WEBVTT

1
00:00.000 --> 00:06.880
Cisco decided to get into the malware protection game with AMP. AMP stands for

2
00:06.880 --> 00:12.080
Advanced Malware Protection and we have a product called AMP for endpoints and

3
00:12.080 --> 00:16.360
it's usually abbreviated as AMP with the number four in here and then the

4
00:16.360 --> 00:20.300
letter E which feels a little bit goofy for an enterprise solution but at the

5
00:20.300 --> 00:24.780
same time it is what it is. So this is known as Advanced Malware Protection for

6
00:24.780 --> 00:30.450
endpoints and it has been revamped in the modern network we or modern portfolio
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

6
00:24.780 --> 00:30.450
endpoints and it has been revamped in the modern network we or modern portfolio

7
00:30.450 --> 00:30.580
.

8
00:30.580 --> 00:36.900
Cisco likes to refer to this as secure endpoint. So maybe they also decided

9
00:36.900 --> 00:42.220
that it didn't sound like a solution necessarily for enterprise networks. I

10
00:42.220 --> 00:45.940
have no idea but secure endpoint certainly gets the point across. What

11
00:45.940 --> 00:50.420
we're trying to accomplish here is we're trying to secure our endpoints. So

12
00:50.420 --> 00:55.860
remember what we just said. Attackers who are out on the internet have a

13
00:55.860 --> 01:00.620
connection to pretty much every network on the planet because everybody has an
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:55.860 --> 01:00.620
connection to pretty much every network on the planet because everybody has an

14
01:00.620 --> 01:07.420
internet connection. Fortunately for us on the good guy side over here we have

15
01:07.420 --> 01:13.340
this product called a firewall and it is very hard for attackers to get through

16
01:13.340 --> 01:17.700
the firewall. Most of their attacks are stopped and halted by the firewalls and

17
01:17.700 --> 01:23.260
again the firewalls are still required because a lot of automated bots and

18
01:23.260 --> 01:26.780
systems are constantly trying to get through firewalls just in case there is

19
01:26.780 --> 01:31.420
a hole there so it's required and yet these threat actors know that they're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
01:26.780 --> 01:31.420
a hole there so it's required and yet these threat actors know that they're

20
01:31.420 --> 01:35.620
probably not going to get through the firewall. Well it would be wonderful if

21
01:35.620 --> 01:40.260
we could all just raise a hearty cheer and say congratulations hey we did it we

22
01:40.260 --> 01:44.820
kept the bad guys out but they have gotten more clever and they have found

23
01:44.820 --> 01:50.580
other ways to get into our network because what they find and what we have

24
01:50.580 --> 01:57.180
in the consulting world what we find as well is that a lot of our networks have

25
01:57.180 --> 02:02.420
this hard exterior this wonderful shield that's protecting them from the evils
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
01:57.180 --> 02:02.420
this hard exterior this wonderful shield that's protecting them from the evils

26
02:02.420 --> 02:08.620
of the internet meanwhile this is just a chewy center with almost no security

27
02:08.620 --> 02:12.980
mechanisms being deployed which made sense a long time ago because we look at

28
02:12.980 --> 02:19.740
a user laptop and say hey guess what I trust you you are a good user I've

29
02:19.740 --> 02:23.420
hired you you don't want to lose your job you're probably not going to go hack

30
02:23.420 --> 02:27.740
my systems and hopefully you won't and so we don't have a lot of security

31
02:27.740 --> 02:32.700
between our trusted platforms here and our servers maybe this is a database
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
02:27.740 --> 02:32.700
between our trusted platforms here and our servers maybe this is a database

32
02:32.700 --> 02:37.100
server with a bunch of private information and it's connected through the

33
02:37.100 --> 02:44.580
same network that the user that we trust is also on well if we don't have any

34
02:44.580 --> 02:51.060
security then that's a problem if that trust gets violated and potentially not

35
02:51.060 --> 02:55.820
even by the actual user because sometimes the actual user here is a good

36
02:55.820 --> 03:00.380
person and they want to abide by the rules but they don't really know what
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
02:55.820 --> 03:00.380
person and they want to abide by the rules but they don't really know what

37
03:00.380 --> 03:04.380
they're doing and they click something that enables the threat actor to take

38
03:04.380 --> 03:09.540
over their machine so now the threat actor effectively has control of this

39
03:09.540 --> 03:14.340
machine and they can use this internal network to attack the database server

40
03:14.340 --> 03:20.700
or again attack a file server or all these types of resources that usually

41
03:20.700 --> 03:23.860
reside in our data center but they might be floating around the network in

42
03:23.860 --> 03:24.180
other

43
03:24.180 --> 03:28.500
places so here's the question and this is where AMP for endpoints is going to

44
03:28.500 --> 03:35.420
come into play here how exactly does this threat actor get onto this otherwise
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
03:28.500 --> 03:35.420
come into play here how exactly does this threat actor get onto this otherwise

45
03:35.420 --> 03:40.900
trusted machine well there's a lot of ways of doing this but the main way that

46
03:40.900 --> 03:46.740
they get away with it is with this concept of malware now we talk about

47
03:46.740 --> 03:50.780
viruses and we talk about worms and we talk about all kinds of malicious

48
03:50.780 --> 03:56.220
software malware this English word within a word concept mail simply means

49
03:56.220 --> 04:01.020
bad and where is the other side of software and so we call it malware
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
03:56.220 --> 04:01.020
bad and where is the other side of software and so we call it malware

50
04:01.020 --> 04:06.860
because it's software that's intended for bad purposes but here's the thing

51
04:06.860 --> 04:12.060
where viruses and worms and all of these other types of bad software packages

52
04:12.060 --> 04:16.900
usually have the purpose of causing disruption and destruction malware can

53
04:16.900 --> 04:23.220
actually be quite silent in a lot of cases because the purpose of malware

54
04:23.220 --> 04:28.780
varies greatly but in a lot of cases like we said this can actually just

55
04:28.780 --> 04:35.700
create a launch point for our attacker so now our attackers have command of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
04:28.780 --> 04:35.700
create a launch point for our attacker so now our attackers have command of

56
04:35.700 --> 04:36.020
this

57
04:36.020 --> 04:41.660
machine and they're using that malware to send attacks to these other internal

58
04:41.660 --> 04:45.980
devices without them ever having to break through the firewall and that's from

59
04:45.980 --> 04:50.220
their perspective the beauty of malware and all I have to do is get this user

60
04:50.220 --> 04:56.140
here to get the malware installed on their machine in some capacity and a lot

61
04:56.140 --> 05:00.380
of the conversation in this skill is about how we prevent this malware from
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
04:56.140 --> 05:00.380
of the conversation in this skill is about how we prevent this malware from

62
05:00.380 --> 05:05.460
getting onto our machines for example we want to prevent email phishing

63
05:05.460 --> 05:10.100
campaigns we want to prevent the old USB trick where you know you I leave a USB

64
05:10.100 --> 05:14.100
stick out in the parking lot or in the main office area and people grab it

65
05:14.100 --> 05:18.740
plug it into their machines the USB is loaded with malware and so now I can

66
05:18.740 --> 05:23.180
put the malware onto the machine just by them plugging it in those kinds of

67
05:23.180 --> 05:28.940
things happen but a lot of it is simply just sending a link via email or via

68
05:28.940 --> 05:33.380
social media or anything any other ways that we can compromise it and just get
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
05:28.940 --> 05:33.380
social media or anything any other ways that we can compromise it and just get

69
05:33.380 --> 05:37.380
that malware installed and so now I've got this launch point for performing an

70
05:37.380 --> 05:43.820
attack and usually I either again want to steal a bunch of personal information

71
05:43.820 --> 05:49.020
credit card data all of these things social security numbers addresses phone

72
05:49.020 --> 05:53.540
numbers all of these different components that make up our personal

73
05:53.540 --> 06:00.100
information can be stolen and then sold on the dark web for real money or
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
05:53.540 --> 06:00.100
information can be stolen and then sold on the dark web for real money or

74
06:00.100 --> 06:05.820
potentially if the threat actors part of a more advanced organization they

75
06:05.820 --> 06:06.060
might

76
06:06.060 --> 06:13.580
want to deploy ransomware and this is a very dangerous type of malware so

77
06:13.580 --> 06:19.500
ransomware the concept here is that we've got this data usually in some kind of

78
06:19.500 --> 06:24.580
data store on the network a file server or storage array and all of our users

79
06:24.580 --> 06:32.620
are happily accessing the storage well then one day the threat actor comes
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
06:24.580 --> 06:32.620
are happily accessing the storage well then one day the threat actor comes

80
06:32.620 --> 06:33.020
along

81
06:33.020 --> 06:41.060
and encrypts it effectively locking up that's a cage by the way locking up our

82
06:41.060 --> 06:49.700
data and there's a key the decryption key on a lock that would open that data

83
06:49.700 --> 06:54.300
back up so they've encrypted our files and now now our users are very sad

84
06:54.300 --> 06:54.700
because

85
06:54.700 --> 06:57.460
they can't access it or maybe they're happy because they get to go home from

86
06:57.460 --> 07:01.060
work early I don't know but I can tell you that our business owners are very
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
06:57.460 --> 07:01.060
work early I don't know but I can tell you that our business owners are very

87
07:01.060 --> 07:07.700
unhappy because the threat actors are suggesting that hey I'll give you the

88
07:07.700 --> 07:15.340
key if you give me a bunch of money and paying the ransom is something that a

89
07:15.340 --> 07:19.540
lot of companies have had to do and with some amount of success they get their

90
07:19.540 --> 07:25.180
files back sometimes they don't and so we want to prevent ransomware from

91
07:25.180 --> 07:32.540
getting installed onto our network so all of this says or suggests that we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
07:25.180 --> 07:32.540
getting installed onto our network so all of this says or suggests that we

92
07:32.540 --> 07:37.900
want to prevent malware from getting installed now here's the problem malware

93
07:37.900 --> 07:42.620
can be very very tricky and even the most advanced systems like Cisco's AMP or

94
07:42.620 --> 07:47.900
secure endpoint can't always know when a malware is floating around on the

95
07:47.900 --> 07:52.060
network and the reason for that is because malware can be silent for a long

96
07:52.060 --> 07:56.020
time it can look like a very innocent file and there's nothing wrong with it

97
07:56.020 --> 08:00.340
and then because either the threat actors send a signal to it or because
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
07:56.020 --> 08:00.340
and then because either the threat actors send a signal to it or because

98
08:00.340 --> 08:05.780
it's on a schedule one way or another boom it triggers and it goes and it does

99
08:05.780 --> 08:12.380
the thing that it's designed to do so we have to be able to prevent it but also

100
08:12.380 --> 08:19.420
ideally try to detect it so this is where that Talos conversation comes into

101
08:19.420 --> 08:25.860
play the Talos cloud is going to bring in data from all over the world this is

102
08:25.860 --> 08:31.770
a massive massive operation and so we're going to track every file on the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
08:25.860 --> 08:31.770
a massive massive operation and so we're going to track every file on the

103
08:31.770 --> 08:32.060
planet

104
08:32.060 --> 08:36.220
earth yeah did you just process what I just said we're going to track every

105
08:36.220 --> 08:41.260
file on the planet earth this is a massive operation but here's the thing

106
08:41.260 --> 08:45.900
about it every file can be reduced down to a hash so I don't have to it's not

107
08:45.900 --> 08:50.300
just based on the name of the file it's really what comprises the file I hash a

108
08:50.300 --> 08:54.700
file every copy of that file on the planet it's going to have the same hash

109
08:54.700 --> 09:04.180
and this file gets categorized as either a known good file meaning hey we don't
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
08:54.700 --> 09:04.180
and this file gets categorized as either a known good file meaning hey we don't

110
09:04.180 --> 09:08.220
to worry about this file this is good we trust this file usually a file from a

111
09:08.220 --> 09:14.500
reputable company or something like that or hey this is a known bad file so

112
09:14.500 --> 09:14.900
yeah

113
09:14.900 --> 09:19.820
you just downloaded this file up here you you click to download which is kind

114
09:19.820 --> 09:25.820
of a really bad idea to to do here we downloaded a file but I know that this

115
09:25.820 --> 09:31.620
is a known bad file and so if AMP is running on that machine then we can
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
09:25.820 --> 09:31.620
is a known bad file and so if AMP is running on that machine then we can

116
09:31.620 --> 09:36.540
immediately quarantine that file but the vast majority of files are going to be

117
09:36.540 --> 09:41.940
in an unknown state because I can create a text file right now and the Talos

118
09:41.940 --> 09:45.820
cloud will find out about that text file and okay we don't know if that's good

119
09:45.820 --> 09:45.940
or

120
09:45.940 --> 09:50.380
bad we're just going to call it unknown and so plenty of files stay in this

121
09:50.380 --> 09:55.700
unknown state until the day that it triggers for some reason and then we can

122
09:55.700 --> 10:00.940
move it into a known bad so this can be a moving target but now we start to see
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
09:55.700 --> 10:00.940
move it into a known bad so this can be a moving target but now we start to see

123
10:00.940 --> 10:08.060
how the architecture comes together because I have a laptop and let's say

124
10:08.060 --> 10:13.260
I'm running AMP for endpoints here which again is also known as secure end

125
10:13.260 --> 10:19.940
point this is a software package that runs here on my laptop on my desktop on

126
10:19.940 --> 10:25.500
my tablets this is an endpoint type of software and secure endpoint so if I

127
10:25.500 --> 10:33.700
deploy this and I'm running this then when I do download that file AMP for end
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
10:25.500 --> 10:33.700
deploy this and I'm running this then when I do download that file AMP for end

128
10:33.700 --> 10:38.860
points or secure endpoints keep on both I guess is going to be sharing this

129
10:38.860 --> 10:43.820
information with Talos and Talos is going to compare it take that hash look

130
10:43.820 --> 10:47.500
and see what it knows about it again most of these will be in an unknown state

131
10:47.500 --> 10:52.020
but if it's known bad from the beginning this is the one of the primary

132
10:52.020 --> 10:52.460
concerns

133
10:52.460 --> 10:57.260
right I just downloaded actual malware then we can prevent that quarantine the

134
10:57.260 --> 11:02.100
file delete it whatever it is we need to do but second if it's in an unknown
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
10:57.260 --> 11:02.100
file delete it whatever it is we need to do but second if it's in an unknown

135
11:02.100 --> 11:07.940
state then it's going to track that file so this unknown file we'll call this

136
11:07.940 --> 11:13.900
unknown one and then we've got unknown two so we've got a bunch of unknown

137
11:13.900 --> 11:14.260
files

138
11:14.260 --> 11:19.700
two three four and so we've got a bunch of these on the system here and then

139
11:19.700 --> 11:19.860
one

140
11:19.860 --> 11:26.780
day Talos says hey remember that file number two this is bad well AMP for end

141
11:26.780 --> 11:30.140
points can go and look at this and say hey we still got this file in our system
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
11:26.780 --> 11:30.140
points can go and look at this and say hey we still got this file in our system

142
11:30.140 --> 11:35.540
let's make sure that we quarantine and delete it so maybe it did detonate or

143
11:35.540 --> 11:40.580
went off or whatever was triggered on somebody else's network which told

144
11:40.580 --> 11:44.660
Talos hey this is a bad file and we need to go prevent that so it can greatly

145
11:44.660 --> 11:48.820
reduce the spread of malware throughout the internet because as soon as it's

146
11:48.820 --> 11:52.340
detected somewhere is being bad we don't have to worry about it already

147
11:52.340 --> 11:57.660
infecting thousands of locations because if we're all running Talos and

148
11:57.660 --> 11:58.300
specifically

149
11:58.300 --> 12:03.140
we've got AMP for end points running on our end points then that will hopefully
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
11:58.300 --> 12:03.140
we've got AMP for end points running on our end points then that will hopefully

150
12:03.140 --> 12:07.580
help us to be able to lock in and secure that endpoint so long story short here

151
12:07.580 --> 12:12.780
AMP for end points is an anti malware software package that's intended to keep

152
12:12.780 --> 12:19.180
us from ideally downloading malware known malware but also even tracking the

153
12:19.180 --> 12:24.340
unknown files and thanks to the Talos cloud we can hopefully isolate and delete

154
12:24.340 --> 12:29.220
those files later on if indeed they're found to be bad