Jason Maynard
Security Consulting Systems Engineer
CCIE# 29033, [CCN|I|D|P], SFCE, CEH SECURI
Cisco and/or its affiliates. Presentation_ID All rights reserved. Cisco Public
TY

Agenda:
• Time for a Better Approach
SECURITY
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2

The Industrialization of Hacking
Phishing, Low
Sophistication
Hacking Becomes
an Industry
Sophisticated
Attacks, Complex
Landscape
1990 1995 2000 2005 2010 2015 2020
Viruses
1990–2000
Worms
2000–2005
Spyware and Rootkits
2005–Today
APTs Cyberware
Today +
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3

How Bad – 2013 and Beyond
145 Million
152 Million
70 Million
50 Million
60 Million
50 Million and a lot more!!!!!!
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4

Needs to be a Better Approach
Current approach has never worked!
Imagine – Security as an Architecture
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5

The New Security Model
BEFORE
Discover
Enforce
Harden
AFTER
Scope
Contain
Remediate
Attack Continuum
DURING
Detect
Block
Defend
Network Endpoint Mobile Virtual Cloud
Point in Time Continuous
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6

Cyber Attack Chain
Recon Weaponization Deliver Exploit Install CnC Actions
BEFORE
Discover
Enforce
Harden
AFTER
Scope
Contain
Remediate
During
Detect
Block
Prevent
NGIPS
Web Security
Email Security
Visibility and Context
Firewall
VPN
NGFW
UTM
NAC + Identity Services
Advanced Malware Protection
Network Behavior Analysis
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7

Sleep Techniques
Unknown Protocols
Encryption
Polymorphism
Actual
Disposi-on
=
Bad
=
Too
Late!!
Actual
Disposi-on
=
Bad
=
Blocked
Beyond the Event Horizon
Addresses limitations of point-in-time detection
Point-­‐in-­‐-me
Detec-on
An-virus
Sandboxing
Ini-al
Disposi-on
=
Clean
Analysis
Stops
Not
100%
Retrospec-ve
Detec-on,
Analysis
Con-nues
Con-nuous
Ini-al
Disposi-on
=
Clean
Blind
to
scope
of
compromise
Turns
back
5me
Visibility
and
Control
are
Key
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8

Leverage Openness and the Broader Community
OpenAppID
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9

Cisco Security Intelligence Operation (SIO)
More Than $100
24 Hours Daily
More Than 40
Million
OPERATIONS
SPENT IN DYNAMIC RESEARCH
AND DEVELOPMENT
0010 010 10010111001 10 100111 010 000100101 110011 01100111010000110000111000111010011101 Cisco1100001110001110 ® SIO
1001 1101 1110011 0110011 101000 0110 00 0111000 111010011 101 1100001 11000 111010011101 101000 0010 010 10010111001 10 100111 010 000100101 110011 01100111010000110000111000111010011101 1100001110001110 1001 1101 1110011 0110011 101000 0110 00 0111000 111010011 101 1100001 11000 111010011101 101000 Email Devices WWW Web
LANGUAGES
IPS Networks Endpoints
More Than 80
PH.D, CCIE, CISSP, MSCE
Cloud IPS AnyConnect®
ESA ASA WWW WSA
Information
More Than 800
ENGINEERS, TECHNICIANS,
AND RESEARCHERS
Actions
Visibility Control
1.6 Million
GLOBAL SENSORS
100 TB
DATA RECEIVED PER DAY
40%
WORLDWIDE EMAIL TRAFFIC
13 Billion
WEB REQUESTS
More Than 150 Million
DEPLOYED ENDPOINTS
3 to 5
MINUTE UPDATES
More Than 200
PARAMETERS TRACKED
More Than 5500
IPS SIGNATURES PRODUCED
More Than 70
PUBLICATIONS PRODUCED
More Than 8 Million
RULES PER DAY
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10

Collective Security Intelligence
Malware
Protection
IPS Rules
Reputation
Feeds
Vulnerability
Database Updates
Sourcefire AEGIS™
Program
Private and
Public
Threat Feeds
Sourcefire VRT®
(Vulnerability
Research Team)
Sandboxing
Machine Learning
Big Data
Infrastructure
Sandnets FireAMP™
Community Honeypots
File Samples
(>380,000 per Day)
Advanced
Microsoft
and Industry
Disclosures
SPARK Program
Snort and ClamAV
Open Source
Communities
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11

The better you can protect……….
The More You See
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12

Questions
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13