Cisco Connect 2018 Indonesia - Cybersecurity Strategy
- 2. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Cybersecurity Strategy: An Integrated Approach Arief Santoso Cyber Security Specialist, GSSO April 2018
- 3. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Today’s Network Security Environment Is Complex
- 4. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU The Security Effectiveness Gap Incremental Capabilities vs. Mountains of Complexity The average enterprise is using 50 or more security products to protect its environment Imagine trying to operationalize that many components
- 5. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU What’s the Implication? The Security Effectiveness Gap
- 6. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 7. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 8. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Can You Guess What This Represents?
- 9. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU A Silver Bullet Does Not Exist!
- 10. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Source: Internetworldstats.com
- 11. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Indonesia – Internet Security Survey 2017 (APJII)
- 12. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Promoting Cybersecurity Best Practices People Process Technology Framework covers all three
- 13. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Cisco Cyber Security Value proposition • Before-During-After attack continuum • Secure Architecture Framework SAFE & threat centric CVD • Cisco Security Technical Alliance Threat Centric • Security Trust Org • Government Affairs • TALOS • CSIRT Collective Sec Intelligence Threat Centric approach with integrated Solutions & Services Security Services • Advisory • Assessment • Arch & design • Strategy • Integration • Integrate • Migrate • Optimize • Managed • Hosted • managed StealthWatch TrustSec NGFW NGIPS OpenDNS AMP FireSIGHT AnyConnect Integrated Solutions ASA FirePower ACI APIC EM Umbrella
- 14. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Cisco’s Threat Centric Security Model Attack Continuum Before Discover Enforce Harden During Detect Block Defend After Scope Contain Remediate Network Endpoint Mobile Virtual Cloud Email and Web Point in Time Continuous
- 15. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Cisco’s Threat Centric Security Model Aligning with the Framework Core During Detect Block Defend After Scope Contain Remediate Identify Before Discover Enforce Harden Protect Detect Respond Recover
- 16. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 17. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 18. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Security Advisory Services Security Segmentation High-Level Designs & Strategy Board and Executives Reporting & Metrics Penetration Testing Web, Mobile & Binary Application Assessments Application and Software Design; Cloud Application Cloud & Mobile Strategy Strategy Workshops & Assessments Incident Response Emergency & Retainer Proactive Services Planning, Proactive Threat Hunting & Table- top Exercises Red Team/Blue Team Scenario based testing Development Code Review and Threat Modeling 1. Strategy 2. Risk & Compliance 3. Network Security 4. Application Security 5. Physical & Operational 6. Threat Management Information Security Risk Assessments and Program Development, GDPR Third Party Due Diligence, Risk Assessments Compliance PCI Readiness Assessments, Health Checks & Scanning, ISO 27001 Penetration Testing External and Internal Network; Wireless Network Assessments Network Architecture, Vulnerability, Breakout Infrastructure Assessments Cellular, VPN, VoIP and Telephony Security Operations Plan, Design and Operate Assessments Voice & Email Phishing, Device/Hardware Development Secure Developer Training, DevOps Assessment, Digital Profiling
- 19. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Source: https://www.nist.gov/itl/applied-cybersecurity/nice/about
- 20. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 21. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU End-to-End “Kill Chain” Defense Infrastructure
- 22. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU The Cisco Security Architecture Our Position AND the Reason We’re Here Today Our Security Approach is Unique • Integrate across the Cisco Security suite of products • Consolidate to include key vendor • Automate detection and remediation
- 23. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential The Power of Context
- 24. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Poor Visibility Network with Only Perimeter Visibility 192.168.19.3 10.85.232.4 10.4.51.5 192.168.132.99 10.43.223.221 10.200.21.110 10.51.51.0/24 10.51.52.0/24 10.51.53.0/24 Internet Many devices in your network without visibility Visibility available for traffic transiting through perimeter
- 25. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Insider Threat Enabling Visibility Inside the Network 192.168.19.3 10.85.232.4 10.4.51.5 192.168.132.99 10.43.223.221 10.200.21.110 10.51.51.0/24 10.51.52.0/24 10.51.53.0/24 Internet Cryptic network addresses that may change constantly Difficult to manage policy without any context
- 26. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Ideal State Context-Based Visibility and Control Employee Employee Supplier Quarantine Shared Server Server High Risk Segment Internet Network Fabric Allowed Traffic Denied Traffic Clear understanding of traffic flow with context Easier to create & apply policy based on such context
- 27. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Context Is Everything Poor context awareness Rich context awareness RESULT RESULT IP ADDRESS: 192.168.2.101 UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN John Doe (EMPLOYEE) Windows 10 Workstation Bank Vault 4:30 AM EST on APR 27 Wired NO THREATS / VULNERABILITIES UNKNOWN KNOWN ROLE BASED ACCESSACCESS TO IP (ANY DEVICE / USER) ? ? ?
- 28. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Context Enables Intelligent Policy Decisions Who: Guest What: iPad Where: Office Who: Receptionist What: iPad Where: Office Internet Confidential Patient Records Internal Employee Intranet Who: Doctor What: Laptop Where: Office Implement Granular Control on Traffic, Users, and Assets Enforce Business Role policies for All Network Services and Decisions Define Security Groups and Access Policies Based on Business Roles
- 29. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential - Sherlock Holmes “The world is full of obvious things which nobody by any chance ever observes”
- 30. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Where Do We Derive Context? ICAP NETFLOW DHCPSPANNMAP PCAP RADIUS DHCPDNS Active Directory LDAPSNMPQUERY Log FilesSYSLOG Event Streamers STIX/TAXII StealthwatchISESIEM (Splunk) FMC Sources of Context Consumers of Context
- 31. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Incident Response Complexity Visibility and Context Key to Response and Agility Potential Breach Event! Security Event Associate User to Event AAA Logs Associate User to Authorization IAM Check Endpoint Posture NAC Where is it on the Network? ??? What Kind of Device is it? ??? How Do I Mitigate? ??? ??? ??? Too Many Screens Data Overload Missing correlation Time Consuming
- 32. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential You Can’t Protect What You Can’t See The Network Gives Deep and Broad Visibility 0101 0100 1011 0101 0100 1011 0101 0100 1011 0101 0100 1011
- 33. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU StealthWatch System Overview NetFlow / NBAR / NSEL Network Devices StealthWatch FlowCollector • Collect and analyze • Up to 4000 sources • Up to 240,000 flows per second (FPS) sustained SPAN StealthWatch FlowSensor Generate NetFlow Non-NetFlow- Capable Device • Management and reporting • Up to 25 FlowCollectors • Up to 6 million FPS globally StealthWatch Management Console
- 34. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU StealthWatch System integration with ISE pxGrid Real-Time Visibility into All Network Layers • Data intelligence throughout network • Discovery of assets • Network profile • Security policy monitoring • Anomaly detection • Accelerated incident response Cisco® Identity Services Engine Mitigation Action Context Information NetFlow StealthWatch
- 40. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Use Case
- 41. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 42. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 43. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 44. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 45. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 46. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 47. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 48. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 49. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 50. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU
- 51. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Cisco: Security that works together
- 52. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Cisco positioned best for consolidation opportunity Architecture1 OpenAPI/integration2 Best of breed Best of need Key consolidation requirements
- 53. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Before consolidation – bad scenario
- 54. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Before consolidation – good scenario
- 55. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Point product approach fails It takes an integrated architecture
- 56. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Effective Security posture = Shortest TTD Time ResponseDetectionThreat
- 57. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Stop Problems Before They Become CrisesImpacttothe Business($) credit card data compromised attack identified vulnerability closed attack thwarted early warning attack identified vulnerability closed attack onset STEALTHWATCH REDUCES MTTK Company with StealthWatch Company with Legacy Monitoring Tools ~70% of Incident Response is spent on MTTK “Worm outbreaks impact revenue by up to $250k / hour. StealthWatch pays for itself in 30 minutes.” F500 Media Conglomerate 259% ROI MTTK Time
Editor's Notes
- #7: Code Red Worm – Jul 2001
- #8: Sapphire / Slammer Worm – Jan 2003
- #9: WannaCry Ransomware – May 2017
- #11: Source: internetworldstats.com
- #36: Insider Threats Dashboard is focused on “lateral movement” within the network. Server to server within the datacenter and host to host within a VLAN or segment Hover your mouse over the Insider Threats Total Bytes of 1.07T of lateral movement accounting for every packet within the network Hover your mouse over the application traffic and highlight the SQL traffic spike just before 17:00 and visibility into all applications Hover your mouse over the Host Audit table in bottom left and talk about accounting for all traffic any host has received from other internal servers and data exfiltration Hover your mouse over the Insider Threat Events in top right corner and talk about triggering events when there is Data Hoarding and Data Exfiltration Hover your mouse over the pie chart in the bottom right calling out the Top Insider Threat Click on the Insider Threat Details to flip to the next slide and start talking about details of the insider threat story
- #37: Insider Threats Dashboard is focused on “lateral movement” within the network. Server to server within the datacenter and host to host within a VLAN or segment Hover your mouse over the Alarm to talk about what each means. Hover your mouse over the Source column and discuss the source of the attack Hover your mouse over the Details and discuss the behavioral model. This will give you the value expected or policy maximum vs observed. The policy max prevents over learning to catch threats. Hover your mouse over the mitigation column to talk about how a block can be initiated to an inline device such as ASA firewall, null0 to router, and we’ve added ability to quarantine with ISE. Click on any source IP of 10.201.0.23 to proceed
- #38: Hover your mouse over the Identity, DHCP, & Host Notes and discuss details of context provided: user username, MAC address, Device Type, Switch port, and security group tag Click your mouse on the “Alarms” tab for details.
- #39: Hover your mouse over and discuss the top flow along with supporting quick view. Call out the direction of traffic and that the application is P2P file over 53/udp (common DNS port) Hover you mouse over the second flow and discuss the large SQL transfer between the terminal server and the database server Click back on the “Insider Threats” dashboard tab to demonstrate drilling into SQL traffic from the dashboard.
- #40: In summary this slide illustrates the stages of the attack. The visual on the bottom help illustrate the flows above with time tables, applications, and amount of data transferred. 2:15 PM Edward logs into terminal server 3:40 PM Edward pulls down 38 GB of data 5:12 PM Edward begins pushing the data out of the network using P2P file through DNS. With early warning the attack could have been stopped at multiple stages.
- #58: MTTK = mean time to know