WEBVTT

1
00:00.000 --> 00:00.060 align:middle line:84%


2
00:00.060 --> 00:02.070 align:middle line:90%
Endpoint protection
is a pretty big deal

3
00:02.070 --> 00:03.990 align:middle line:90%
when it comes to
securing your network,

4
00:03.990 --> 00:06.360 align:middle line:90%
but endpoint
protection solutions

5
00:06.360 --> 00:08.800 align:middle line:90%
come in a bunch of
different shapes and sizes.

6
00:08.800 --> 00:12.360 align:middle line:90%
So before we jump into what
Cisco brings to the table,

7
00:12.360 --> 00:14.670 align:middle line:90%
we need to talk about
the different kinds

8
00:14.670 --> 00:17.170 align:middle line:90%
of endpoint protections
that are available to us.

9
00:17.170 --> 00:19.860 align:middle line:90%
Let's jump on a whiteboard
and talk about the differences

10
00:19.860 --> 00:22.110 align:middle line:90%
in different kinds of
endpoint protection.

11
00:22.110 --> 00:24.630 align:middle line:90%
The threat landscape
itself, the attacks that

12
00:24.630 --> 00:27.450 align:middle line:90%
are being carried out against
us are constantly changing,

13
00:27.450 --> 00:28.410 align:middle line:84%
and guess what?

14
00:28.410 --> 00:32.430 align:middle line:90%
The solutions for protecting
ourselves against those attacks
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.410 --> 00:32.430 align:middle line:90%
The solutions for protecting
ourselves against those attacks

15
00:32.430 --> 00:35.220 align:middle line:90%
are also constantly
changing, and we're now

16
00:35.220 --> 00:37.890 align:middle line:90%
in an era, where we
have to differentiate

17
00:37.890 --> 00:42.180 align:middle line:90%
between the different kinds of
endpoint protection solutions

18
00:42.180 --> 00:43.180 align:middle line:84%
that we have.

19
00:43.180 --> 00:46.860 align:middle line:90%
So what we're talking about
now is endpoint protection

20
00:46.860 --> 00:52.680 align:middle line:90%
platforms and endpoint detection
and response platforms.

21
00:52.680 --> 00:54.780 align:middle line:90%
Those are two
different solutions

22
00:54.780 --> 00:57.880 align:middle line:90%
that both work together to
accomplish the same thing,

23
00:57.880 --> 00:59.800 align:middle line:90%
and that's protecting
our endpoints.

24
00:59.800 --> 01:03.480 align:middle line:90%
So let's talk about the
difference between EPPs, EDRs,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:59.800 --> 01:03.480 align:middle line:90%
So let's talk about the
difference between EPPs, EDRs,

25
01:03.480 --> 01:06.390 align:middle line:90%
and then a little extra
thing called XDRs here

26
01:06.390 --> 01:07.200 align:middle line:84%
in this Nugget.

27
01:07.200 --> 01:11.460 align:middle line:90%
When we're talking about
endpoint protection platforms,

28
01:11.460 --> 01:13.440 align:middle line:90%
what you're really
saying here is

29
01:13.440 --> 01:15.630 align:middle line:90%
this is our
traditional antivirus

30
01:15.630 --> 01:18.100 align:middle line:84%
or anti-malware solution.

31
01:18.100 --> 01:20.580 align:middle line:90%
This is going to be installed
on all of our endpoints

32
01:20.580 --> 01:23.940 align:middle line:90%
like desktops and servers,
as long as it doesn't impact

33
01:23.940 --> 01:25.600 align:middle line:84%
your server's performance.

34
01:25.600 --> 01:28.020 align:middle line:90%
The idea is we have
a user like Bob here.

35
01:28.020 --> 01:30.330 align:middle line:90%
Bob is sitting on
their computer,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.020 --> 01:30.330 align:middle line:90%
Bob is sitting on
their computer,

36
01:30.330 --> 01:34.440 align:middle line:90%
and we'll install an antivirus
solution on this computer.

37
01:34.440 --> 01:38.250 align:middle line:90%
That way as files
enter the computer,

38
01:38.250 --> 01:41.460 align:middle line:90%
the antivirus solution
will scan the file

39
01:41.460 --> 01:44.820 align:middle line:90%
and determine if it matches
some sort of signature

40
01:44.820 --> 01:47.340 align:middle line:84%
or hash that it knows is bad.

41
01:47.340 --> 01:49.720 align:middle line:90%
If the antivirus
determines that it's bad,

42
01:49.720 --> 01:53.610 align:middle line:90%
it can do things like quarantine
the file, fix the file,

43
01:53.610 --> 01:57.150 align:middle line:90%
or correct it by removing
the malicious code, or just

44
01:57.150 --> 01:58.920 align:middle line:84%
plain old delete the file.

45
01:58.920 --> 02:02.820 align:middle line:90%
The idea is that it stops
it at the point in time
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:58.920 --> 02:02.820 align:middle line:90%
The idea is that it stops
it at the point in time

46
02:02.820 --> 02:05.020 align:middle line:90%
that the file
enters our network.

47
02:05.020 --> 02:07.860 align:middle line:90%
This is kind of like a firewall,
except for it's not a firewall.

48
02:07.860 --> 02:09.509 align:middle line:90%
It's not working
the network itself,

49
02:09.509 --> 02:12.690 align:middle line:90%
it's working with the individual
files as they're entering.

50
02:12.690 --> 02:16.350 align:middle line:90%
The kicker to that is the
malware is constantly evolving

51
02:16.350 --> 02:19.920 align:middle line:90%
and all it really has to
do to get into the network

52
02:19.920 --> 02:24.240 align:middle line:90%
is just beat this solution
at the point in time.

53
02:24.240 --> 02:26.310 align:middle line:90%
That's a really important
word to understand

54
02:26.310 --> 02:28.650 align:middle line:84%
or here is point in time.

55
02:28.650 --> 02:30.130 align:middle line:90%
I guess that's
more than one word.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:28.650 --> 02:30.130 align:middle line:90%
I guess that's
more than one word.

56
02:30.130 --> 02:31.890 align:middle line:90%
It's really important
to understand

57
02:31.890 --> 02:35.130 align:middle line:90%
that the file is trying to
beat the endpoint protection

58
02:35.130 --> 02:38.640 align:middle line:90%
platform at the point in
time that it's being scanned.

59
02:38.640 --> 02:40.530 align:middle line:84%
Once it beats it, it's in.

60
02:40.530 --> 02:43.800 align:middle line:90%
It has full access to
servers, the network, and all

61
02:43.800 --> 02:46.450 align:middle line:90%
of the other things that we have
going on in our environment,

62
02:46.450 --> 02:49.050 align:middle line:90%
and that's where the
EDRs come into play.

63
02:49.050 --> 02:53.220 align:middle line:90%
The EDRs go beyond this,
whereas the endpoint protection

64
02:53.220 --> 02:56.970 align:middle line:90%
platform is, in fact, monitoring
files at this point in time

65
02:56.970 --> 02:58.470 align:middle line:90%
that they enter the
network and it's

66
02:58.470 --> 03:01.680 align:middle line:90%
trying to stop malicious files
from entering the network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:58.470 --> 03:01.680 align:middle line:90%
trying to stop malicious files
from entering the network.

67
03:01.680 --> 03:04.950 align:middle line:90%
The endpoint detection
and response solution

68
03:04.950 --> 03:09.150 align:middle line:90%
constantly monitors all
files within the environment.

69
03:09.150 --> 03:11.888 align:middle line:84%
It looks for anomalous behavior.

70
03:11.888 --> 03:12.930 align:middle line:84%
How do I spell anomalous?

71
03:12.930 --> 03:14.160 align:middle line:84%
Hang on, I've got to pause this.

72
03:14.160 --> 03:14.660 align:middle line:84%
Here we go.

73
03:14.660 --> 03:17.430 align:middle line:84%
A-N-O-M-A-L-O-U-S. There we go.

74
03:17.430 --> 03:18.390 align:middle line:84%
Anomalous behaviors.

75
03:18.390 --> 03:22.530 align:middle line:90%
It's looking for anything that
just seems out of the norm.

76
03:22.530 --> 03:27.490 align:middle line:90%
It learns what is normal for our
computer or our entire network.

77
03:27.490 --> 03:30.660 align:middle line:90%
So once a file makes its
way onto an endpoint,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:27.490 --> 03:30.660 align:middle line:90%
So once a file makes its
way onto an endpoint,

78
03:30.660 --> 03:34.920 align:middle line:90%
the EDR will actually continue
to monitor and analyze a file,

79
03:34.920 --> 03:38.550 align:middle line:90%
because some malicious files
make their way in and then wait

80
03:38.550 --> 03:41.130 align:middle line:90%
to perform the attack
once they verify

81
03:41.130 --> 03:43.200 align:middle line:84%
that they're past the EPP.

82
03:43.200 --> 03:46.350 align:middle line:90%
So the EDR will continue
to monitor what's

83
03:46.350 --> 03:49.260 align:middle line:90%
going on our particular
device and then

84
03:49.260 --> 03:53.700 align:middle line:90%
use analytics, machine learning,
and AI to constantly report

85
03:53.700 --> 03:56.010 align:middle line:90%
back to a centralized
solution, where

86
03:56.010 --> 03:58.530 align:middle line:90%
we can monitor threats
that are ongoing

87
03:58.530 --> 04:00.420 align:middle line:84%
in our entire environment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:58.530 --> 04:00.420 align:middle line:84%
in our entire environment.

88
04:00.420 --> 04:03.030 align:middle line:90%
That way we can determine
what threat has occurred,

89
04:03.030 --> 04:06.210 align:middle line:90%
how it entered the
environment, what it's doing,

90
04:06.210 --> 04:09.750 align:middle line:90%
what is it trying to do to the
environment, what trajectory

91
04:09.750 --> 04:12.420 align:middle line:90%
is it on, and what are
our steps to remediate it.

92
04:12.420 --> 04:16.350 align:middle line:90%
The endpoint detection response
is really taking it up a notch,

93
04:16.350 --> 04:20.470 align:middle line:90%
but you can see how these
are two separate solutions.

94
04:20.470 --> 04:24.550 align:middle line:90%
One is trying to stop files from
entering into the environment,

95
04:24.550 --> 04:27.780 align:middle line:90%
the other one is maintaining
the security of our environment

96
04:27.780 --> 04:30.480 align:middle line:84%
in an ongoing monitoring way.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
04:27.780 --> 04:30.480 align:middle line:84%
in an ongoing monitoring way.

97
04:30.480 --> 04:32.640 align:middle line:90%
And one of the cool
things that Cisco did

98
04:32.640 --> 04:36.197 align:middle line:90%
is they noticed these were
two different solutions,

99
04:36.197 --> 04:37.530 align:middle line:84%
and they thought, you know what?

100
04:37.530 --> 04:39.870 align:middle line:90%
We could probably
make it one solution,

101
04:39.870 --> 04:42.595 align:middle line:90%
and that's called Cisco
AMP for Endpoints.

102
04:42.595 --> 04:44.220 align:middle line:90%
In the next Nugget,
we're going to talk

103
04:44.220 --> 04:47.760 align:middle line:90%
a lot more about what Cisco
AMP for Endpoints does for us

104
04:47.760 --> 04:50.520 align:middle line:90%
and how it uses the
best of both worlds

105
04:50.520 --> 04:52.830 align:middle line:84%
when it comes to EPPs and EDRs.

106
04:52.830 --> 04:55.740 align:middle line:90%
But that sets up what
EPPs and EDRs are.

107
04:55.740 --> 04:58.300 align:middle line:90%
I did say I was going to
mention one more thing,

108
04:58.300 --> 05:01.010 align:middle line:84%
and that's now called the XDR.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:58.300 --> 05:01.010 align:middle line:84%
and that's now called the XDR.

109
05:01.010 --> 05:04.520 align:middle line:90%
This is a EDR on
steroids, where it's

110
05:04.520 --> 05:07.520 align:middle line:90%
going to be using advanced
analytics reporting machine

111
05:07.520 --> 05:10.850 align:middle line:90%
learning techniques to
monitor the entire network

112
05:10.850 --> 05:13.040 align:middle line:84%
in a centralized fashion.

113
05:13.040 --> 05:15.110 align:middle line:90%
This is a new and
upcoming solution

114
05:15.110 --> 05:18.050 align:middle line:90%
that you should just be aware
exists out there in the wild,

115
05:18.050 --> 05:20.790 align:middle line:90%
even though it may not be
on an exam environment.

116
05:20.790 --> 05:23.720 align:middle line:90%
So that sets up the difference
between endpoint protection

117
05:23.720 --> 05:26.902 align:middle line:90%
platforms and endpoint detection
and response platforms.

118
05:26.902 --> 05:28.610 align:middle line:90%
I hope this has been
informative for you,

119
05:28.610 --> 05:31.000 align:middle line:90%
and I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
05:28.610 --> 05:31.000 align:middle line:90%
and I'd like to thank
you for viewing.