Cisco Connect 2018 Malaysia

1. Cisco ConfidentialC97-714039-00 © 2012 Cisco and/or its affiliates. All rights reserved. 1
Securing SP
Data Center in a
Hyper-Converged World
Christopher Chew | chrichew@cisco.com

2. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
The race is on to digitize
of businesses will
become fully digital
75%
By 2020
of these digitization
efforts will be successful
30%
Only
reason companies
don’t succeed#1
Failure to Innovate

3. Digitization is disrupting the SP business
The world has gone mobile Traffic growth, driven by video
Rise of cloud computing Machine-to-Machine
Changing
Customer
Expectations Ubiquitous Access
to Apps & Services
10X Mobile Traffic Growth
From 2013-2019
Changing Enterprise
Business Models
Efficiency & Capacity
Soon to
Change SP
Architectures/
Service Delivery
Emergence of the Internet of Everything
Process ThingsPeople Data
PetabytesperMonth
Other (43%, 25%)120,000
100,000
80,000
60,000
40,000
20,000
0
Internet Video (57%, 75%)
2013 2014 2015 2016 2017 2018
23% Global
CAGR
2013- 2018

4. Shift to 5G Will Be Led by New Services
Ultra Reliability
(Wherever + Whenever)
Ultra Capacity
and Coverage
Ultra High-Speed
(up to 10 Gbps to cell site)
Ultra Low Latency
(1 ms End-to-End)
Massive Device
Connectivity
Pervasive Video
Broadband access
in dense areas
Average 1 Gbps per
device
Broadband access
everywhere
Tactile Internet
Extreme real-time
communications
Natural Disaster
Lifeline communications
High Speed Train
Higher
user mobility
Sensor Networks
Massive
Internet of Things
E-Health Services
Ultra-reliable
communications
Broadcast
Services
Broadcast-like services
+
1G
New services increase the attack surface, bringing new threats

5. 50B Devices
Connected by 2020
$19T
Opportunity
Digital Disruption,
Massive Scale
Active
Adversaries
Security
Industry
Attack surface
Threat Actors
Attack
Sophistication
Rapidly expanding number
of security companies
Not interoperable
Not open
Changing
Business Models
Dynamic Threat
Landscape
Complexity and
Fragmentation
Security Challenges

6. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Key Security Challenges for Service Providers
Changing Dynamics Reducing Complexity Speeding Innovation Talent Shortage
of service providers said they lost revenue due to attacks in 2016*
*Cisco 2017 Midyear Cybersecurity Report

7. Visibility Across Threat Vectors is Critical
You Can’t Find What You Can’t See
Branch CloudData
Center
Endpoint NetworkEdge Operational
Technology
WHO WHAT WHERE WHEN HOW

8. Leave Cisco’s Approach

9. Talos is the industry-leading threat intelligence
organization. We detect and correlate threats in real
time using the largest threat detection network in the
world to protect against known and emerging cyber
security threats to better protect your organization.

10. 250+
Full Time Threat
Intel Researchers
MILLIONS
Of Telemetry
Agents
4
Global Data
Centers
1100+
Threat Traps
100+
Threat Intelligence
Partners
THREAT INTEL
1.5 MILLION
Daily Malware
Samples
600 BILLION
Daily Email
Messages
16 BILLION
Daily Web
Requests
Honeypots
Open Source
Communities
Vulnerability
Discovery (Internal)
Product
Telemetry
Internet-Wide
Scanning
20 BILLION
Threats Blocked
INTEL
SHARING
TALOS INTEL BREAKDOWN
Customer Data
Sharing
Programs
Service Provider
Coordination
Program
Open
Source
Intel
Sharing
3rd Party Programs
(MAPP)
Industry
Sharing
Partnerships
(ISACs)
500+
Participants

11. Campus Office
VPN
WLAN
Switch
Campus & Mobile
Workers
Branch Office
Branch
Router
W WW
Control
Servers DC Ethernet
Switching Fabric
DDoS
DDoS
Malware
Sandbox
NGIPS
URL
Filtering
NGFW
Datacenter Infrastructure
Security Management & Operations
Network Core
Internet
Malware
Email Web
Vulnerability
Management
Log Mgmt
Inspection/
ForensicsServicesSIEM
IAM
IAM
Control
Plane
Internal IT Cloud
MSS
Physical
Security
Public
Cloud
Evolved
Packet Core
Mobile
Subscriber
Access
Technologies
Small Cell
SP WiFi
eNodeB
Mobile
Infrastructure
MME
PCRF PGW
SGW
WLAN/Internet
Roaming
Networks
Secure
Messaging
Security Application : Mobility & Fixed Network Domain
IT Network MSSP Production

12. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• Gain unique visibility
across your business
• Simplify segmentation
throughout your networks
• Address threats faster
• Enable your network to take action
• Extend visibility and granular access
control
• Prevent the lateral movement
of threats
• Protect your critical information
• Simplify policy enforcement
and data center segmentation
• Accelerate incident response
in the data center
• Identify threats quickly
and take action
Extended Network Data Center
Stealthwatch Enhances Visibility Across your
Entire Business
AnalyzeMonitor Detect RespondCISCO STEALTHWATCH

13. EPG
“Internet”
EPG
“Web”
SP IT DC Security Use Case
ACI + FirePower – Intelligent Threat Defense
FireSIGHT Management
Center
Alerts
Network Visibility
Policy Management
Analytics
Remediation
Application Policy
Infrastructure
Controller (APIC)
Service GraphContracts
NGIPS/NGFW
Advanced Malware Protection
Policy and events
Basic configuration
and health
Intelligent Remediation

14. • Obtain comprehensive,
scalable enterprise
visibility and security
context
• Gain real-time
situational awareness
of traffic
• Detect and analyze
network behavior
anomalies
• Easily detect behaviors
linked to advanced
persistent threats
(APTs), insider threats,
distributed denial-of-
service (DDoS) attacks,
and malware
• Accelerate network
troubleshooting and threat
mitigation
• Respond quickly
to threats
• Continuously improve
enterprise security
posture
Monitor Detect Analyze Respond
See and detect more in your network
with Cisco Stealthwatch
• Collect and analyze
holistic network audit
trails
• Achieve faster root
cause analysis
• Conduct thorough
forensic investigations

15. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
SOURCE ADDRESS 10.1.8.3
DESTINATION ADDRESS 172.168.134.2
SOURCE PORT 47321
DESTINATION PORT 443
INTERFACE Gi0/0/0
IP TOS 0x00
IP PROTOCOL 6
NEXT HOP 172.168.25.1
TCP FLAGS 0x1A
SOURCE SGT 100
: :
APPLICATION NAME NBAR SECURE-HTTP
Routers
Netflow Provides
• A trace of every conversation
in your network
• An ability to collect records
everywhere in your network
(switch, router, or firewall)
• Network usage measurements
• An ability to find north-south as
well as east-west communication
• Lightweight visibility compared to
Switched Port Analyzer (SPAN)-
based traffic analysis
• Indications of compromise (IOC)
• Security group information
Switches
Visibility Through Netflow
10.1.8.3
172.168.134.2Internet

16. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Stealthwatch Cloud Use Case
Description
As organizations move infrastructure to the cloud, they may be blind to the transactional conversations that stay within
the cloud. Visibility is key here as in it is difficult to protect what you cannot see. Stealthwatch Cloud provides flow
visibility into AWS and other public clouds and provides real-time alerts to suspicious and anomalous behavior utilizing
VPC logs. No agents needed for AWS visibility.
Public Cloud Visibility
Use Case
Know what happened for later
investigation informed by
continuous activity tracking
See all activity on your cloud by
monitoring all IP-based traffic
Understand security data through
automatically organized groups
Enable smarter response and
reduce investigation times with
high-fidelity alerts
Monitor activity in real time with
telemetry traffic analysis
Establish baseline for normal
behavior and identify anomalies
over time with entity modeling

17. Cisco and NBC Partner at the Rio Olympics
• FirePOWER Next-Generation
Firewall/NGIPS
• Advanced Malware Protection
(AMP)
• Stealthwatch
Key Solutions
https://newsroom.cisco.com/press-release-content?type=webcontent&articleId=1759742

18. Security Stats for the Rio Olympic Games
Total number of security alerts (8/5/2016 to 8/21/2016) *
- Total Security Alerts: 40M
- Total Attacks blocked: 23M
- DDoS Attack mitigated: 223
Attack types included: Security Scanner analysis, SQL Injection, XSS, File
Upload, Remote File Access Attempt, Command Injection, PHP Injection,
HTTP Violation, Missing/Blank User Agent, Anonymous proxies requests,
Automatic exploits programs
*Received by Akamai protection and security sensors from all technology sponsors