WEBVTT

1
00:00.000 --> 00:04.180
Well, as we dive into a conversation around security architecture, it's

2
00:04.180 --> 00:05.120
incredibly important

3
00:05.120 --> 00:07.680
for us to pause and recognize a couple of things.

4
00:07.680 --> 00:11.370
First and foremost, security moves in a mile a minute, meaning that it's

5
00:11.370 --> 00:12.560
constantly changing

6
00:12.560 --> 00:15.400
Cisco's portfolios, constantly evolving.

7
00:15.400 --> 00:18.980
And there's a lot of products that used to be known by one name and now they're

8
00:18.980 --> 00:19.400
known

9
00:19.400 --> 00:20.400
by another name.

10
00:20.400 --> 00:24.820
And then Cisco goes and acquires a new company and introduces that product into

11
00:24.820 --> 00:25.920
the portfolio.

12
00:25.920 --> 00:31.850
And so nothing in this conversation should be used to plan purchases and make
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:25.920 --> 00:31.850
And so nothing in this conversation should be used to plan purchases and make

13
00:31.850 --> 00:32.480
design

14
00:32.480 --> 00:34.680
decisions in real world networks.

15
00:34.680 --> 00:38.690
Instead, it should be a foundational conversation to say, okay, I understand

16
00:38.690 --> 00:40.080
how Cisco's architecture

17
00:40.080 --> 00:41.280
kind of comes together.

18
00:41.280 --> 00:43.200
I understand what products do what?

19
00:43.200 --> 00:47.260
Let me go talk to my Cisco rep or go talk to my Cisco partner and say, okay,

20
00:47.260 --> 00:47.800
this is

21
00:47.800 --> 00:49.680
my understanding of what I think I need.

22
00:49.680 --> 00:53.190
And they'll say, well, okay, that's great, but this product is now this product

23
00:53.190 --> 00:53.600
and so

24
00:53.600 --> 00:54.600
on and so forth.

25
00:54.600 --> 00:58.390
In fact, that's going to impact us during this conversation because there are

26
00:58.390 --> 00:58.800
quite a

27
00:58.800 --> 01:03.780
few products that are on this exam blueprint that are no longer part of the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.800 --> 01:03.780
few products that are on this exam blueprint that are no longer part of the

28
01:03.780 --> 01:05.000
Cisco portfolio

29
01:05.000 --> 01:06.800
because they've been renamed.

30
01:06.800 --> 01:09.960
And so they're still there, but they don't have the same name.

31
01:09.960 --> 01:13.800
And yet we might be asked a question about a product that his name has changed.

32
01:13.800 --> 01:16.320
And so we need to make sure we know both names.

33
01:16.320 --> 01:19.120
And it's just all part of the security game.

34
01:19.120 --> 01:22.610
We've got to make sure we are on top of things when it comes to network

35
01:22.610 --> 01:23.680
security because

36
01:23.680 --> 01:28.800
our threat actors are constantly evolving their approaches to compromising our

37
01:28.800 --> 01:30.000
networks.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:28.800 --> 01:30.000
networks.

38
01:30.000 --> 01:33.580
And they're trying to get to our sensitive data so they can sell it on the dark

39
01:33.580 --> 01:33.920
web or

40
01:33.920 --> 01:37.680
they're trying to deploy ransomware, whatever the situation is.

41
01:37.680 --> 01:42.920
And we have to be constantly vigilant and putting the right products in place.

42
01:42.920 --> 01:46.200
And Cisco believes that they have a pretty powerful portfolio.

43
01:46.200 --> 01:47.200
And that's just it.

44
01:47.200 --> 01:49.760
Cisco has a fairly large architecture.

45
01:49.760 --> 01:55.120
It's not just, hey, deploy a Cisco firewall here and deploy maybe a Cisco email

46
01:55.120 --> 01:55.840
security

47
01:55.840 --> 01:57.360
appliance over here.

48
01:57.360 --> 02:02.260
It's, hey, we can deploy an entire architecture that is designed to give us
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:57.360 --> 02:02.260
It's, hey, we can deploy an entire architecture that is designed to give us

49
02:02.260 --> 02:03.360
comprehensive

50
02:03.360 --> 02:09.290
security and they can all feed together or work together and feed a single

51
02:09.290 --> 02:10.160
source of

52
02:10.160 --> 02:15.120
information that we can then use to know what's happening inside of our network

53
02:15.120 --> 02:15.240
.

54
02:15.240 --> 02:18.980
And so when we think about what security traditionally has been, we've got to

55
02:18.980 --> 02:19.400
offer

56
02:19.400 --> 02:22.040
our protections.

57
02:22.040 --> 02:25.200
So what are we protecting our network from?

58
02:25.200 --> 02:29.440
Well naturally we want to protect our network against threats.

59
02:29.440 --> 02:31.800
But these threats can come in a lot of different forms.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:29.440 --> 02:31.800
But these threats can come in a lot of different forms.

60
02:31.800 --> 02:36.080
We've got these bad guys out here, the threat actors, and they're trying to get

61
02:36.080 --> 02:37.360
in to our

62
02:37.360 --> 02:38.360
network.

63
02:38.360 --> 02:39.360
So here's our network.

64
02:39.360 --> 02:42.600
We've got some things on the network like user machines.

65
02:42.600 --> 02:44.040
We've got some servers.

66
02:44.040 --> 02:48.970
We've got data and storage and they're trying to get into this network so they

67
02:48.970 --> 02:49.320
can

68
02:49.320 --> 02:53.200
access all these juicy targets that they're trying to get after.

69
02:53.200 --> 02:57.290
And so we used to deploy a firewall in here and that would hopefully stop them

70
02:57.290 --> 02:57.960
from getting

71
02:57.960 --> 02:59.240
on the network.

72
02:59.240 --> 03:05.010
And so we would certainly want to deploy or protect rather from various traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:59.240 --> 03:05.010
And so we would certainly want to deploy or protect rather from various traffic

73
03:05.010 --> 03:05.600
coming

74
03:05.600 --> 03:10.260
from the web or the internet because these threat actors might live in a

75
03:10.260 --> 03:11.840
different country

76
03:11.840 --> 03:15.160
and yet they can access our network through the internet.

77
03:15.160 --> 03:18.520
And so that's why we deploy a firewall here at the edge.

78
03:18.520 --> 03:24.160
But these days most of the threats aren't necessarily coming from the internet.

79
03:24.160 --> 03:27.880
And yes a firewall is still necessary but threat actors are well aware that

80
03:27.880 --> 03:29.360
these firewalls

81
03:29.360 --> 03:31.640
pretty much exist in every network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:29.360 --> 03:31.640
pretty much exist in every network.

82
03:31.640 --> 03:33.480
So what are they doing instead?

83
03:33.480 --> 03:39.750
Well instead they are trying to deploy software packages especially malware

84
03:39.750 --> 03:41.120
here on to a user

85
03:41.120 --> 03:42.840
machine.

86
03:42.840 --> 03:46.680
Now they have a launching point for their attacks.

87
03:46.680 --> 03:52.550
So they're trying to launch attacks from inside the network meaning that they

88
03:52.550 --> 03:54.080
bypassed effectively

89
03:54.080 --> 03:56.320
they bypassed this firewall.

90
03:56.320 --> 03:57.680
So it's kind of an interesting concept.

91
03:57.680 --> 04:02.640
So we have to be well aware of the fact that malware is a very large threat.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:57.680 --> 04:02.640
So we have to be well aware of the fact that malware is a very large threat.

92
04:02.640 --> 04:06.600
Malware isn't just software that kind of ruins our productivity and makes it so

93
04:06.600 --> 04:07.280
our PCs

94
04:07.280 --> 04:08.800
don't work as well.

95
04:08.800 --> 04:10.840
This is very very dangerous.

96
04:10.840 --> 04:17.790
This can provide our threat actors again a launch point for attacks on the

97
04:17.790 --> 04:18.600
network.

98
04:18.600 --> 04:22.860
Now from an internal device a device that is already on the network and doesn't

99
04:22.860 --> 04:23.200
have

100
04:23.200 --> 04:25.720
to go through the firewall in a lot of cases.

101
04:25.720 --> 04:30.440
We also have to be worried about how the malware gets installed on the user PCs
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:25.720 --> 04:30.440
We also have to be worried about how the malware gets installed on the user PCs

102
04:30.440 --> 04:30.520
.

103
04:30.520 --> 04:34.640
And so we have to think about email security because we might have email ph

104
04:34.640 --> 04:35.520
ishing scams

105
04:35.520 --> 04:40.290
out there where links are sent out and these phishing scams can be very

106
04:40.290 --> 04:41.520
sophisticated to

107
04:41.520 --> 04:47.360
the point that even people in IT I mean like me and you might actually be

108
04:47.360 --> 04:48.280
fooled.

109
04:48.280 --> 04:53.020
I've been very close to clicking on links that are phishing links because it's

110
04:53.020 --> 04:53.920
not just

111
04:53.920 --> 04:58.800
any more an email that has bad spelling that's clearly not from a legitimate

112
04:58.800 --> 04:59.760
user but they

113
04:59.760 --> 05:05.030
disguise themselves and tell a really good story and make me think that hey
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:59.760 --> 05:05.030
disguise themselves and tell a really good story and make me think that hey

114
05:05.030 --> 05:05.920
this is somebody

115
05:05.920 --> 05:10.510
I know and they're sending me a link it's pretty scary these days how good

116
05:10.510 --> 05:11.600
email phishing

117
05:11.600 --> 05:13.240
scams can be.

118
05:13.240 --> 05:17.430
And so we have to really think comprehensively about all of these different

119
05:17.430 --> 05:18.400
components and

120
05:18.400 --> 05:24.240
how everything kind of needs to come together such that we can not only protect

121
05:24.240 --> 05:24.880
from these

122
05:24.880 --> 05:29.000
different threats but also explore maybe unique ways of preventing these

123
05:29.000 --> 05:30.120
threats from being
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:29.000 --> 05:30.120
threats from being

124
05:30.120 --> 05:34.700
effective when maybe an email phishing or maybe I should say a phishing email

125
05:34.700 --> 05:35.280
does come

126
05:35.280 --> 05:39.760
through the system and it does land on somebody's machine.

127
05:39.760 --> 05:43.460
What if they do click on that link how do we protect the network from them

128
05:43.460 --> 05:44.320
clicking on

129
05:44.320 --> 05:49.120
that link and how do we detect if this phishing email resulted in malware

130
05:49.120 --> 05:50.360
getting deployed

131
05:50.360 --> 05:53.960
and now the malware is performing attacks on the network we need to be able to

132
05:53.960 --> 05:54.320
detect

133
05:54.320 --> 05:55.960
that as well.

134
05:55.960 --> 06:05.290
So this used to require a centralized solution that would be known as a SEAM or
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
05:55.960 --> 06:05.290
So this used to require a centralized solution that would be known as a SEAM or

135
06:05.290 --> 06:05.720
sometimes

136
06:05.720 --> 06:11.840
a SIM but this stands for security information and event manager.

137
06:11.840 --> 06:15.850
This is a software package that's going to bring information in from all kinds

138
06:15.850 --> 06:16.360
of different

139
06:16.360 --> 06:22.230
security appliances and different security software packages and me as an admin

140
06:22.230 --> 06:22.640
I can

141
06:22.640 --> 06:27.720
in theory log into one of these and be able to hopefully very quickly be able

142
06:27.720 --> 06:28.280
to tell

143
06:28.280 --> 06:32.240
what's happening on my network if there are any network threats.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
06:28.280 --> 06:32.240
what's happening on my network if there are any network threats.

144
06:32.240 --> 06:37.460
Well that's great and all except Sims used to be and still are very complex in

145
06:37.460 --> 06:38.080
nature

146
06:38.080 --> 06:41.740
to the point that it required multiple admins and potentially a security

147
06:41.740 --> 06:42.760
operations center

148
06:42.760 --> 06:47.790
or SOC which is sort of like a network operations center or a NOC but now

149
06:47.790 --> 06:49.720
dedicated for security.

150
06:49.720 --> 06:56.160
Well this led to a Cisco creation and really it's an industry wide creation but

151
06:56.160 --> 06:56.720
Cisco

152
06:56.720 --> 07:07.000
has a product known as the XDR and this stands for the extended detection and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

152
06:56.720 --> 07:07.000
has a product known as the XDR and this stands for the extended detection and

153
07:07.000 --> 07:08.800
response.

154
07:08.800 --> 07:13.600
Now again it's not just a Cisco creation they do have a product called XDR and

155
07:13.600 --> 07:13.960
by the

156
07:13.960 --> 07:22.080
way the X stand it comes from extended so XDR being response here.

157
07:22.080 --> 07:27.430
Cisco has a product known as Cisco SDXDR but other security companies also have

158
07:27.430 --> 07:28.080
similar

159
07:28.080 --> 07:35.120
products but either way the XDR is similar to a SIM however it's intended to be
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
07:28.080 --> 07:35.120
products but either way the XDR is similar to a SIM however it's intended to be

160
07:35.120 --> 07:35.640
much

161
07:35.640 --> 07:42.520
more simple as well as very effective visualization.

162
07:42.520 --> 07:47.850
One of the problems with security platforms over time has been that I can get

163
07:47.850 --> 07:48.360
into a

164
07:48.360 --> 07:53.810
software package like this and it lists out hundreds if not thousands of alerts

165
07:53.810 --> 07:53.960
.

166
07:53.960 --> 07:58.740
It's actually a tale of his oldest time that we've got some large corporation

167
07:58.740 --> 07:59.120
and they

168
07:59.120 --> 08:04.880
end up getting compromised or hacked and a bunch of data gets stolen and it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
07:59.120 --> 08:04.880
end up getting compromised or hacked and a bunch of data gets stolen and it

169
08:04.880 --> 08:06.040
turns out

170
08:06.040 --> 08:10.590
that this hacking attempt was actually listed inside of one of their monitoring

171
08:10.590 --> 08:11.400
solutions.

172
08:11.400 --> 08:17.160
It was right there but it's really hard to see that one line in the middle of

173
08:17.160 --> 08:17.800
dozens

174
08:17.800 --> 08:23.640
or hundreds or thousands of what we might call false positives.

175
08:23.640 --> 08:28.190
These readings that could be a threat but probably isn't a threat and it's hard

176
08:28.190 --> 08:28.480
for

177
08:28.480 --> 08:32.600
us as humans to be able to filter all of that out and so XDR is supposed to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

177
08:28.480 --> 08:32.600
us as humans to be able to filter all of that out and so XDR is supposed to

178
08:32.600 --> 08:33.440
help us out

179
08:33.440 --> 08:35.440
in this regard.

180
08:35.440 --> 08:42.340
Now Cisco's XDR specifically is going to leverage the concept of a priority

181
08:42.340 --> 08:43.000
score and that priority

182
08:43.000 --> 08:47.360
score is out of a thousand.

183
08:47.360 --> 08:53.440
The higher the priority the greater the threat.

184
08:53.440 --> 08:58.820
So if we see something that has a priority score of 15 probably not a big deal

185
08:58.820 --> 08:59.480
but if

186
08:59.480 --> 09:04.680
we have a priority score of 950 well that one we probably better go try to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

186
08:59.480 --> 09:04.680
we have a priority score of 950 well that one we probably better go try to

187
09:04.680 --> 09:05.680
figure out right

188
09:05.680 --> 09:06.680
away.

189
09:06.680 --> 09:10.960
Now there's one other Cisco software package that we want to be aware of.

190
09:10.960 --> 09:17.440
This exists up in the cloud and this is known as Talos Intelligence.

191
09:17.440 --> 09:23.510
Talos is a Cisco product that came through an acquisition and it's essentially

192
09:23.510 --> 09:24.960
this gigantic

193
09:24.960 --> 09:30.160
cloud database of all kinds of different threats and one of the things that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

193
09:24.960 --> 09:30.160
cloud database of all kinds of different threats and one of the things that

194
09:30.160 --> 09:31.080
does very very

195
09:31.080 --> 09:38.120
well is it analyzes different files to be able to figure out our files say for

196
09:38.120 --> 09:38.240
not.

197
09:38.240 --> 09:42.940
And this is pretty interesting and we'll talk about how exactly it works coming

198
09:42.940 --> 09:43.400
up.

199
09:43.400 --> 09:44.400
Now why Talos?

200
09:44.400 --> 09:51.260
Well Talos in Greek mythology was this defender of the island or isle of Crete

201
09:51.260 --> 09:52.480
and so Cisco

202
09:52.480 --> 09:55.760
views Talos as a defender of networks.

203
09:55.760 --> 09:59.960
And so when we look at all of these different Cisco products.

204
09:59.960 --> 10:05.120
So Cisco's got an entire suite of products here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

204
09:59.960 --> 10:05.120
So Cisco's got an entire suite of products here.

205
10:05.120 --> 10:09.400
They are getting information and sharing information with Talos.

206
10:09.400 --> 10:14.730
It's sort of the centralized platform that's going to bring all of this

207
10:14.730 --> 10:16.560
information together

208
10:16.560 --> 10:21.310
but also share information and if we think about it or realize there's other

209
10:21.310 --> 10:22.280
corporations

210
10:22.280 --> 10:23.280
out here.

211
10:23.280 --> 10:29.100
So there's another corporation if I'm corporation A and their corporation B and

212
10:29.100 --> 10:29.920
they have an

213
10:29.920 --> 10:34.710
alert go off like hey this file turned out to be malware and they share that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

213
10:29.920 --> 10:34.710
alert go off like hey this file turned out to be malware and they share that

214
10:34.710 --> 10:35.640
with Talos.

215
10:35.640 --> 10:40.300
Talos is then going to share that down with our malware protection which is AMP

216
10:40.300 --> 10:40.760
in our

217
10:40.760 --> 10:41.760
case.

218
10:41.760 --> 10:46.340
So our anti malware protection or advanced malware protection but either way AM

219
10:46.340 --> 10:46.880
P is going

220
10:46.880 --> 10:53.230
to understand that hey this particular file is actually malware and so maybe

221
10:53.230 --> 10:54.080
this file

222
10:54.080 --> 10:58.280
exists in my network and I can go delete it and I am aware of that because it

223
10:58.280 --> 10:58.800
already

224
10:58.800 --> 11:01.120
triggered somewhere else in the world.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

224
10:58.800 --> 11:01.120
triggered somewhere else in the world.

225
11:01.120 --> 11:04.870
So that's the advantage of having this sort of centralized cloud architecture

226
11:04.870 --> 11:05.360
and that's

227
11:05.360 --> 11:07.440
exactly what Talos brings.

228
11:07.440 --> 11:11.160
So from here we're going to start exploring Cisco's security suite.

229
11:11.160 --> 11:15.000
As I mentioned this is based on the blueprint we're going to talk about

230
11:15.000 --> 11:15.960
products like AMP

231
11:15.960 --> 11:19.160
and make sure we understand what that is even if the name has changed in the

232
11:19.160 --> 11:19.560
modern

233
11:19.560 --> 11:21.960
Cisco security architecture.

234
11:21.960 --> 11:25.790
But regardless we're going to come away from this conversation with a much

235
11:25.790 --> 11:26.960
better understanding

236
11:26.960 --> 11:32.610
of what the security architecture looks like and how Cisco views security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

236
11:26.960 --> 11:32.610
of what the security architecture looks like and how Cisco views security

237
11:32.610 --> 11:33.640
products in their

238
11:33.640 --> 11:37.400
suite as far as how we would deploy them into enterprise networks.