Cisco Connect 2018 Philippines - security keynote
- 2. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Changing The Security Equation Stephen Dane Managing Director, Security, Asia Pacific & Japan March 2018
- 3. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Global security challenges People • Talent Crunch • High Demanded Expertise • Increased Costs Digital Disruption, Massive Scale • 50B Devices Connected by 2020 • $19T Opportunity Security Industry • Rapidly expanding number of security companies • Not interoperable • Not open Active Adversaries • Attack surface • Threat Actors • Attack Sophistication Dynamic Threat Landscape Changing Business Models Complexity and Fragmentation Shortage of Cybersecurity Experts
- 4. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Current situation and outlook ASEAN is a prime target for cyber attack... ... and the threat landscape is bound to escalate over time Rising Systemic Risk • Increasing trade and business linkages will make the region as strong as its weakest link Sustained under-investment • Diverging national priorities and different paces of digital evolution will lead to persistent under-investment Persistently porous cyber defenses • Caused by limited intelligence sharing, increasing vulnerability to Advanced Persistent Threats Larger attack surfaces leading to complexity in monitoring and response • Due to technology developments (IT/OT convergence, Multi-cloud, increased share of encrypted traffic) Policy preparedness and institutional oversight is extremely low • Lack of strategic mindset around policy and governance • Absence of a unifying framework • Significant under-investment Absence of a holistic approach by businesses • Cyber risk is seen as IT rather than business risk Nascent local cybersecurity industry together with limited buyer awareness • Fragmentation • Multi vendor/product landscape leading to operational complexity • Paucity of skilled talent Cybersecurity in ASEAN 1. Based on Market capitalization of Top 1000 listed companies across SEA in 2017 Source: A.T. Kearney interviews and analysis
- 5. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU ASEAN countries have emerged as launchpads for cyber attack either as vulnerable hotbeds or as trusted, well-connected hubs Blocked suspicious web activity by country of origin (expected ratio = 1.0) 0.83Chile 1.43Peru 1.46Panama 1.54Belize 1.20United States 2.11Canada 1.15 Venezuela 1.22Italy 0.87 France Germany Ukraine Turkey Romania 0.94 Russia 1.31 China Malaysia 1.60 Australia Indonesia Vietnam 3.52 2.84 1.07 3.88 1.47 1.00 2.77 • Malaysia and Indonesia are global hotspots for major blocked suspicious web activities—up to 3.5 times the standard ratio • Vietnam is amongst the top 5 countries from which attacks on IoT devices originated Source: A.T. Kearney research report
- 6. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU National Strategy development Legislation Governance and operational entities International cooperation Awareness Capacity building Sector – specific focus Singapore Malaysia Philippines Thailand Indonesia Vietnam Rest of ASEAN Absent Initiated / Proposed Established & Operational Level of policy preparedness across ASEAN remains low across most countries, with lack of a unifying framework Only Singapore and Malaysia have operational National strategies Progress on legislation and governance remains fairly slow Source: A.T. Kearney, Interviews, Press clippings Most regional efforts focused on Capacity Building
- 7. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Identify Identify End Point Network Content Cloud Analytics IOT SIEM Managed & Professional Security Services Protect Defect Respond Recover Share of ASEAN cyber security spend, 2017 x% Product Design & Development 70% Services 30% Vendor positioning across the security value chain Product/Product Implementation &/or Monitoring Services Technology Capability Specialist Holistic Solutions Provider Regional System Integrators & Managed Service Providers Consulting & Services Providers Product & Technology of others Product & Technology of others Focused on limited set of products they supply Fragmented vendor landscape with few holistic providers … Large number of localized MSS providers with limited regional mobility Source: Industry interviews, A.T.Kearney analysis …and several hundred small niche players Rely on others Large number of product specialists with varied capabilities Very few holistic solutions providers, perpetuating “best of breed as an industry practice” Emerging regional systems integrators facing challenges in expanding across the value chain.
- 8. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Urgent call to action across ASEAN Source: A.T. Kearney analysis Secure sustained regional commitment for cybersecurity Elevate cybersecurity on the regional policy agenda Build the next wave of cybersecurity capability Fortify the Ecosystem
- 9. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Changing the equation People Policy & Process Technology Networking Academy 20 years students across 180 countries 7.8 million students in Asia Pacific & Japan 1.26 million Security students trained globally in FY17 90,000 students in Asia Pacific & Japan 10,000and Security & Trust Organization Integrated architectural approach Engages world governments to help shape national cybersecurity policy agenda INTERPOL collaboration to share threat intelligence & best practices New era of networking security is foundational Security enables digital transformation
- 10. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Cisco’s Security architecture Security that works together Threat Intelligence – Services Endpoint CloudNetwork 4.6 Hours Reduced Time To Detection | On Average 184 Days To Detect A Breach In ASEAN
- 11. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Security capabilities integrated throughout the network Digital Network Architecture Network visibility Network Segmentation 360° visibility Real-time analysis of data and traffic to provide visibility and intelligence across the network Dynamic control Software-defined segmentation for effective and consistent policy application Comprehensive automation Integrated solutions that augment your capabilities and reduce manual processes
- 12. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Malicious binaries and encryption Increase November 2016 Attackers embrace encryption to conceal command-and-control activity 19% 12% Increase 268%70% 50% 38% Global Encrypted Web Traffic Malicious Sandbox Binaries with Encryption October 2017
- 13. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU The Cisco network with Encrypted Traffic Analytics Known malware traffic Known benign traffic Extract observable features in the data Employ machine learning techniques to build detectors Malware detected in Encrypted Traffic
- 14. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Deep Visibility Context Control Malware will get in. You must prevent what you can, but you can never prevent 100% of attacks. So what’s needed to protect against threats that get in? Securing the endpoint PC MobileLinux Mac on the endpoint
- 15. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU AMP for Endpoints Prevent Prevent attacks and block malware in real time Detect Continuously monitor to reduce time to detection Respond Accelerate investigations and remediate faster and more effectively
- 16. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU SEE Once Threat Endpoint security in action 17 AMP Cloud1 Threat Grid2 Security Intelligence Endpoint AMP for Endpoint Enforce Everywhere 3 Endpoint CloudNetwork
- 17. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Cisco AMP for Endpoints Excels in ‘The Evolving Effectiveness of Endpoint Protection Solutions’ Report AMP for Endpoints named a Leader Cisco named a Visionary for AMP for Endpoints Gartner 2018 Magic Quadrant for Endpoint Protection Platforms Gartner evaluated 12 endpoint security products, including Cisco AMP for Endpoints IDC Marketscape: Worldwide Endpoint Specialized Threat Analysis and Protection 2017 Vendor Assessment
- 18. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU It’s a multicloud world
- 19. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Modern data centers are incredibly complex Big and Fast Data Virtualization Expanded attack surface Increase in east-west traffic Hybrid Cloud Multi cloud orchestration Workload portability Zero trust model Application Architecture Continuous development | Micro Services | APIs
- 20. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Visibility “See Everything” Complete visibility of users, devices, networks, applications, workloads and processes Threat protection “Stop the Breach” Quickly detect, block, and respond to attacks before hackers can steal data or disrupt operations Segmentation “Reduce the Attack Surface” Prevent attackers from moving laterally east-west with application whitelisting and micro-segmentation Securing the data center
- 21. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Attack Continuum Before During After Security everywhere architecture 22 Branch IOTCloudData CenterEndpoint CampusEdge Web Network Analytics Advanced Malware Secure Internet Gateway UTMW W W Policy & Access Email NGFW + NGIPS Cloud Security
- 22. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU PROTECTING YOUR NETWORK
- 23. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Deeper data + more context = better security We analyze massive amounts of data — 19.7 billion threats blocked daily Our real-time datasets are diverse, global, and live 600 Billion Email samples 16 Billion Web requests 3.4 Billion AMP queries 160 Countries worldwide 100 Billion Internet requests 12,000 Enterprise customers 80 Million Daily active users
- 24. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential CISCO CONNECT 2018 . IT’S ALL YOU Why Cisco Security 5K People Strong #1 Cisco Priority Threat Researchers 250 Invested Billions Sourcefire Lancope Neohapsis OpenDNS ThreatGRID Cognitive Portcullis CloudLock Faster Finding Breaches 100x Ongoing Innovation Best of breed portfolio Integrated Threats Blocked Daily 19.7B Fortune 100 use Cisco Security 88% Security Effectiveness 99%