WEBVTT

1
00:00.000 --> 00:04.800
Now, before we start getting into some API examples later on in the skills,

2
00:04.800 --> 00:08.760
I want to clear up some other information that has changed between older

3
00:08.760 --> 00:09.440
versions

4
00:09.440 --> 00:12.200
of what we're doing and where we're at right now.

5
00:12.200 --> 00:16.720
And some of that is some of the software suite's ASISCO offers in order to be

6
00:16.720 --> 00:17.440
able to perform

7
00:17.440 --> 00:19.080
those better secure functions.

8
00:19.080 --> 00:23.280
So let's take a look at a couple of them and see where we're at.

9
00:23.280 --> 00:26.960
The first one we're taking a look at is Cisco Secured Network Analytics.

10
00:26.960 --> 00:30.600
Now, this used to be known as Cisco StealthWatch and it is a security product
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:26.960 --> 00:30.600
Now, this used to be known as Cisco StealthWatch and it is a security product

11
00:30.600 --> 00:31.200
that provides

12
00:31.200 --> 00:35.200
comprehensive visibility and network traffic analysis.

13
00:35.200 --> 00:39.150
The uses that data from various sources like routers, which is another network

14
00:39.150 --> 00:39.440
device

15
00:39.440 --> 00:45.250
across our organization to detect advanced threats, track network performance,

16
00:45.250 --> 00:45.520
and ensure

17
00:45.520 --> 00:48.040
compliance with the security policies.

18
00:48.040 --> 00:51.680
It'll provide us with deep visibility into network traffic patterns and flows,

19
00:51.680 --> 00:52.040
enabling

20
00:52.040 --> 00:55.440
detection of malicious activities and performance issues.

21
00:55.440 --> 01:00.520
So kind of a real-life, real-world dashboard of data from the actual network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:55.440 --> 01:00.520
So kind of a real-life, real-world dashboard of data from the actual network

22
01:00.520 --> 01:01.440
device itself

23
01:01.440 --> 01:05.400
to be able to tell us if we're utilizing all of our resources or if we need to

24
01:05.400 --> 01:06.000
allocate

25
01:06.000 --> 01:07.000
some more.

26
01:07.000 --> 01:11.550
And we could use the security analytics provided to be able to give us more

27
01:11.550 --> 01:12.360
detail on how

28
01:12.360 --> 01:17.010
to detect and alert on unusual behavior and potential security threats at real

29
01:17.010 --> 01:17.480
time.

30
01:17.480 --> 01:21.540
That threat detection helps identify a wide range of security issues from

31
01:21.540 --> 01:22.720
malware infections

32
01:22.720 --> 01:27.880
to data exfiltration extamps by analyzing that network to limited.

33
01:27.880 --> 01:31.050
So it's going into a little bit of the packet inspection and utilizing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:27.880 --> 01:31.050
So it's going into a little bit of the packet inspection and utilizing

34
01:31.050 --> 01:32.400
information we provide

35
01:32.400 --> 01:36.490
as security and network administrators to be able to identify things that are

36
01:36.490 --> 01:37.120
going in

37
01:37.120 --> 01:42.680
and out of the network that may be needed for security reasons.

38
01:42.680 --> 01:45.380
And for the forensic side of the house, we're going to have some tools for

39
01:45.380 --> 01:46.280
conducting forensic

40
01:46.280 --> 01:51.110
investigations into historical network activity to trace the root cause of some

41
01:51.110 --> 01:51.480
of those

42
01:51.480 --> 01:53.760
security incidents that may take place.

43
01:53.760 --> 01:57.350
And this is really good for folks like myself who really dig into the forensic

44
01:57.350 --> 01:57.800
side of the

45
01:57.800 --> 02:00.360
house and hand it out.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:57.800 --> 02:00.360
house and hand it out.

46
02:00.360 --> 02:05.330
And we can seamlessly integrate other Cisco security products and solutions to

47
02:05.330 --> 02:05.760
make sure

48
02:05.760 --> 02:10.890
that the overall security posture is coordinated with proper responses to those

49
02:10.890 --> 02:11.720
threats.

50
02:11.720 --> 02:15.480
Next program we're going to take a look at is Cisco Secure Cloud Analytics.

51
02:15.480 --> 02:18.760
Now this used to be called StealthWatchCloud.

52
02:18.760 --> 02:22.190
And it's a cloud-based security service that offers visibility and threat

53
02:22.190 --> 02:23.080
detection across

54
02:23.080 --> 02:25.840
your cloud and on-on-premises environments.

55
02:25.840 --> 02:30.460
It'll provide comprehensive visibility into user and device activity across
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:25.840 --> 02:30.460
It'll provide comprehensive visibility into user and device activity across

56
02:30.460 --> 02:31.080
your entire

57
02:31.080 --> 02:34.360
network, including those cloud environments and private networks.

58
02:34.360 --> 02:38.890
So like earlier when we were talking about the private or hybrid/community

59
02:38.890 --> 02:39.720
cloud, we also

60
02:39.720 --> 02:42.080
do get threat detection here as well.

61
02:42.080 --> 02:45.800
And we use the advanced analytics and machine learning to detect unusual

62
02:45.800 --> 02:47.000
behavior and potential

63
02:47.000 --> 02:48.720
security threats in real time.

64
02:48.720 --> 02:55.460
So we can start developing rules that are either static or built around machine

65
02:55.460 --> 02:56.440
learning,

66
02:56.440 --> 02:58.600
for example AI and things like that.

67
02:58.600 --> 03:02.020
To be able to kind of gather the best information we can to be able to build
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:58.600 --> 03:02.020
To be able to kind of gather the best information we can to be able to build

68
03:02.020 --> 03:03.000
the best rules that

69
03:03.000 --> 03:07.160
we can for unusual behavior that may lead to a threat.

70
03:07.160 --> 03:12.200
And this will generate security alerts based on those detected anomalies that

71
03:12.200 --> 03:12.960
could indicate

72
03:12.960 --> 03:15.440
a breach in other security issues.

73
03:15.440 --> 03:19.830
Now this one also integrates with other Cisco products and cloud environments

74
03:19.830 --> 03:20.160
to enhance

75
03:20.160 --> 03:24.320
that security posture overall without requiring additional hardware.

76
03:24.320 --> 03:27.630
So this can lay on top of the hardware that we already have in place and be a

77
03:27.630 --> 03:28.080
little bit

78
03:28.080 --> 03:32.180
more economical for us in the long run because we don't have to buy any more
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
03:28.080 --> 03:32.180
more economical for us in the long run because we don't have to buy any more

79
03:32.180 --> 03:34.120
hardware or

80
03:34.120 --> 03:35.920
third-party resources.

81
03:35.920 --> 03:37.520
This go cognitive intelligence.

82
03:37.520 --> 03:41.200
Now this one used to be Cisco-Cognitive Threat Analytics.

83
03:41.200 --> 03:44.480
It was a component of Cisco's broader security platform.

84
03:44.480 --> 03:48.420
This also uses machine learning and AI to analyze that network traffic to

85
03:48.420 --> 03:49.440
develop patterns

86
03:49.440 --> 03:54.360
and identify abnormalities that may indicate a security threat.

87
03:54.360 --> 03:58.900
This does it in a little bit more detail since we are focusing around a

88
03:58.900 --> 04:00.360
solution here that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:58.900 --> 04:00.360
solution here that

89
04:00.360 --> 04:05.510
is more heavily involved in the machine learning and AI development of some of

90
04:05.510 --> 04:06.640
those rules.

91
04:06.640 --> 04:10.360
It leads into the behavioral analysis of that traffic.

92
04:10.360 --> 04:14.820
So we can monitor the users and devices across network to detect unusual

93
04:14.820 --> 04:15.960
activities that

94
04:15.960 --> 04:18.280
could signify a security breach.

95
04:18.280 --> 04:22.150
This would be done based on the abnormality behavior that our machine learning

96
04:22.150 --> 04:22.480
is helping

97
04:22.480 --> 04:28.240
us develop through the patterns of use on our network.

98
04:28.240 --> 04:32.230
We can develop automated responses that are capable of automatically responding
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
04:28.240 --> 04:32.230
We can develop automated responses that are capable of automatically responding

99
04:32.230 --> 04:32.640
to those

100
04:32.640 --> 04:34.440
identified threats.

101
04:34.440 --> 04:40.770
So think of this in terms of developing a rule within an IPS or Intrusion

102
04:40.770 --> 04:43.240
Prevention System.

103
04:43.240 --> 04:48.880
The rules that we develop in there are either anomaly based or signature based.

104
04:48.880 --> 04:53.520
We develop a response that goes with those rules because of IPS takes action.

105
04:53.520 --> 04:56.840
Well, so does Cisco-Cognitive Intelligence.

106
04:56.840 --> 05:00.600
This can help reduce the time and the resources required for manual
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
04:56.840 --> 05:00.600
This can help reduce the time and the resources required for manual

107
05:00.600 --> 05:01.760
interventions.

108
05:01.760 --> 05:06.730
Faster, we are able to detect something and build a rule around it for an

109
05:06.730 --> 05:07.680
action that

110
05:07.680 --> 05:08.680
follows detection.

111
05:08.680 --> 05:14.960
The faster we're able to remediate based on that automated response.

112
05:14.960 --> 05:18.430
And just like the previous two, we're able to integrate this with the other

113
05:18.430 --> 05:19.160
Cisco products

114
05:19.160 --> 05:23.080
to make sure that we have usability across the different platforms.

115
05:23.080 --> 05:26.570
This is delivered through the cloud allowing for that scalability and ease of

116
05:26.570 --> 05:27.200
deployment

117
05:27.200 --> 05:29.080
across multiple networks.

118
05:29.080 --> 05:34.500
So we're really focusing in on the cognitive intelligence system being able to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
05:29.080 --> 05:34.500
So we're really focusing in on the cognitive intelligence system being able to

119
05:34.500 --> 05:35.680
go through

120
05:35.680 --> 05:41.980
and detect abnormalities developed machine learned and AI based rules for that

121
05:41.980 --> 05:44.680
cloud infrastructure.

122
05:44.680 --> 05:48.320
And the last one we're going to be covering is the Cisco Secure Client Network

123
05:48.320 --> 05:49.000
Visibility

124
05:49.000 --> 05:50.000
Module.

125
05:50.000 --> 05:53.440
This would used to be called any connect network visibility module.

126
05:53.440 --> 05:56.840
So if you're familiar with any of the previous names, these are the new names

127
05:56.840 --> 05:57.720
that I'm presenting

128
05:57.720 --> 05:58.720
to you.

129
05:58.720 --> 06:05.480
And this one, NVM for short for network visibility monitor, is a feature of the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
05:58.720 --> 06:05.480
And this one, NVM for short for network visibility monitor, is a feature of the

130
06:05.480 --> 06:06.280
Cisco Secure

131
06:06.280 --> 06:10.760
Client that provides detailed insights into network traffic from the client's

132
06:10.760 --> 06:11.680
perspective.

133
06:11.680 --> 06:14.520
So anything that's happening on the client side is what we're going to be

134
06:14.520 --> 06:16.440
looking at specifically

135
06:16.440 --> 06:19.810
because overall the previous programs were just taking a look at the overall

136
06:19.810 --> 06:20.400
network as

137
06:20.400 --> 06:23.830
traffic went from point eight point B. In this particular case, we're going to

138
06:23.830 --> 06:24.200
be looking

139
06:24.200 --> 06:27.240
at it from how the client's system sees it.

140
06:27.240 --> 06:29.840
Not necessarily the user, but the actual system itself.

141
06:29.840 --> 06:33.560
And this will help our organization monitor network activity for security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
06:29.840 --> 06:33.560
And this will help our organization monitor network activity for security

142
06:33.560 --> 06:34.320
purposes, such

143
06:34.320 --> 06:38.880
as identifying that malicious traffic that may enter or exit that particular

144
06:38.880 --> 06:39.360
system

145
06:39.360 --> 06:43.320
that's being monitored or unauthorized applications.

146
06:43.320 --> 06:49.480
So if an organization has a strict policy on organic applications that need to

147
06:49.480 --> 06:50.200
be restricted

148
06:50.200 --> 06:55.000
or installed or whatever the case may be, NVM can allow us to be able to go

149
06:55.000 --> 06:55.600
through

150
06:55.600 --> 07:02.190
and apply that same level of security that on the network side that we would
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
06:55.600 --> 07:02.190
and apply that same level of security that on the network side that we would

151
07:02.190 --> 07:03.160
normally have

152
07:03.160 --> 07:07.680
to configure manually through things like app locker inside of Microsoft.

153
07:07.680 --> 07:11.500
We do get data collected from various network parameters such as like the

154
07:11.500 --> 07:13.040
application protocol,

155
07:13.040 --> 07:17.880
source and destination IPs, port numbers, and volumes of data transferred.

156
07:17.880 --> 07:23.020
So this goes back to looking at what the actual client system is receiving and

157
07:23.020 --> 07:24.080
transmitting

158
07:24.080 --> 07:27.080
in terms of information across the network.

159
07:27.080 --> 07:31.920
And by looking at these different points of data or that particular collection,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
07:27.080 --> 07:31.920
And by looking at these different points of data or that particular collection,

160
07:31.920 --> 07:31.960
we're

161
07:31.960 --> 07:37.860
able to develop more detailed rules based on what our norm is or floor of

162
07:37.860 --> 07:38.880
traffic.

163
07:38.880 --> 07:43.560
Now while this program does work with other Cisco software suites, we're

164
07:43.560 --> 07:44.520
specifically

165
07:44.520 --> 07:50.680
wanting to integrate this with our stealth watch and our Cisco ISE or ISE.

166
07:50.680 --> 07:55.020
And this allows us to be able to develop a more detailed reporting for our

167
07:55.020 --> 07:56.280
network traffic.

168
07:56.280 --> 07:59.930
But because we're taking a look at the client side of the network traffic

169
07:59.930 --> 08:00.840
itself, we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
07:59.930 --> 08:00.840
itself, we're

170
08:00.840 --> 08:04.990
also able to dive in a little bit more and assist those different departments

171
08:04.990 --> 08:05.440
within

172
08:05.440 --> 08:09.780
our organization like the help desk and troubleshooting network issues because

173
08:09.780 --> 08:10.880
we can take a deep

174
08:10.880 --> 08:14.360
dive into what the actual endpoint is taking a look at.

175
08:14.360 --> 08:17.910
So let's say a website is blocked and we're only seeing it on one or two

176
08:17.910 --> 08:18.640
systems.

177
08:18.640 --> 08:22.160
The NVM software suite would allow us to be able to go through and take a look

178
08:22.160 --> 08:22.720
at it from

179
08:22.720 --> 08:26.740
the client's perspective and see if it's something within our own network or if

180
08:26.740 --> 08:27.600
it's just something

181
08:27.600 --> 08:33.500
from the actual website itself that blocks that particular system for whatever
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
08:27.600 --> 08:33.500
from the actual website itself that blocks that particular system for whatever

182
08:33.500 --> 08:34.360
reason.

183
08:34.360 --> 08:37.740
Now should we go through all those security measures and we still need to be

184
08:37.740 --> 08:39.040
able to implement

185
08:39.040 --> 08:43.290
something a little bit different or more detailed, we can do policy enforcement

186
08:43.290 --> 08:44.000
with the software

187
08:44.000 --> 08:45.360
suite.

188
08:45.360 --> 08:50.170
And by doing this, we're providing network policies that can be used to refine

189
08:50.170 --> 08:52.560
access controls,

190
08:52.560 --> 08:57.210
not just the ACLs, but also the traffic on that individual client system based

191
08:57.210 --> 08:57.440
on the

192
08:57.440 --> 09:01.540
policy that we have within our organization that was developed from observed
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
08:57.440 --> 09:01.540
policy that we have within our organization that was developed from observed

193
09:01.540 --> 09:03.120
traffic patterns

194
09:03.120 --> 09:06.840
that were machine learned through this particular program.