Operations Signatures Content inspection Third-party partnerships WWW Threat research Valid SMTP connection? Bad or unwanted content? Command and control site? Hostile action? Malicious content on the endpoint? 7

8 Defend with Intelligence Reputation Signatures Platform-specific rules and logic Cisco Security Intelligence Operations WWW 8

9 Discovery with Breadth of daily security intelligence 9

10 Discovery with Breadth 100 TB of security intelligence deployed security devices 10

11 Discovery with Breadth 100 TB of security intelligence 1.6 million deployed devices daily web requests 11

12 Discovery with Breadth 100 TB of security intelligence 1.6 million deployed devices 13 billion web requests applications and micro-applications 12

13 100 TB of security intelligence 1.6 million deployed devices 150,000 microapplications 93 billion daily messages 5500 IPS signatures 150 million deployed endpoints 5 billion daily connections 1000 applications Cisco Security Intelligence Operations 13 billion web requests 35% enterprise 3 to 5- minute updates 4.5 billion daily blocks Broad visibility Global footprint Defense in depth 13

14 Discovery with Context Who What Where How When Suspicious smtp.example Example.org Domain.com Owner Poorly Structured DOC RAR PDF ZIP PDF Server in High San London Beijing Kiev Jose Risk Location Dynamic IP HTTP SSL Address SMTP Domain Mail server Registered registered < 1 month < > 21 Month Year year Min 14

15 Discovery with Context Who What Where How When Suspicious domain owner Poorly structured PDF Server in high-risk location Dynamic IP address Domain registered < 1 minute

16 Cisco SIO Defense Flow Blocked Reputation Classified Unclassified Harvest URLs from spam Cisco SIO web intelligence Cisco Security Intelligence Operations WWW Sender reputation = -10 Spam blocked Reputation -10 to 10 Categories Antivirus Signatures Efficient antivirus use 16

17 Cisco SIO Defense Flow Inspect content types Confidence in type Inferred rather than declared Example Harvest URLs from spam Cisco SIO web intelligence Cisco Security Intelligence Operations WWW Sender reputation = -10 Spam blocked Reputation -10 to 10 Categories Antivirus Signatures Efficient antivirus use Rules Policy Does local policy allow this action or content? 17

18 Microsoft Internet Explorer Zero-Day Vulnerability Day 0 Zero-day malware In the wild Day 16 First antivirus signature deployed Day 17 Second antivirus signature deployed Day 18 Third antivirus signature deployed Traditional response Security advisory issued Microsoft IE patched 18

19 Microsoft Internet Explorer Zero-Day Vulnerability Day 0 Zero-day malware blocked by Cisco Cisco SIO Proactive Defense Day 14 Cisco IPS signature CNC server blocked Day 16 1 st Anti-Virus Day 17 2 nd Anti-Virus Signature Multiple Deployed attack Signature Deployed vectors Signatures and Deployed Security Advisory Issued Day 18 3 rd Anti-Virus multiple layers of defense Cisco SIO cross-platform intelligence Blocked zero-day Traditional threat Response Blocked 40+ parked domains Blocked exploit server and CNC 18-day lead time IE Patched 19

20 Cisco SIO: Defense in Depth Cisco Security Intelligence Operations WWW 20

21 21

22 22