WEBVTT

1
00:00.000 --> 00:01.950 align:middle line:84%


2
00:01.950 --> 00:03.660 align:middle line:84%
How important is a reputation?

3
00:03.660 --> 00:06.510 align:middle line:90%
Well, for humans it's pretty
important, and for a website,

4
00:06.510 --> 00:10.350 align:middle line:90%
we want to know if a website
or an IP address or a domain

5
00:10.350 --> 00:14.040 align:middle line:90%
has a reputation for spam
or malicious content,

6
00:14.040 --> 00:16.860 align:middle line:90%
and talosintelligence.com
can help us determine

7
00:16.860 --> 00:18.940 align:middle line:84%
that before we even go there.

8
00:18.940 --> 00:20.730 align:middle line:90%
So here we are at
talosintelligence.com

9
00:20.730 --> 00:22.523 align:middle line:84%
once again at their home page.

10
00:22.523 --> 00:23.940 align:middle line:90%
And right here,
what we can do is,

11
00:23.940 --> 00:25.380 align:middle line:90%
we can do a reputation
look up right here

12
00:25.380 --> 00:27.338 align:middle line:90%
on the homepage in this
little slot right here,

13
00:27.338 --> 00:29.550 align:middle line:90%
or we can go to the
Reputation Center.

14
00:29.550 --> 00:32.380 align:middle line:90%
So if we click on the link here
on the tab, Reputation Center,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.550 --> 00:32.380 align:middle line:90%
So if we click on the link here
on the tab, Reputation Center,

15
00:32.380 --> 00:35.160 align:middle line:90%
it'll give us options for
all of these options shown

16
00:35.160 --> 00:35.735 align:middle line:84%
on that page.

17
00:35.735 --> 00:37.860 align:middle line:90%
So let's go to that main
page for Reputation Center

18
00:37.860 --> 00:38.610 align:middle line:84%
right now.

19
00:38.610 --> 00:40.080 align:middle line:90%
So here in the
Reputation Center,

20
00:40.080 --> 00:42.660 align:middle line:90%
the first option is IP and
Domain Reputation Center.

21
00:42.660 --> 00:44.310 align:middle line:90%
So if we click on
this link right here,

22
00:44.310 --> 00:48.060 align:middle line:90%
IP and Domain Reputation,
let's go ahead and look up

23
00:48.060 --> 00:49.665 align:middle line:84%
ihaveabadreputation.com.

24
00:49.665 --> 00:54.450 align:middle line:84%


25
00:54.450 --> 00:57.600 align:middle line:90%
So that site is actually built
for a purpose for testing,

26
00:57.600 --> 01:00.330 align:middle line:90%
things like Cisco's
Umbrella, which also is going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:57.600 --> 01:00.330 align:middle line:90%
things like Cisco's
Umbrella, which also is going

27
01:00.330 --> 01:03.480 align:middle line:90%
to leverage from Cisco Talos
and the security intelligence

28
01:03.480 --> 01:04.379 align:middle line:84%
it provides.

29
01:04.379 --> 01:07.050 align:middle line:90%
So by putting in
ihaveabadreputation.com and we

30
01:07.050 --> 01:09.750 align:middle line:90%
scroll down a little bit,
under reputation details,

31
01:09.750 --> 01:12.600 align:middle line:90%
it shows here as untrusted,
and the threat category

32
01:12.600 --> 01:14.237 align:middle line:84%
is malicious sites.

33
01:14.237 --> 01:16.320 align:middle line:90%
Now, one of the benefits
of having a URL like this

34
01:16.320 --> 01:18.600 align:middle line:90%
that we can test
with is that if we

35
01:18.600 --> 01:21.210 align:middle line:90%
are a policy on our
Firepower appliance

36
01:21.210 --> 01:23.460 align:middle line:90%
or if we have a policy on
our website secure appliance

37
01:23.460 --> 01:27.330 align:middle line:90%
that's blocking those types
of sites, if it doesn't work,

38
01:27.330 --> 01:30.040 align:middle line:90%
we don't get compromised or we
aren't putting ourself at risk.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:27.330 --> 01:30.040 align:middle line:90%
we don't get compromised or we
aren't putting ourself at risk.

39
01:30.040 --> 01:33.600 align:middle line:90%
So using test URLs to test
our policies is a great idea,

40
01:33.600 --> 01:37.223 align:middle line:90%
and this is an example of one of
those, ihaveabadreputation.com.

41
01:37.223 --> 01:38.640 align:middle line:90%
And if we scroll
down a little bit

42
01:38.640 --> 01:41.310 align:middle line:90%
further, it has the
mail server information

43
01:41.310 --> 01:43.800 align:middle line:90%
and we click on Who Is and
scroll down, look at that.

44
01:43.800 --> 01:46.050 align:middle line:90%
And there's information
regarding email volume history

45
01:46.050 --> 01:49.260 align:middle line:90%
and top network owners as
well, one convenient way

46
01:49.260 --> 01:51.817 align:middle line:90%
of doing reputation
lookups based on a domain.

47
01:51.817 --> 01:53.400 align:middle line:90%
Another option that
we have right here

48
01:53.400 --> 01:56.460 align:middle line:90%
under reputation lookup
is File Reputation Lookup.

49
01:56.460 --> 01:57.340 align:middle line:84%
Check this out.

50
01:57.340 --> 01:59.040 align:middle line:90%
Let's click on File
Reputation Lookup.

51
01:59.040 --> 02:01.690 align:middle line:90%
So Talos has a database
regarding billions,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:59.040 --> 02:01.690 align:middle line:90%
So Talos has a database
regarding billions,

52
02:01.690 --> 02:04.860 align:middle line:90%
it is right here, billions
with a B, billions of files,

53
02:04.860 --> 02:08.220 align:middle line:90%
and the reputation system
is Fed into AMP, Firepower,

54
02:08.220 --> 02:11.760 align:middle line:90%
ClamAV, and open source Snort,
and AMP, the Advanced Malware

55
02:11.760 --> 02:14.400 align:middle line:90%
Protection, is integrated into
many different Cisco products

56
02:14.400 --> 02:15.250 align:middle line:84%
as well.

57
02:15.250 --> 02:18.720 align:middle line:90%
So I did a Google search on a
hash for some malicious code,

58
02:18.720 --> 02:20.640 align:middle line:90%
and let's go ahead
and paste it here.

59
02:20.640 --> 02:22.920 align:middle line:90%
And what it's going to
do it's going to search,

60
02:22.920 --> 02:25.860 align:middle line:90%
and what Talos is going to do,
it's going to take the SHA256#,

61
02:25.860 --> 02:29.010 align:middle line:90%
I'll say, I'm not a robot,
and click on Search.

62
02:29.010 --> 02:31.310 align:middle line:90%
And it's going look for a
match, and it found one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:29.010 --> 02:31.310 align:middle line:90%
And it's going look for a
match, and it found one.

63
02:31.310 --> 02:35.670 align:middle line:90%
And so the AMP detection name
is W32.TrojanRansom:WNCry,

64
02:35.670 --> 02:37.330 align:middle line:84%
or a variant of want to cry.

65
02:37.330 --> 02:39.060 align:middle line:90%
Then it identifies
the associated domains

66
02:39.060 --> 02:41.670 align:middle line:90%
for this hash and
then detection aliases

67
02:41.670 --> 02:44.800 align:middle line:90%
regarding that specific
malicious code.

68
02:44.800 --> 02:45.300 align:middle line:84%
Wow.

69
02:45.300 --> 02:46.270 align:middle line:84%
Check it out.

70
02:46.270 --> 02:48.150 align:middle line:90%
So if we manually
needed to do that,

71
02:48.150 --> 02:51.900 align:middle line:90%
we could, but the benefit of
having a device like Firepower

72
02:51.900 --> 02:54.720 align:middle line:90%
or Umbrella that's
leveraging AMP or the AMP

73
02:54.720 --> 02:56.730 align:middle line:90%
for Endpoints or
anywhere else we want

74
02:56.730 --> 02:59.550 align:middle line:90%
to check for malicious
content, our security devices

75
02:59.550 --> 03:01.950 align:middle line:90%
and appliances and software
is doing this for us
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:59.550 --> 03:01.950 align:middle line:90%
and appliances and software
is doing this for us

76
03:01.950 --> 03:03.270 align:middle line:84%
in the background.

77
03:03.270 --> 03:05.940 align:middle line:90%
And the cool thing about using
a security intelligence service

78
03:05.940 --> 03:09.450 align:middle line:90%
like Talos is that as new
malicious code shows up,

79
03:09.450 --> 03:11.490 align:middle line:90%
that new information
in near real time

80
03:11.490 --> 03:13.860 align:middle line:90%
can be shared with the
other millions of devices

81
03:13.860 --> 03:16.800 align:middle line:90%
that Cisco is supporting so
that all those other devices can

82
03:16.800 --> 03:19.560 align:middle line:90%
protect against this
newly discovered threat.

83
03:19.560 --> 03:22.260 align:middle line:90%
So if we go back to
Reputation Center once again,

84
03:22.260 --> 03:25.200 align:middle line:90%
we have IP domain Reputation
Center, File Reputation,

85
03:25.200 --> 03:28.250 align:middle line:90%
which we just looked at,
AMP Naming Conventions.

86
03:28.250 --> 03:30.395 align:middle line:90%
Here's some practice
exercises for developers.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:28.250 --> 03:30.395 align:middle line:90%
Here's some practice
exercises for developers.

87
03:30.395 --> 03:32.645 align:middle line:90%
There's also a section called
Intelligence Categories,

88
03:32.645 --> 03:34.395 align:middle line:90%
and if we click on
that, we have a section

89
03:34.395 --> 03:35.420 align:middle line:84%
for Content Categories.

90
03:35.420 --> 03:38.160 align:middle line:90%
And this really helpful if we're
using a product like Umbrella

91
03:38.160 --> 03:41.040 align:middle line:90%
or Firepower or some
other services tied

92
03:41.040 --> 03:43.290 align:middle line:90%
into Talos because then
when a user is going

93
03:43.290 --> 03:45.480 align:middle line:90%
to some site, that's
security appliance

94
03:45.480 --> 03:47.640 align:middle line:90%
can know the category
of that site and then

95
03:47.640 --> 03:51.233 align:middle line:90%
based on our policy, permit it
or deny it based on our policy.

96
03:51.233 --> 03:52.650 align:middle line:90%
And Threat Categories
is so useful

97
03:52.650 --> 03:54.990 align:middle line:90%
because if we have a security
appliance like the web

98
03:54.990 --> 03:58.680 align:middle line:90%
secure appliance or
Firepower or Umbrella,

99
03:58.680 --> 04:02.200 align:middle line:90%
that based on a website being
in one of these categories,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
03:58.680 --> 04:02.200 align:middle line:90%
that based on a website being
in one of these categories,

100
04:02.200 --> 04:04.080 align:middle line:90%
we can prevent the
user from actually

101
04:04.080 --> 04:06.180 align:middle line:90%
getting to that site
in the first place.

102
04:06.180 --> 04:08.390 align:middle line:90%
An ounce of prevention
is worth a pound of cure.

103
04:08.390 --> 04:10.950 align:middle line:90%
Any time we can stop
the user or the system

104
04:10.950 --> 04:12.690 align:middle line:90%
from getting to
a malicious site,

105
04:12.690 --> 04:14.820 align:middle line:90%
it's a lot better to
prevent that connection

106
04:14.820 --> 04:16.950 align:middle line:90%
than having the
user go to the site

107
04:16.950 --> 04:19.680 align:middle line:90%
and perhaps get malicious
code on their computer

108
04:19.680 --> 04:22.500 align:middle line:90%
and then have software locally
identify that the problem

109
04:22.500 --> 04:23.160 align:middle line:84%
and stop it.

110
04:23.160 --> 04:25.020 align:middle line:90%
The sooner we can
stop the attack,

111
04:25.020 --> 04:27.270 align:middle line:90%
the sooner we can
prevent it, the better.

112
04:27.270 --> 04:28.890 align:middle line:90%
In this video, you
reinforced the idea

113
04:28.890 --> 04:31.230 align:middle line:90%
that we can use security
intelligence in the cloud
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:28.890 --> 04:31.230 align:middle line:90%
that we can use security
intelligence in the cloud

114
04:31.230 --> 04:36.320 align:middle line:90%
to identify the reputation of
a file, of a site, of a domain

115
04:36.320 --> 04:38.850 align:middle line:90%
simply by using the tools that
are provided by that security

116
04:38.850 --> 04:39.870 align:middle line:84%
intelligence provider.

117
04:39.870 --> 04:42.690 align:middle line:90%
In this example we used
talosintelligence.com.

118
04:42.690 --> 04:44.140 align:middle line:90%
so I'll see you
in the next video.

119
04:44.140 --> 04:46.590 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

120
04:46.590 --> 04:49.760 align:middle line:90%
and I'd like to thank
you for viewing.