Accelerating Incident Response with Cisco's Integrated Security Platform
•
1 j'aime•78 vues
Cisco Connect Halifax 2018 Accelerating incident response in organizations of any size
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Accelerating Incident Response with Cisco's Integrated Security Platform
Similaire à Accelerating Incident Response with Cisco's Integrated Security Platform (20)
Plus de Cisco Canada
Plus de Cisco Canada (20)
Dernier
Dernier (20)
Accelerating Incident Response with Cisco's Integrated Security Platform
- 1. © 2016 Cisco and/or its affiliates. All rights reserved. 1 Cisco Connect Accelerating Incident Response in organizations of Any Size April, 2018 Jean-Paul Kerouanton Advanced Threat Solution CSE
- 2. 2© 2016 Cisco and/or its affiliates. All rights reserved. 9:36AM
- 3. 3© 2016 Cisco and/or its affiliates. All rights reserved. How does your current security infrastructure help you respond to incidents?
- 4. 4© 2016 Cisco and/or its affiliates. All rights reserved. ANTIVIRUS ANTIVIRUS Vendors pumping out update after update after update after update… Firewall Web filter Email filter ANTIVIRUS SERVER consoles pumping out alert after alert after alert after alert… ! ! ! !
- 5. 5© 2016 Cisco and/or its affiliates. All rights reserved. Typical Incident Response workflow
- 6. 6© 2016 Cisco and/or its affiliates. All rights reserved. INVESTIGATE INCIDENTS RECOVER IMPROVE DEFENSE REDUCE THE ATTACK SURFACE ALERTS SECURITY ARCHITECTURE BLOCK
- 7. 7© 2016 Cisco and/or its affiliates. All rights reserved. What we will show today
- 8. 8© 2016 Cisco and/or its affiliates. All rights reserved.
- 9. 9© 2016 Cisco and/or its affiliates. All rights reserved. Email Security ThreatGrid Umbrella SIG Cisco ISE NextGen Firewall Email Security AMP for Endpoints AMP AMP AMP AMP Cisco ISE Umbrella Investigate AMP AMP CISCO TALOS
- 10. 10© 2016 Cisco and/or its affiliates. All rights reserved. Cisco ISE NextGen Firewall Cisco ISE Email Security AMP for Endpoints Cisco ISE Cisco ISE ThreatGrid Umbrella SIG Cisco ISE NextGen Firewall Email Security AMP for Endpoints CISCO TALOS AMP AMP AMP AMP Umbrella Investigate AMP AMP 30+ day recorded history = accelerated IR Continuous analysis of that recorded history = automated hunting
- 11. 11© 2016 Cisco and/or its affiliates. All rights reserved. EMAIL WEB FIREWALL MERAKI UMBRELLA THREATGRID Blocking AMP AMP COGNITIVE THREAT ANALYTICS Endpoint
- 12. 12© 2016 Cisco and/or its affiliates. All rights reserved. Today’s IR scenarios
- 13. 13© 2016 Cisco and/or its affiliates. All rights reserved. Want to try it out yourself?