Hybrid Cloud Security
Total Page:16
File Type:pdf, Size:1020Kb
#CLMEL Hybrid Cloud Security Cisco CloudCentre, AMP for Endpoints, Tetration Analytics, StealthWatch Cloud, ACI+ISE w/TrustSec, ASA/Firepower NGFW, Cloudlock, OpenDNS Umbrella, Cisco Threat Response, Duo Security Brenden Buresh – Principal Systems Engineer Jeff Fanelli – Principal Systems Architect BRKSEC-2719 #CLMEL Cisco Webex Teams Questions? Use Cisco Webex Teams (formerly Cisco Spark) to chat with the speaker after the session How 1 Open the Cisco Events Mobile App 2 Find your desired session in the “Session Scheduler” 3 Click “Join the Discussion” 4 Install Webex Teams or go directly to the team space 5 Enter messages/questions in the team space cs.co/ciscolivebot#BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 3 • Introduction • Cisco CloudCentre Agenda • AMP for Endpoints • Tetration Analytics Part1 - ADM • StealthWatch Cloud • Simplifying Security Visibility Demo • ACI+ISE w/TrustSec • ASA/Firepower NGFW • Tetration Analytics Part2 – Enforcement • Cloudlock • OpenDNS Umbrella • Simplifying Security Segmentation Demo #2 • Cisco Threat Response • Duo Security • Multi-Layered Threat Protection Demo #3 • Conclusion #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 4 Introduction Modern Data Centres are Incredibly Complex Big and Fast Data Application Architecture Hybrid Cloud Virtualisation Continuous development Multicloud orchestration Expanded attack surface Micro Services Workload portability Increase in east-west traffic APIs Zero trust model #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 6 Cisco Data Centre Security Integrated Visibility Segmentation Threat Protection “See Everything” “Reduce the “Stop the Breach” Attack Surface” #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 7 Featured Use Cases and Demos Visibility Segmentation Threat Protection Network and Firewalls and Application Automated Threat Detection, Application Analytics Segmentation Blocking, and Response Stealthwatch Tetration ASA/NGFW NGFW/NGIPS AMP + Cisco Threat Response ACI/TrustSec + Tetration Stealthwatch + Tetration OpenDNS Umbrella AMP + OpenDNS Umbrella Integrated #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 8 Security Capabilities in the Hybrid Cloud Threat Visibility Segmentation Prevention Client Stealthwatch AMP ACI ASAv OpenDNS AMP Server AV/AM Cloud Threat TrustSec NGFWv Umbrella Tetration Workload Response #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 9 Cisco CloudCentre Hybrid Cloud Creates Complexity “lack of visibility and governance across multiple clouds ” “inefficient methods to monitor and optimise cloud consumption and Evolving on- costs” Adopting premises “to develop fast across public clouds environment multiple environments” “to manage infrastructure for both old and new applications” “complex process for integration with other ecosystem solutions” #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 CloudCentre Suite Design, Deploy, and Optimise Anywhere CloudCentre Suite Evolving on- Adopting premises public clouds environment New and One integrated End to end existing platform lifecycle applications #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 12 CloudCentre Suite Multicloud Management Platform Securely Design, Deploy, and Optimise Anywhere Data Centre Private Cloud Public Cloud End to End Lifecycle One Integrated New and Existing Container Platform Applications as Service #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 13 Workload Manager Abstraction of application profile from infrastructure End-to-end infrastructure and application lifecycle management • Blueprint once, deploy anywhere Profile • Integrate with CI/CD toolchain • Govern and control user and cloud accounts, environments and budgets Benefits: Increase workload Workload Manager UI Cloud Private/ management efficiencies, accelerate Personalities Public Clouds time to value, provide governance and policy across multiple clouds BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 14 Cost Optimiser Cloud usage optimisation and cost reduction across multiple clouds • Use automated recommendations to optimise consumption • Simplify inventory and total spend reporting across clouds, accounts and users • Implement right sizing aligned with policy Benefits: Provide consumption visibility across clouds, right-size cloud instances, control spend and reduce cloud costs BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 Action Orchestrator Start Ecosystem integration standardised Invoke using adapters and workflows 1 Target Response • Extend Workload Manager services and actions Invoke • Execute workflows with business and 2 Target technical logic Response • Use included adapters or create custom adapters ~ Invoke Benefits: Eliminate repetitive tasks and N Target broaden scope of cloud orchestration, Response simplify business process and reduce human error End BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 CloudCentre Suite Integration with Cisco Portfolio Business (ITSM) Development (DevOps) CloudCentre Suite AppDynamics Model Deploy Manage Optimise Monitor Map Cisco Intersight Stealthwatch Automation Cloud Services CCP ACI Tetration UCS HyperFlex Nexus ACI Anywhere #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 17 AMP for Endpoints Cisco Security Architecture Security that Works Together Threat Intelligence - TALOS Network Endpoint Cloud Services #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 19 Endpoint Devices Increasingly Difficult to Defend Most challenging areas to defend: 57% 56% 56% Mobile Devices Cloud Data User Behaviour *Source: Cisco 2018 Security Capabilities Benchmark Study #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 How Does the 1% Escape and Get Through? Advanced evasion techniques: • Fileless malware • Environmentally-aware malware • Polymorphism • Exploit legitimate processes #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 21 Uncover the 1% with Cisco AMP for Endpoints Stop Malware Eliminate Blind Discover Unknown Using multiple detection Spots Threats and protection mechanisms The network and endpoint, With proactive threat hunting working together across all operating systems #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 22 How Cisco Addresses Endpoint Challenges Reduce Prevent Detect Risk • Antivirus • Static analysis • Vulnerable software • Fileless malware detection • Sandboxing • Low prevalence • Cloud lookups (1:1, • Malicious Activity • Proxy log analysis 1:many) Protection • Client Indicators of • Machine learning Compromise • Device flow correlation • Cloud Indicators of Compromise #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 23 Agentless Detection with Proxy Analysis Identify Anomalous Traffic Occurring Within Your Network VoIP Printers Security Thermostats Phones Cameras #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 24 Prevent Fileless Malware Malware has Evolved – We Need to Protect Against More than Just Files Monitor process activity and guard against attempts to hijack legitimate applications. #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 25 Protect Against Ransomware Malicious Activity Protection • Monitor Process behaviour at execution • Tuned to detect tell-tale ransomware signs • Quarantine and terminate associated files and processes • Log and alert encryption attempt #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 26 Dynamic Analysis and Sandboxing Execute, Analyse & Test Malware Behaviour to Discover Unknown Zero-Day Threats Suspicious File AMP for Endpoints Analysis Report Threat Grid #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 27 Cloud Based Analysis - See Once, Block Everywhere Share Intelligence Across Network, Web, Email, and Endpoints Talos Talos AMP Cloud Threat Grid Endpoint NGFW NGIPS ISR CES/ESA WSA/SIG #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 28 Continuous Monitoring What happened? Where did the malware come from? Where has the malware been? What is it doing? How do we stop it? #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 29 Perform In-Depth Investigations Threat hunting One click remediation Intelligence correlation #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 30 Tetration Analytics Part1 - ADM Tetration Analytics Hybrid Cloud Workload Protection Attribute and Behaviour Based Security Policy and Segmentation Baseline Software workload vulnerabilities posture Application insight Process behaviour deviation Cisco Tetration Generate segmentation Enforce policy segmentation policies #CLMEL BRKSEC-2719 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 32 Tetration Analytics Platform Details Architecture Overview Event Cisco Web GUI REST API notification Tetration apps Data collection