Next up, we will talk about Cisco's anti-malware product,
which is known as Advanced Malware Protection, or AMP.
AMP is pretty interesting.
Yes, it's, again, anti-malware.
When we think about anti-malware or anti-virus software,
we're talking about trying to prevent a file that's been downloaded
from impacting a machine negatively.
But Cisco does this a little differently.
Specifically, yes, we have an endpoint solution,
But we also, and I say or here, really, it's an and,
we also have the option of deploying this into the network.
So it's almost like saying,
hey, let's deploy an antivirus into the network,
and hopefully we'll pick up on viruses that are being spread around,
and we'll be able to stop that traffic.
I mean, that's exactly what we're saying here.
Now, again, the focus is on malware less so than viruses.
Viruses are a particular category of malware, we could say.
Malware is everything from, sure, viruses,
but also we're talking about things like ransomware,
which is a big one,
and generally speaking, just software that's intended to cause problems.
So maybe even things like spying software and the like.
So we've got all kinds of different types of malware.
We want to stop it.
So how do we go about doing this?
Well, this is going to come down to, first of all,
understanding what the process is for malware getting installed,
A host is going to reach out via the internet
to some server somewhere,
and then that server is going to send the file down to that host.
Sounds pretty simple.
That's exactly how we download files.
But the reality is that this process
could be something that's perfectly good,
because I'm downloading a file off the internet
that's going to, maybe it's a template for my,
some kind of report I'm putting together,
whatever the file is,
and it could be bad, it could be malware,
but importantly, it could be unknown.
Maybe it's a file that is probably safe,
but who really knows?
I mean, we maybe haven't downloaded this file a whole lot,
and so the world doesn't know if this file is actually safe or not.
So this is sort of the three different potential options here,
and we understand that this could actually be malware.
This bad format could, or this file could be bad
So important to notice here where we play with AMP.
On the endpoint, we've got a client that's running
that's going to evaluate this file,
but then we also have the network involved,
and from an SD-WAN perspective,
that would probably be the edge.
The edge that maybe is connecting
not only our SD-WAN environment together,
but also possibly giving our host access to the internet.
And so we notice that the request goes through, sure,
but importantly, the file is going to actually come back through the edge
and be delivered to the PC.
So yes, we could, hopefully,
AMP, if it's running on the PC, would identify a bad file,
say, hey, this is a bad file,
and then it would quarantine or delete the file
and protect the PC.
But as always, wouldn't it be better
if this process didn't actually have to run?
In fact, this should be our backup plan
because really what we want to do
is this edge here would ideally also be running AMP
and basically do the exact same thing.
See, it's a bad file, and delete,
or really not delete the file,
but we'd actually stop or block the file
from even getting to the PC.
And so that, this right here,
should be plan A, or our primary plan.
So that would be the advantage of running AMP here on the edge
while also still running AMP on the PC
like we do with traditional antivirus and anti-malware software.
Now at the heart of this is going to be us asking the question
of how do we know whether a file is bad, good,
or how do we, no, there we go, good, bad, or unknown.
And when I say we, really we're talking about the edge.
How does the edge know?
Or for that matter, how does the software on the PC know?
And at the heart of this is going to be Cisco's Talos cloud.
Talos is basically one gigantic database
that's just full of information about files.
How do I identify a file?
Well, we take a look at the file and we run a hash against it.
And so every file, every copy, I should say, of a file
will have the exact same hash output
because it's a one-way math operation.
So if I can convert the file to a hash
and then go to the Talos cloud here
and check that hash and say, hey, is it good or bad or unknown?
Is it good, basically?
Well, at that point, we will hopefully get a response.
Now, we can get up to three responses.
We could see that the file is good.
We could see that the file is bad.
And we could see that the file is not known.
Look familiar?
We just set it up here.
That's exactly the three types of results we could get.
And we're looking at this Talos cloud as saying,
hey, this giant database in the sky,
whether files are good or bad.
But there's nearly countless numbers of files on the internet.
One database can't possibly know
whether every single file that's out there
is either good or bad.
So there's actually going to be a lot of unknown files.
The good news about the Talos cloud
is it is connected to everything.
And so if a file is unknown,
but then all of a sudden a PC, maybe that's running AMP,
or at least we said it was unknown,
if this file is actually bad, guess what?
It's going to report it to Talos.
And now everyone is going to get reported
or get this report saying that this file is bad.
Meaning that there was malware embedded in it,
and it triggered,
and now all of a sudden this host is infected.
But let's go ahead and advise the rest of the world
that this is not a good file.
And so that might get pushed, for example,
and this is why there's still value in running it on the PC,
because if we did allow it to be downloaded,
now AMP can actually go and declare that file bad
and delete the file before it triggers
and starts running malware on this PC.
So one of the huge benefits of the Cisco security architecture
is having this sort of centralized operation,
which can alert us to files that we thought were OK,
but now we know that they're not.
And naturally this is going to get pushed out to our edge as well,
so it can stop that file from being downloaded in the future.
Now we implied it with this conversation,
but generally speaking, if the hash is good,
then that file is going to be allowed.
If it's bad, then we know it's going to be blocked or deleted.
And if it's unknown, yes, it will be allowed.
Because again, most of the Internet files that we download
are probably going to fall into that category,
and we can't just block every single file from being downloaded
if we don't know whether it's good or not.
as part of all of this.
So when we have our edge running here
and we receive traffic
and we see that a file is coming in from the Internet
and it's going to be sent to a PC,
we want to check out this file.
So let's go ahead and go through the AMP processes here
to really understand what ends up happening.
So first of all, like we said, we're going to compute a hash,
whether it fits into one of these categories.
Now, we've been using good, bad, and unknown.
That's really not the technical terms for it.
Cisco prefers to use the terms clean, malicious,
and then still unknown.
So this is going to be the technical result
when we take a look at that hash.
Now again, clean and unknown are going to be passed
while malicious will be blocked.
But the other thing that the unknown result can provide for us
is we can actually take that file then
and send it to another Cisco product known as Threat Grid.
This is interesting.
Threat Grid is basically a sandbox environment,
and Cisco's Threat Grid sandbox
is basically going to take that file
and it's going to attempt to trigger it.
It's going to try to make it, if it does have malware,
trigger and do its thing in a sandbox environment,
which keeps the rest of the world safe,
or the rest of our network safe at least.
And so if a PC has this unknown file
and eventually Threat Grid is actually able to trigger it,
well, all of a sudden, we go back to this situation
and we say, hey, again, number one,
the network needs to be aware,
but number two, this PC needs to quarantine that file immediately.
Now, this is a separate paid product from Cisco,
so be aware of that.
But at the same time, that might be something worth exploring
if we want to make sure that we're doing everything we can
to protect our users from these malicious files.
Now, just to wrap this up, we'll bring this back to SD-WAN.
First of all, we know that our edges are capable of running AMP.
That's a big part of this integration.
Second of all, we need to configure which VPNs will be running AMP.
We don't necessarily have to deploy this to all VPNs,
but we do have to configure that and determine that.
We can pick which cloud region we're going to run in,
and then, again, we can tie into Threat Grid,
Threat Grid, if that's a product that we have.
Lastly, and very importantly,
we talked about that Unified Threat Defense, or UTD, file.
That is going to be the starting point here for our edges
to be able to figure out whether or not these files are clean,
malicious, or unknown.
So this UTD file contains signatures, as we talked about.
It's used for the IPS functionality, and it's used for AMP as well.
So if we decide to deploy AMP into our environment,
we are going to need that UTD file.
And, again, as we talked about before,
it's going to get uploaded via manager,
and then manager will push that down to the edges.