8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security
âą
5 gefĂ€llt mirâą2,800 views
This document discusses Cisco's next generation security strategy and solutions. It outlines Cisco's approach of integrating products to provide unified visibility, advanced threat protection, and consistent control across networks, endpoints, cloud, and mobile environments. It highlights key Cisco security technologies like FirePOWER, Advanced Malware Protection (AMP), and Identity Services Engine (ISE) and how they work together to provide defense, detection, and remediation against evolving threats.
Empfohlen
Empfohlen
Weitere Àhnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Andere mochten auch
Andere mochten auch (20)
Ăhnlich wie 8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security
Ăhnlich wie 8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security (20)
Mehr von BGA Cyber Security
Mehr von BGA Cyber Security (20)
KĂŒrzlich hochgeladen
KĂŒrzlich hochgeladen (20)
8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security
- 1. Next Generation Security Fuat KILIĂ Consulting Systems Engineer - Security Ali Fuat TĂRKAY Product Sales Specialist - Security
- 2. © 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2
- 3. Cisco and/or its affiliates. All rights reserved. Cisco Public All were smart. All had security. All were seriously compromised. Todayâs Real World: Threats are evolving and evading traditional defense
- 4. Cisco and/or its affiliates. All rights reserved. Cisco Public What would you do if you knew you would be compromised?! BEFORE Discover Enforce Harden DURING Detect Block Defend AFTER Scope Contain Remediate Network Endpoint Mobile Virtual Email & Web ContinuousPoint-in-time Attack Continuum Cloud
- 5. Cisco and/or its affiliates. All rights reserved. Cisco Public The Silver Bullet Does Not Exist⊠âCaptive Portalâ âIt matches the patternâ âNo false positives, no false negatives.â Application Control FW/VPN IDS / IPS UTM NAC AV PKI âBlock or Allowâ âFix the Firewallâ âNo key, no accessâ Sandboxing âDetect the Unknownâ
- 6. Cisco and/or its affiliates. All rights reserved. Cisco Public Customer Value Proposition Cisco Security Solutions Unmatched Visibility Advanced Threat Protection Consistent Control Flexibility & Choice
- 7. Ciscoâs Strategy Integrated Platform for Defense, Discovery and Remediation Firewall Content Gateways Integrated Platform Virtual Cloud Device Data Center Network Access Control Firewall Content Aware Applications Context Aware Identity, Data, Location Threat Aware Malware, APT
- 8. Cisco and/or its affiliates. All rights reserved. Cisco Public Gartner Defines Next-Generation IPS 8 NGIPS Definition âąâŻ Standard First-Gen IPS âąâŻ Context Awareness âąâŻ Application Awareness and full-stack visibility âąâŻ Content Awareness âąâŻ Adaptive Engine Download at Sourcefire.com *Source: âDefining Next-Generation Network Intrusion Preventionâ Gartner, October 7, 2011
- 9. Cisco and/or its affiliates. All rights reserved.Presentation_ID Cisco Public FirePOWER Platform http:// http://WWW WWW WWW WWW FireSIGHT Management Center FireSIGHT Management Center âąâŻ Context Awareness âąâŻ Operating System Identification âąâŻ Fingerprint Applications (Web, Protocol & Client Versions) âąâŻ Service Enumeration (HTTP, SMPT, RDPâŠetc) âąâŻ Users Awareness âąâŻ 24x7 Monitoring (Passive & Inline) âąâŻ Identify Assets Potential Vulnerabilities (Weakness) âąâŻ Leveraging Visibility/vulnerabilities to âAdaptâ âąâŻ Access Control Rules Enforcement âąâŻ Alerting, Correlation & Packets Capture FirePOWER Platform/Services âąâŻ Inspect, Detect, Drop, AllowâŠetc âąâŻ IPS, Application Control, Malware Inspection & URL Rating âąâŻ Inline, Passive & Hybrid Context Awareness in Intrusion Events
- 10. Cisco and/or its affiliates. All rights reserved. Cisco Public FireSIGHT â Unique Visibility Typical NGFW Cisco FireSIGHT System Typical IPS
- 11. Cisco and/or its affiliates. All rights reserved. Cisco Public Building Host Profile OS & version Identified Server applications and version Client Applications Who is at the host Client Version Application What other systems / IPs did user have, when? §ï§âŻ Converting Data into Information
- 12. Cisco and/or its affiliates. All rights reserved. Cisco Public FireSIGHT Impact Assessment Correlates all intrusion events to an impact of the attack against the target Impact Flag Administrator Action Why 1 Act immediately, vulnerable Event corresponds to vulnerability mapped to host 2 Investigate, potentially vulnerable Relevant port open or protocol in use, but no vuln mapped 3 Good to know, currently not vulnerable Relevant port not open or protocol not in use 4 Good to know, unknown target Monitored network, but unknown host 0 Good to know, unknown network Unmonitored network
- 13. Cisco and/or its affiliates. All rights reserved. Cisco Public Indications of Compromise (IoCs) IPS Events Malware Backdoors Exploit Kits Web App Attacks CnC Connections Admin Privilege Escalations SI Events Connections to Known CnC IPs Malware Events Malware Detections Office/PDF/Java Compromises Malware Executions Dropper Infections
- 14. Cisco and/or its affiliates. All rights reserved. Cisco Public Gartner Leadership Sourcefire has been a leader in the Gartner Magic Quadrant for IPS since 2006. As of December 2013 Source: Gartner (December 2013) Radware StoneSoft (McAfee) IBM Cisco HP McAfee Sourcefire (Cisco) HuaweiEnterasys Networks (Extreme Networks) NSFOCUS Information Technology challengers abilityto execute leaders visionariesniche players vision
- 15. Cisco and/or its affiliates. All rights reserved. Cisco Public 2012 NSS Labs SVM for IPS
- 16. Cisco and/or its affiliates. All rights reserved. Cisco Public 2013 NSS Labs SVM for IPS
- 17. Cisco and/or its affiliates. All rights reserved. Cisco Public ASA with FirePOWER Services Available Now!! Industryâs First Threat-Focused NGFW #1 Cisco Security announcement of the year! âąâŻ Integrating defense layers helps organizations get the best visibility âąâŻ Enable dynamic controls to automatically adapt âąâŻ Protect against advanced threats across the entire attack continuum Proven Cisco ASA firewalling Industry leading NGIPS and AMP Cisco ASA with FirePOWER Services
- 18. Cisco Confidential 18© 2013-2014 Cisco and/or its affiliates. All rights reserved. NSS Labs â Next-Generation Firewall Security Value Map Source: NSS Labs 2014 The NGFW Security Value Map shows the placement of Cisco ASA with FirePOWER Services and the FirePOWER 8350 as compared to other vendors. All three products achieved 99.2 percent in security effectiveness and now all can be confident that they will receive the best protections possible regardless of deployment.
- 19. Cisco and/or its affiliates. All rights reserved. Cisco Public SecurityEffectiveness TCO per Protected-Mbps The Results CiscoAMP is a Leader in Security Effectiveness and TCO and offers Best Protection Value Cisco Advanced Malware Protection Best Protection Value 99.0% Breach Detection Rating Lowest TCO per Protected-Mbps NSS Labs Security Value Map (SVM) for Breach Detection Systems
- 20. Fire and ISE
- 21. Cisco Confidential 21© 2013-2014 Cisco and/or its affiliates. All rights reserved. EPS REST API Threat Detection âąâŻ IDS Sig âąâŻ Malware âąâŻ Traffic âąâŻ Application âąâŻ And Many More.. Automagical, Dynamic, Squirrely Threat/Malware/Attack Response/Defense Quarantine Action âąâŻ VLAN Assignment âąâŻ dACLs âąâŻ SGT âąâŻ QoS TAG ISE
- 22. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22 Network as a Sensor © 2014 Lancope, Inc. All rights reserved.
- 23. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23 © 2014 Lancope, Inc. All rights reserved. Flow â The Network Phone Bill Flow CacheDestination IP Origin IP Destination Port Origin Port L3 Protocol DSCP Flow Info Packet Bytes/Packet Origin IP , Port, Proto... 11000 1528 ⊠⊠⊠⊠⊠⊠Monthly Statement Bill At-A-Glance Flow Record Telephone Bill
- 24. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24 Internet  Atlant a  San  Jose  New  York  Remote  Sites  WAN  Firewall  &  IPS  Datacenter  DMZ  User  Network  3G Internet
- 25. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25 Internet  Atlant a  San  Jose  New  York  NetFlo w  Remote  Sites  NetFlo w  NetFlow  WAN  NetFlow  Firewall  Datacenter  NetFlow  NetFlow  NetFlow  DMZ  NetFlo w  NetFlo w  User  Network  3G Internet NetFlo w  NetFlo w  NetFlo w  NetFlow Â
- 26. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26 © 2014 Lancope, Inc. All rights reserved. How CTD Analyzes Devices 31
- 27. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 27 âąâŻ Cisco Bulut ve mobilite gibi gĂŒnlĂŒk hayatımızı oldukça deÄiĆtiren trendlern ıĆıÄında, gereken gĂŒvenlik uzmanlıÄı ve eÄitimi alanında aĆaÄıdaki yenilikleri, uzmanların, mĂŒhendislerin ve operasyon ekiplerinin eÄitimi için yayınlamıĆtır: âąâŻYenilenen CCNP GĂŒvenlik sertifikasyon programı âąâŻYeni Cisco SibergĂŒvenlik UzmanlıÄı âąâŻDaha önceki Cisco GĂŒvenlik UzmanlıÄı sertifikasyonunun sonlanması âąâŻYeni ve gĂŒncellenmiĆ ĂŒrĂŒn eÄitimleri âąâŻ Yeniden dizayn edilen CCNP Security sertifikasyonu, bugĂŒn çok daha geniĆ bir bkÄ±Ć açısıyla, uçtan uça mimari kurmaları gereken gĂŒvenlik uzmanlarını hedeflemektedir: âąâŻ 300-206 Implementing Cisco Edge Network Security Solutions (SENSS) âąâŻ 300-207 Implementing Cisco Threat Control Solutions (SITCS) âąâŻ 300-208 Implementing Cisco Secure Access Solutions (SISAS) âąâŻ 300-209 Implementing Cisco Secure Mobility Solutions (SIMOS)