- [Instructor] We've talked about our campus networks
in a previous video and how evolving threats continue
to come against our infrastructure.
Most businesses these days have BYOD,
Bring Your Own Device policies, that add
to those complications.
We have a plethora of device types and operating systems
in our typical networks.
Couple that with rapidly growing and changing threats
and you can see why our traditional endpoint
security considerations need to be reimagined.
Now, historically we've used host-based antivirus products
in decades past to protect those endpoints.
While these have been helpful and certainly are still
an important piece of the security puzzle, we need
to look at ways to keep up with the changing landscape.
We've already examined Cisco's SAFE framework,
which has provided us with a general security model
for tailoring that to our needs.
Now we want to look at some specific recommendations
from Cisco for endpoint hardening.
And when we say hardening, we're referring to the process
of securing a system by reducing its vulnerabilities.
Let's start our discussion with Cisco AMP for Endpoints.
AMP stands for Advanced Malware Protection.
This is a next-generation solution that integrates
several features into one product with the ability
to prevent, detect, and respond to threats by leveraging
cloud-based analytics.
Cisco AMP protects Windows, Mac, Linux, Android,
and iOS devices through a public
or private cloud deployment.
The prevention mechanism leverages two different services,
Cisco Talos and Cisco Threat Grid.
Talos uses global statistics to track threats
with the ability to understand root causes
and the scope of outbreaks.
Every single day, Talos receives and analyzes
almost 17 billion web requests, 300 million emails,
and one and a half million unique malware samples.
Talos compiles this intelligence and feeds that
into Cisco AMP in order to provide protection
from well-known and emerging threats.
Cisco threat Grid performs file analysis, both static
file analysis for metrics such as checksums
and behavioral file analysis to see what actually
happens with a file when it's executed
in a sandbox environment.
This analysis is used in conjunction with the Talos
intelligence feed to protect against both known
and unknown threats.
The detection mechanisms employed by Cisco AMP
include the continual monitoring of all endpoint activity.
And it does that in order to detect abnormal behavior.
That's something that isn't possible
with a traditional malware suite.
Traditionally, our malware suites will check a file
maybe upon downloading or upon execution and that's when
the checking stops.
With AMP for Endpoints, it's going to continually
monitor the activity of all of our network endpoints
to see if that exhibits some sort of strange
behavior later on.
For example, if an endpoint exhibits behavior
indicative of a ransomware infection,
the offending processes are terminated by Cisco AMP
and it does that in order to prevent the endpoint
from being encrypted by the ransomware.
Cisco AMP also has the ability to detect
vulnerable software across our environments.
And it will provide a list of running vulnerabilities
based on CVE scoring.
And that will be made available to administrators
that would have a list of hosts that need to be patched
in order to prevent future exploitation.
The response piece uses several unique features,
including endpoint forensics.
This provides what are called file and device trajectories
so that you can track all of the affected applications,
processes, and systems in order to pinpoint
the original infection method or device.
And it will also show you the point of entry
or how did that infection get into your network.
Many other powerful analysis and tracking features
are found in Cisco AMP as well.
Another Cisco product that helps harden our devices
is Cisco Umbrella.
You may be more familiar with the original name
before Cisco purchased this solution, which was OpenDNS.
And very simply what Cisco Umbrella does
is to use DNS data to provide filtering
against malicious Internet destinations.
Cisco Umbrella is said to gather intelligence
from over 175 billion daily DNS requests
from more than 90 million users.
So they use crowdsourced information from all
of the Umbrella users and that data is fed
into the Umbrella database where machine learning
is used to continually update the protection.
Setting up Cisco Umbrella is a fairly simple process.
Once you sign up for the service, you want to add
your network as a core identity on the deployment page.
And you would do that by entering one or more public
IP addresses that are associated with your network.
Once that's completed, you would want to explicitly
point your network DNS settings
to the Umbrella IP addresses.
This can be done on Edge routers and firewalls
or even at the individual host level.
Now, if you do have tech-savvy users who you think
may try to circumvent this because they can do that
by changing their local DNS settings, Umbrella actually
has a really helpful guide for preventing that
with the use of firewall rules.
So if that's something you're interested in
you can go to the Cisco Umbrella page and check that out.
One more Cisco-recommended product to protect our endpoints
is Cisco AnyConnect, which is their VPN software.
This allows employees to work from anywhere
that they have public Internet access, whether they're on
a company laptop or even their personal devices.
As long as they're connected to a VPN
as an authenticated user, they can work from anywhere.
AnyConnect is used in conjunction with the Adaptive
Security Appliance firewall to provide these VPN services.
Another tool often used in conjunction with AnyConnect
is Cisco Endpoint Security Analytics.
This is built on the popular Splunk software.
And Splunk is a popular Security Information
and event Management system or SIM for short.
And what SIMs do is they basically gather all the logs
from your network, from all of your network devices.
That can include firewalls, routers, even hosts.
So it will gather all of those logs into one
central repository so that it's much easier to read
and interpret all of your network logs.
This Cisco solution helps to identify zero-day malware,
dangerous user behavior, and data exfiltration
among other things.
So as you can see, in order to provide adequate
client security in our modern networks, we have to go
beyond our traditional antivirus methods.
This has been a look at some of the Cisco-recommended
solutions for effectively hardening our endpoints.