Cisco decided to get into the malware protection game with AMP. AMP stands for
Advanced Malware Protection and we have a product called AMP for endpoints and
it's usually abbreviated as AMP with the number four in here and then the
letter E which feels a little bit goofy for an enterprise solution but at the
same time it is what it is. So this is known as Advanced Malware Protection for
endpoints and it has been revamped in the modern network we or modern portfolio WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
endpoints and it has been revamped in the modern network we or modern portfolio
.
Cisco likes to refer to this as secure endpoint. So maybe they also decided
that it didn't sound like a solution necessarily for enterprise networks. I
have no idea but secure endpoint certainly gets the point across. What
we're trying to accomplish here is we're trying to secure our endpoints. So
remember what we just said. Attackers who are out on the internet have a
connection to pretty much every network on the planet because everybody has an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
connection to pretty much every network on the planet because everybody has an
internet connection. Fortunately for us on the good guy side over here we have
this product called a firewall and it is very hard for attackers to get through
the firewall. Most of their attacks are stopped and halted by the firewalls and
again the firewalls are still required because a lot of automated bots and
systems are constantly trying to get through firewalls just in case there is
a hole there so it's required and yet these threat actors know that they're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a hole there so it's required and yet these threat actors know that they're
probably not going to get through the firewall. Well it would be wonderful if
we could all just raise a hearty cheer and say congratulations hey we did it we
kept the bad guys out but they have gotten more clever and they have found
other ways to get into our network because what they find and what we have
in the consulting world what we find as well is that a lot of our networks have
this hard exterior this wonderful shield that's protecting them from the evils WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this hard exterior this wonderful shield that's protecting them from the evils
of the internet meanwhile this is just a chewy center with almost no security
mechanisms being deployed which made sense a long time ago because we look at
a user laptop and say hey guess what I trust you you are a good user I've
hired you you don't want to lose your job you're probably not going to go hack
my systems and hopefully you won't and so we don't have a lot of security
between our trusted platforms here and our servers maybe this is a database WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
between our trusted platforms here and our servers maybe this is a database
server with a bunch of private information and it's connected through the
same network that the user that we trust is also on well if we don't have any
security then that's a problem if that trust gets violated and potentially not
even by the actual user because sometimes the actual user here is a good
person and they want to abide by the rules but they don't really know what WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
person and they want to abide by the rules but they don't really know what
they're doing and they click something that enables the threat actor to take
over their machine so now the threat actor effectively has control of this
machine and they can use this internal network to attack the database server
or again attack a file server or all these types of resources that usually
reside in our data center but they might be floating around the network in
other
places so here's the question and this is where AMP for endpoints is going to
come into play here how exactly does this threat actor get onto this otherwise WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
come into play here how exactly does this threat actor get onto this otherwise
trusted machine well there's a lot of ways of doing this but the main way that
they get away with it is with this concept of malware now we talk about
viruses and we talk about worms and we talk about all kinds of malicious
software malware this English word within a word concept mail simply means
bad and where is the other side of software and so we call it malware WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
bad and where is the other side of software and so we call it malware
because it's software that's intended for bad purposes but here's the thing
where viruses and worms and all of these other types of bad software packages
usually have the purpose of causing disruption and destruction malware can
actually be quite silent in a lot of cases because the purpose of malware
varies greatly but in a lot of cases like we said this can actually just
create a launch point for our attacker so now our attackers have command of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
create a launch point for our attacker so now our attackers have command of
this
machine and they're using that malware to send attacks to these other internal
devices without them ever having to break through the firewall and that's from
their perspective the beauty of malware and all I have to do is get this user
here to get the malware installed on their machine in some capacity and a lot
of the conversation in this skill is about how we prevent this malware from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of the conversation in this skill is about how we prevent this malware from
getting onto our machines for example we want to prevent email phishing
campaigns we want to prevent the old USB trick where you know you I leave a USB
stick out in the parking lot or in the main office area and people grab it
plug it into their machines the USB is loaded with malware and so now I can
put the malware onto the machine just by them plugging it in those kinds of
things happen but a lot of it is simply just sending a link via email or via
social media or anything any other ways that we can compromise it and just get WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
social media or anything any other ways that we can compromise it and just get
that malware installed and so now I've got this launch point for performing an
attack and usually I either again want to steal a bunch of personal information
credit card data all of these things social security numbers addresses phone
numbers all of these different components that make up our personal
information can be stolen and then sold on the dark web for real money or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
information can be stolen and then sold on the dark web for real money or
potentially if the threat actors part of a more advanced organization they
might
want to deploy ransomware and this is a very dangerous type of malware so
ransomware the concept here is that we've got this data usually in some kind of
data store on the network a file server or storage array and all of our users
are happily accessing the storage well then one day the threat actor comes WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are happily accessing the storage well then one day the threat actor comes
along
and encrypts it effectively locking up that's a cage by the way locking up our
data and there's a key the decryption key on a lock that would open that data
back up so they've encrypted our files and now now our users are very sad
because
they can't access it or maybe they're happy because they get to go home from
work early I don't know but I can tell you that our business owners are very WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
work early I don't know but I can tell you that our business owners are very
unhappy because the threat actors are suggesting that hey I'll give you the
key if you give me a bunch of money and paying the ransom is something that a
lot of companies have had to do and with some amount of success they get their
files back sometimes they don't and so we want to prevent ransomware from
getting installed onto our network so all of this says or suggests that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
getting installed onto our network so all of this says or suggests that we
want to prevent malware from getting installed now here's the problem malware
can be very very tricky and even the most advanced systems like Cisco's AMP or
secure endpoint can't always know when a malware is floating around on the
network and the reason for that is because malware can be silent for a long
time it can look like a very innocent file and there's nothing wrong with it
and then because either the threat actors send a signal to it or because WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then because either the threat actors send a signal to it or because
it's on a schedule one way or another boom it triggers and it goes and it does
the thing that it's designed to do so we have to be able to prevent it but also
ideally try to detect it so this is where that Talos conversation comes into
play the Talos cloud is going to bring in data from all over the world this is
a massive massive operation and so we're going to track every file on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a massive massive operation and so we're going to track every file on the
planet
earth yeah did you just process what I just said we're going to track every
file on the planet earth this is a massive operation but here's the thing
about it every file can be reduced down to a hash so I don't have to it's not
just based on the name of the file it's really what comprises the file I hash a
file every copy of that file on the planet it's going to have the same hash
and this file gets categorized as either a known good file meaning hey we don't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and this file gets categorized as either a known good file meaning hey we don't
to worry about this file this is good we trust this file usually a file from a
reputable company or something like that or hey this is a known bad file so
yeah
you just downloaded this file up here you you click to download which is kind
of a really bad idea to to do here we downloaded a file but I know that this
is a known bad file and so if AMP is running on that machine then we can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is a known bad file and so if AMP is running on that machine then we can
immediately quarantine that file but the vast majority of files are going to be
in an unknown state because I can create a text file right now and the Talos
cloud will find out about that text file and okay we don't know if that's good
or
bad we're just going to call it unknown and so plenty of files stay in this
unknown state until the day that it triggers for some reason and then we can
move it into a known bad so this can be a moving target but now we start to see WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
move it into a known bad so this can be a moving target but now we start to see
how the architecture comes together because I have a laptop and let's say
I'm running AMP for endpoints here which again is also known as secure end
point this is a software package that runs here on my laptop on my desktop on
my tablets this is an endpoint type of software and secure endpoint so if I
deploy this and I'm running this then when I do download that file AMP for end WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
deploy this and I'm running this then when I do download that file AMP for end
points or secure endpoints keep on both I guess is going to be sharing this
information with Talos and Talos is going to compare it take that hash look
and see what it knows about it again most of these will be in an unknown state
but if it's known bad from the beginning this is the one of the primary
concerns
right I just downloaded actual malware then we can prevent that quarantine the
file delete it whatever it is we need to do but second if it's in an unknown WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
file delete it whatever it is we need to do but second if it's in an unknown
state then it's going to track that file so this unknown file we'll call this
unknown one and then we've got unknown two so we've got a bunch of unknown
files
two three four and so we've got a bunch of these on the system here and then
one
day Talos says hey remember that file number two this is bad well AMP for end
points can go and look at this and say hey we still got this file in our system WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
points can go and look at this and say hey we still got this file in our system
let's make sure that we quarantine and delete it so maybe it did detonate or
went off or whatever was triggered on somebody else's network which told
Talos hey this is a bad file and we need to go prevent that so it can greatly
reduce the spread of malware throughout the internet because as soon as it's
detected somewhere is being bad we don't have to worry about it already
infecting thousands of locations because if we're all running Talos and
specifically
we've got AMP for end points running on our end points then that will hopefully WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we've got AMP for end points running on our end points then that will hopefully
help us to be able to lock in and secure that endpoint so long story short here
AMP for end points is an anti malware software package that's intended to keep
us from ideally downloading malware known malware but also even tracking the
unknown files and thanks to the Talos cloud we can hopefully isolate and delete
those files later on if indeed they're found to be bad