Cyber Security 2016 - data.eventworld.cz · Cisco Systems jitesar@cisco.com CSE Security, CCIE...

transcript

Cyber Security 2016 Využití aplikačních rozhraní pro analýzu malwaru a automatizovanou odezvu na hrozby

Jiří Tesař Cisco Systems jitesar@cisco.com CSE Security, CCIE #14558, SFCE #124266

Internet

Endpoint User

NGFW/UTM

Filter

DATACENTER

I0II0I II0II0 0I 0 I

000II000I0I

0I 0I 00 II 0II 0I 0I0I0

0II I0II00I0 II00I0

NGIPS/AMP

00I0II0I0II0I00II0I

NGIPSv NGFWv

00 III 0 II0I0 II 0I0 00 III0I0 0 II 000

NGIPS/ AMP

NGIPSv

Roaming User

BEFORE Discover

Enforce

Harden

DURING Detect

Defend

AFTER Scope

Contain

Remediate

Before During After Internet

Management

Client SW

802.1x

URL SIEM

Data Sources

Internet

ASA/Firepower

Firepower MC

AnyConnect

802.1x

Before During After

What does their traffic look like over time?

What operating systems?

View all application traffic… Look for risky applications…

Geolocation for source and destination

URL …

Intrusion events by impact, priority, hosts, users …

File analysis

Malware detection

Identify Where to Start

If this is all there was then the “Order of Investigation” is easy.

From the FMC Dashboard

Identify Where to Start

Indications of Compromise Is often a better place to start. If it was always so easy.

From the FMC Context Explorer

An unknown file is present on IP: 10.4.10.183, having been downloaded from Firefox

At 10:57, the unknown file is from IP 10.4.10.183 to IP: 10.5.11.8

Seven hours later the file is then transferred to a third device (10.3.4.51) using an SMB application

The file is copied yet again onto a fourth device (10.5.60.66) through the same SMB application a half hour later

The Cisco Collective Security Intelligence Cloud has learned this file is malicious and a retrospective event is raised for all four devices immediately.

At the same time, a device with the FireAMP endpoint connector reacts to the retrospective event and immediately stops and quarantines the newly detected malware

Internet

ASA/Firepower

Firepower MC

AnyConnect

802.1x

Before During After

Internet

AnyConnect

ASA/Firepower

Firepower MC NGFW

DC SSL

802.1x

Before During After

Internet

AnyConnect

ASA/Firepower

Firepower MC NGFW

DC SSL

802.1x

TALOS Before During After

Internet

AnyConnect

ASA/Firepower

Firepower MC NGFW

DC SSL

802.1x

Device Trajectory

• Gives you deep visibility into file activity on a single device/endpoint

Looks DEEP into a device and helps answer:

• How did the threat get onto the system?

• How bad is my infection on a given device?

• What communications were made?

• What don’t I know? • What is the chain of events?

Internet

AnyConnect

ASA/Firepower

Firepower MC NGFW

DC SSL

802.1x

Internet

AnyConnect

ASA/Firepower

Firepower MC NGFW

DC SSL

802.1x

Internet

AnyConnect

ASA/Firepower

Firepower MC NGFW

DC SSL

802.1x

8 hours after the first attack, the Malware tries to re-enter the system through the original point of entry but is recognized and blocked.

802.1x

Internet

Switch WLC

Cisco Access Layer

AnyConnect

ASA/Firepower

Before During After

Internet

Switch WLC

Cisco Access Layer

AnyConnect

802.1x

ASA/Firepower

Before During After

Identity Services Engine

Network Resources Role-based policy

access

Traditional TrustSec

BYOD Access

Secure Access

Guest Access

Role-based Access

Identity Profiling

and Posture

Compliant

Quick Reminder – What is ISE?

A centralized security solution that automates context-aware access

to network resources and shares contextual data

Network

Context ISE pxGrid

controller

Internet

Switch WLC

Cisco Access Layer

AnyConnect

802.1x

ASA/Firepower

Before During After

AAA Guest PROF POST

Internet

Switch WLC

Cisco Access Layer

AnyConnect

802.1x

ASA/Firepower

Before During After

AAA Guest PROF POST

PxGrid

Internet

AAA Guest PROF POST

Lancope

Switch WLC

PxGrid

Cisco Access Layer

AnyConnect

802.1x

ASA/Firepower

Before During After

Internet

AAA Guest PROF POST

Lancope

Switch WLC

PxGrid

Cisco Access Layer

AnyConnect

802.1x

ASA/Firepower

Before During After

Access denied

per security

policy

Based on the new

tag, ISE enforces

policy on

FMC detects

suspicious file and

alerts ISE using pxGrid

by changing the

Security Group Tag

(SGT) to suspicious

FMC scans the

user activity and

Enable Rapid Threat Containment With Cisco Firepower Management Center (FMC) and Identity Service Engine (ISE)

Corporate user

downloads file

Internet

AAA Guest PROF POST

Lancope

Switch WLC

PxGrid

Cisco Access Layer

AnyConnect

802.1x

ASA/Firepower

Before During After

ESA WSA

AMP AMP

Internet

AAA Guest PROF POST

Lancope

Switch WLC

ESA WSA

PxGrid

Cisco Access Layer

AnyConnect

802.1x

ASA/Firepower

Before During After

Internet

AAA Guest PROF POST

Lancope

Switch WLC

ESA WSA

PxGrid

Cisco Access Layer

AnyConnect

802.1x

ASA/Firepower

Before During After

AMP AMP

Internet

AAA Guest PROF POST

Lancope

Switch WLC

ESA WSA

PxGrid

Cisco Access Layer

AnyConnect

802.1x

ASA/Firepower

Before During After

AMP AMP

AMP/CTA

CWS OpenDNS

Internet

AAA Guest PROF POST

Lancope

Switch WLC

ESA WSA

PxGrid

Cisco Access Layer

AnyConnect

802.1x

ASA/Firepower

Before During After

AMP AMP

AMP/CTA

CWS OpenDNS

WiFi/LAN

Content GW

Firewall

Threat Management

Meraki

Secure Access

Secure Transfer

Secure Inside

Meraki

TrustSec

Encryption

Security

Policy Management

& Monitoring

S2S VPN

GET VPN

Flex VPN

MacSec

SGT/SGACL

SourceFire

ASA/IPS

Switches

ASA 5500-X

ASA 5585-X

ASA-SM

ISR, CSR

FireAMP

AMP for mobile

LanCope

WSA/VM

SMA/VM

ESA/VM

ASA-SFR

AnyConnect

Děkuji za pozornost

Cyber Security 2016 - data.eventworld.cz · Cisco Systems jitesar@cisco.com CSE Security, CCIE...

Documents