WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:02.730 align:middle line:90%
DNS is just part
of our landscape

3
00:02.730 --> 00:04.019 align:middle line:84%
when it comes to security.

4
00:04.019 --> 00:05.394 align:middle line:90%
We've already
talked a little bit

5
00:05.394 --> 00:07.950 align:middle line:90%
about how DNS could be
leveraged to exfiltrate data.

6
00:07.950 --> 00:11.130 align:middle line:90%
But we could also talk about
how we could investigate

7
00:11.130 --> 00:14.910 align:middle line:90%
DNS patterns in order to
find out how an attacker may

8
00:14.910 --> 00:16.230 align:middle line:84%
be attempting to attack us.

9
00:16.230 --> 00:18.450 align:middle line:90%
And what types of threats
they could carry out.

10
00:18.450 --> 00:21.720 align:middle line:90%
Even how their files or
their execution patterns

11
00:21.720 --> 00:25.410 align:middle line:90%
are being communicated
outbound towards the attackers

12
00:25.410 --> 00:26.400 align:middle line:84%
infrastructure.

13
00:26.400 --> 00:30.750 align:middle line:90%
Using things like Cisco AMP
with Threat Grid in conjunction
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:26.400 --> 00:30.750 align:middle line:90%
Using things like Cisco AMP
with Threat Grid in conjunction

14
00:30.750 --> 00:33.120 align:middle line:90%
with the Cisco
Umbrella product, we

15
00:33.120 --> 00:35.970 align:middle line:90%
can leverage one of the
features called Cisco Umbrella

16
00:35.970 --> 00:40.080 align:middle line:90%
Investigate to get an entire
picture of how a threat could

17
00:40.080 --> 00:41.910 align:middle line:84%
be carried out against us.

18
00:41.910 --> 00:44.610 align:middle line:90%
And including, what does their
infrastructure look like?

19
00:44.610 --> 00:46.650 align:middle line:90%
What are they going to
be communicating to?

20
00:46.650 --> 00:49.410 align:middle line:90%
What are the malicious
domains or the IP addresses

21
00:49.410 --> 00:52.120 align:middle line:90%
that are also going to be
part of this attack as well?

22
00:52.120 --> 00:55.200 align:middle line:90%
Let's talk more about
Cisco Umbrella Investigate.

23
00:55.200 --> 00:57.750 align:middle line:90%
Now, thanks to the
power of Cisco's dCloud,

24
00:57.750 --> 01:00.520 align:middle line:90%
we can actually see
Cisco Umbrella in action.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:57.750 --> 01:00.520 align:middle line:90%
we can actually see
Cisco Umbrella in action.

25
01:00.520 --> 01:04.080 align:middle line:90%
This is one of the cooler things
about the analytics platforms

26
01:04.080 --> 01:06.270 align:middle line:90%
and the reporting
platforms within Cisco

27
01:06.270 --> 01:09.360 align:middle line:90%
is they give us great resources
to actually test drive

28
01:09.360 --> 01:11.100 align:middle line:84%
these products, like dCloud.

29
01:11.100 --> 01:14.430 align:middle line:90%
I think the D actually stands
for demo, for demo Cloud,

30
01:14.430 --> 01:16.450 align:middle line:90%
so that you can
demo these products.

31
01:16.450 --> 01:18.120 align:middle line:90%
So if you see on the
screen right here,

32
01:18.120 --> 01:21.660 align:middle line:90%
I've got this particular
Umbrella version 2.1

33
01:21.660 --> 01:23.400 align:middle line:84%
Instance Demo spun up.

34
01:23.400 --> 01:25.800 align:middle line:90%
This is the URL, you do
have to get logged in,

35
01:25.800 --> 01:28.440 align:middle line:90%
and then you want to click
this view button right here

36
01:28.440 --> 01:31.560 align:middle line:90%
and it will launch you straight
into the dCloud environment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:28.440 --> 01:31.560 align:middle line:90%
and it will launch you straight
into the dCloud environment.

37
01:31.560 --> 01:32.710 align:middle line:84%
Which looks like this.

38
01:32.710 --> 01:34.590 align:middle line:84%
This is Cisco Umbrella.

39
01:34.590 --> 01:37.900 align:middle line:90%
You get to see it in action
now at this particular point.

40
01:37.900 --> 01:40.740 align:middle line:90%
And what I like to see is
I like to see right here

41
01:40.740 --> 01:44.460 align:middle line:90%
we've got some malware
attempts, 2,105 requests

42
01:44.460 --> 01:46.860 align:middle line:84%
blocked in the last 24 hours.

43
01:46.860 --> 01:50.640 align:middle line:90%
We've got Command and Control,
that's those C&C items where

44
01:50.640 --> 01:53.370 align:middle line:90%
they're trying to use tunnels
to command and control

45
01:53.370 --> 01:55.090 align:middle line:84%
what the malware is doing.

46
01:55.090 --> 01:56.760 align:middle line:90%
There's also
cryptomining requests

47
01:56.760 --> 01:58.630 align:middle line:90%
that have been going
on in our environment.

48
01:58.630 --> 02:01.620 align:middle line:90%
So if we want to investigate--
that's what we're really here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:58.630 --> 02:01.620 align:middle line:90%
So if we want to investigate--
that's what we're really here

49
02:01.620 --> 02:04.650 align:middle line:90%
to talk about is the Umbrella
Investigate product--

50
02:04.650 --> 02:08.580 align:middle line:90%
we can dig in to what these
types of threats really do.

51
02:08.580 --> 02:10.350 align:middle line:90%
So let's go into
cryptomining real quick

52
02:10.350 --> 02:12.060 align:middle line:84%
and see the view details.

53
02:12.060 --> 02:14.250 align:middle line:90%
And look at the threats
that have been stopped

54
02:14.250 --> 02:15.780 align:middle line:84%
thanks to Cisco's Umbrella.

55
02:15.780 --> 02:18.420 align:middle line:90%
Well, I see exactly
which identity

56
02:18.420 --> 02:20.070 align:middle line:84%
or where this is being located.

57
02:20.070 --> 02:23.580 align:middle line:90%
And what policies and rules
are being triggered here.

58
02:23.580 --> 02:27.000 align:middle line:90%
And I also see exactly
what the destination is

59
02:27.000 --> 02:28.500 align:middle line:84%
that they're trying to go to.

60
02:28.500 --> 02:31.530 align:middle line:90%
So when I see minergate.com,
that makes me think,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:28.500 --> 02:31.530 align:middle line:90%
So when I see minergate.com,
that makes me think,

61
02:31.530 --> 02:33.822 align:middle line:90%
OK, well clearly this is
the cryptomining threat

62
02:33.822 --> 02:35.280 align:middle line:90%
that they're talking
about and it's

63
02:35.280 --> 02:37.350 align:middle line:84%
trying to go to minergate.com.

64
02:37.350 --> 02:40.470 align:middle line:90%
So somebody has installed
some sort of application

65
02:40.470 --> 02:42.030 align:middle line:90%
in their environment
that's trying

66
02:42.030 --> 02:45.240 align:middle line:90%
to do some low, lightweight
cryptomining behind the scenes

67
02:45.240 --> 02:48.090 align:middle line:90%
so that they can use
our resources to gain

68
02:48.090 --> 02:49.380 align:middle line:84%
cryptocurrency.

69
02:49.380 --> 02:50.320 align:middle line:84%
So let's do this.

70
02:50.320 --> 02:53.880 align:middle line:90%
Let's try and dig in to
Miner Gate by investigating.

71
02:53.880 --> 02:56.010 align:middle line:90%
So I'll go to the
Investigate section

72
02:56.010 --> 02:58.090 align:middle line:90%
right here on the
left hand side.

73
02:58.090 --> 03:00.990 align:middle line:90%
And you can see we can
now do some searches based
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:58.090 --> 03:00.990 align:middle line:90%
And you can see we can
now do some searches based

74
03:00.990 --> 03:06.990 align:middle line:90%
on hostname, URL, Autonomous
System Number, IP address,

75
03:06.990 --> 03:08.890 align:middle line:84%
hash, or an email address.

76
03:08.890 --> 03:12.720 align:middle line:90%
So I'll say minergate.com
and click Investigate.

77
03:12.720 --> 03:15.180 align:middle line:90%
OK, so it tells me some
things about MinerGate.

78
03:15.180 --> 03:16.950 align:middle line:90%
First of all, it's
kind of a low risk.

79
03:16.950 --> 03:19.440 align:middle line:90%
It is in the
cryptomining category.

80
03:19.440 --> 03:21.540 align:middle line:90%
I can even look at the
security indicators

81
03:21.540 --> 03:24.330 align:middle line:90%
here and look for
any unusual patterns

82
03:24.330 --> 03:26.040 align:middle line:84%
or any unusual keywords.

83
03:26.040 --> 03:28.410 align:middle line:90%
Just some different
categories and scores

84
03:28.410 --> 03:31.980 align:middle line:90%
that we have here within
the specific domain name.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:28.410 --> 03:31.980 align:middle line:90%
that we have here within
the specific domain name.

85
03:31.980 --> 03:34.358 align:middle line:90%
But then I see the
number of DNS queries

86
03:34.358 --> 03:36.150 align:middle line:90%
that have been happening
in my environment,

87
03:36.150 --> 03:37.637 align:middle line:84%
again, for the last month.

88
03:37.637 --> 03:39.720 align:middle line:90%
I think that's going to
be an important one to see

89
03:39.720 --> 03:42.960 align:middle line:90%
is what kind of
query volume have we

90
03:42.960 --> 03:46.350 align:middle line:90%
had for the past month
for this specific URL?

91
03:46.350 --> 03:49.620 align:middle line:90%
And down here, we can actually
see an entire timeline

92
03:49.620 --> 03:52.140 align:middle line:84%
of the history of this domain.

93
03:52.140 --> 03:55.140 align:middle line:90%
This little blue box right
here is indicating our timeline

94
03:55.140 --> 03:57.150 align:middle line:90%
that we're viewing
above and then

95
03:57.150 --> 04:00.510 align:middle line:90%
this yellow bar here shows the
security categories that have
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:57.150 --> 04:00.510 align:middle line:90%
this yellow bar here shows the
security categories that have

96
04:00.510 --> 04:02.790 align:middle line:84%
existed since actually, 2017.

97
04:02.790 --> 04:04.740 align:middle line:90%
So when I hover
over this, we see

98
04:04.740 --> 04:09.090 align:middle line:90%
that dating all the way back to
October 11, 2017 this category

99
04:09.090 --> 04:10.600 align:middle line:84%
was potentially harmful.

100
04:10.600 --> 04:12.660 align:middle line:90%
And that's what that
yellow is indicating to us.

101
04:12.660 --> 04:14.670 align:middle line:90%
Anything yellow is
potentially harmful.

102
04:14.670 --> 04:18.399 align:middle line:90%
Interestingly, we can see some
DNS resolution information.

103
04:18.399 --> 04:20.579 align:middle line:90%
So when we try to
go to minergate.com,

104
04:20.579 --> 04:24.120 align:middle line:90%
it shows me here is the IP
addresses that it resolves to.

105
04:24.120 --> 04:26.910 align:middle line:90%
But these IP
addresses are the ones

106
04:26.910 --> 04:28.300 align:middle line:84%
that are potentially harmful.

107
04:28.300 --> 04:29.770 align:middle line:90%
I think that's
pretty interesting.

108
04:29.770 --> 04:32.970 align:middle line:90%
And then we can also see when
we first saw that IP address,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:29.770 --> 04:32.970 align:middle line:90%
And then we can also see when
we first saw that IP address,

109
04:32.970 --> 04:35.370 align:middle line:90%
as well as when we last
saw that IP address--

110
04:35.370 --> 04:37.140 align:middle line:84%
notice this is paginated.

111
04:37.140 --> 04:39.000 align:middle line:90%
So we can go through
a list of pages

112
04:39.000 --> 04:40.890 align:middle line:90%
that these IP
addresses resolve to.

113
04:40.890 --> 04:44.370 align:middle line:90%
We get the who is information,
so that we can investigate who

114
04:44.370 --> 04:45.960 align:middle line:84%
owns this domain potentially.

115
04:45.960 --> 04:49.530 align:middle line:90%
And then we can also get some
more geographic information

116
04:49.530 --> 04:53.010 align:middle line:90%
regarding the distribution of
requests for the specific IP

117
04:53.010 --> 04:53.650 align:middle line:84%
address.

118
04:53.650 --> 04:56.910 align:middle line:90%
Notice the list of geographies
that we're looking at here.

119
04:56.910 --> 04:59.490 align:middle line:90%
Turkey, Brazil,
Nigeria, and Russia--

120
04:59.490 --> 05:03.070 align:middle line:90%
these don't necessarily have
the best reputation when
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:59.490 --> 05:03.070 align:middle line:90%
these don't necessarily have
the best reputation when

121
05:03.070 --> 05:05.140 align:middle line:90%
it comes to network
traffic and being

122
05:05.140 --> 05:07.060 align:middle line:84%
destined for a specific domain.

123
05:07.060 --> 05:08.980 align:middle line:90%
Now, this is where it
gets really interesting.

124
05:08.980 --> 05:11.890 align:middle line:90%
The associated samples
and the threat scores.

125
05:11.890 --> 05:15.640 align:middle line:90%
We can see that there are some
types of threats like Trojans,

126
05:15.640 --> 05:17.800 align:middle line:90%
which have a maxed out
threat score of 100

127
05:17.800 --> 05:20.680 align:middle line:90%
that this domain
is associated with.

128
05:20.680 --> 05:24.130 align:middle line:90%
In other words, when these
types of threats or Trojans

129
05:24.130 --> 05:26.890 align:middle line:90%
or malware make their
way into our environment,

130
05:26.890 --> 05:29.920 align:middle line:90%
that's when we start
seeing the spike in traffic

131
05:29.920 --> 05:31.600 align:middle line:84%
to minergate.com.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
05:29.920 --> 05:31.600 align:middle line:84%
to minergate.com.

132
05:31.600 --> 05:35.020 align:middle line:90%
Because these attacks are all
about using your computing

133
05:35.020 --> 05:38.980 align:middle line:90%
resources to mine
cryptocurrency into this pool

134
05:38.980 --> 05:40.390 align:middle line:84%
of minergate.com.

135
05:40.390 --> 05:43.120 align:middle line:90%
So you can see with
the Investigate button

136
05:43.120 --> 05:45.940 align:middle line:90%
we can get into a
lot more detail about

137
05:45.940 --> 05:51.310 align:middle line:90%
how this particular URL or
autonomous system or IP address

138
05:51.310 --> 05:53.440 align:middle line:90%
fares against the
community, what

139
05:53.440 --> 05:55.570 align:middle line:90%
is the overall summary
of it, and what

140
05:55.570 --> 05:58.420 align:middle line:90%
is our traffic and
destination traffic look like.

141
05:58.420 --> 06:01.150 align:middle line:90%
Beyond that, we can also
see what kind of threats
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
05:58.420 --> 06:01.150 align:middle line:90%
Beyond that, we can also
see what kind of threats

142
06:01.150 --> 06:03.560 align:middle line:90%
are associated with
the URL IP address,

143
06:03.560 --> 06:05.980 align:middle line:90%
and so on thanks to
the Cisco Umbrella.

144
06:05.980 --> 06:09.010 align:middle line:90%
Again, consider the fact that
this is all part of the threat

145
06:09.010 --> 06:10.330 align:middle line:84%
intelligence community.

146
06:10.330 --> 06:13.840 align:middle line:90%
So this is constantly learning
and constantly evolving

147
06:13.840 --> 06:17.450 align:middle line:90%
and therefore, constantly
protecting your environment.

148
06:17.450 --> 06:19.960 align:middle line:90%
That's why you're interested
in products like this,

149
06:19.960 --> 06:23.890 align:middle line:90%
because they constantly evolve
and can stop these zero day

150
06:23.890 --> 06:26.800 align:middle line:90%
attacks from occurring even
using that retrospective

151
06:26.800 --> 06:27.470 align:middle line:84%
analysis.

152
06:27.470 --> 06:30.520 align:middle line:90%
So that's been introducing
the Cisco Umbrella Investigate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

152
06:27.470 --> 06:30.520 align:middle line:90%
So that's been introducing
the Cisco Umbrella Investigate

153
06:30.520 --> 06:31.130 align:middle line:84%
product.

154
06:31.130 --> 06:32.838 align:middle line:90%
I hope this has been
informative for you,

155
06:32.838 --> 06:35.120 align:middle line:90%
and I'd like to thank
you for viewing.