How important is a reputation?
Well, for humans it's pretty important, and for a website,
we want to know if a website or an IP address or a domain
has a reputation for spam or malicious content,
and talosintelligence.com can help us determine
that before we even go there.
So here we are at talosintelligence.com
once again at their home page.
And right here, what we can do is,
we can do a reputation look up right here
on the homepage in this little slot right here,
or we can go to the Reputation Center.
So if we click on the link here on the tab, Reputation Center, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we click on the link here on the tab, Reputation Center,
it'll give us options for all of these options shown
on that page.
So let's go to that main page for Reputation Center
right now.
So here in the Reputation Center,
the first option is IP and Domain Reputation Center.
So if we click on this link right here,
IP and Domain Reputation, let's go ahead and look up
ihaveabadreputation.com.
So that site is actually built for a purpose for testing,
things like Cisco's Umbrella, which also is going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
things like Cisco's Umbrella, which also is going
to leverage from Cisco Talos and the security intelligence
it provides.
So by putting in ihaveabadreputation.com and we
scroll down a little bit, under reputation details,
it shows here as untrusted, and the threat category
is malicious sites.
Now, one of the benefits of having a URL like this
that we can test with is that if we
are a policy on our Firepower appliance
or if we have a policy on our website secure appliance
that's blocking those types of sites, if it doesn't work,
we don't get compromised or we aren't putting ourself at risk. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we don't get compromised or we aren't putting ourself at risk.
So using test URLs to test our policies is a great idea,
and this is an example of one of those, ihaveabadreputation.com.
And if we scroll down a little bit
further, it has the mail server information
and we click on Who Is and scroll down, look at that.
And there's information regarding email volume history
and top network owners as well, one convenient way
of doing reputation lookups based on a domain.
Another option that we have right here
under reputation lookup is File Reputation Lookup.
Check this out.
Let's click on File Reputation Lookup.
So Talos has a database regarding billions, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So Talos has a database regarding billions,
it is right here, billions with a B, billions of files,
and the reputation system is Fed into AMP, Firepower,
ClamAV, and open source Snort, and AMP, the Advanced Malware
Protection, is integrated into many different Cisco products
as well.
So I did a Google search on a hash for some malicious code,
and let's go ahead and paste it here.
And what it's going to do it's going to search,
and what Talos is going to do, it's going to take the SHA256#,
I'll say, I'm not a robot, and click on Search.
And it's going look for a match, and it found one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it's going look for a match, and it found one.
And so the AMP detection name is W32.TrojanRansom:WNCry,
or a variant of want to cry.
Then it identifies the associated domains
for this hash and then detection aliases
regarding that specific malicious code.
Wow.
Check it out.
So if we manually needed to do that,
we could, but the benefit of having a device like Firepower
or Umbrella that's leveraging AMP or the AMP
for Endpoints or anywhere else we want
to check for malicious content, our security devices
and appliances and software is doing this for us WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and appliances and software is doing this for us
in the background.
And the cool thing about using a security intelligence service
like Talos is that as new malicious code shows up,
that new information in near real time
can be shared with the other millions of devices
that Cisco is supporting so that all those other devices can
protect against this newly discovered threat.
So if we go back to Reputation Center once again,
we have IP domain Reputation Center, File Reputation,
which we just looked at, AMP Naming Conventions.
Here's some practice exercises for developers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Here's some practice exercises for developers.
There's also a section called Intelligence Categories,
and if we click on that, we have a section
for Content Categories.
And this really helpful if we're using a product like Umbrella
or Firepower or some other services tied
into Talos because then when a user is going
to some site, that's security appliance
can know the category of that site and then
based on our policy, permit it or deny it based on our policy.
And Threat Categories is so useful
because if we have a security appliance like the web
secure appliance or Firepower or Umbrella,
that based on a website being in one of these categories, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that based on a website being in one of these categories,
we can prevent the user from actually
getting to that site in the first place.
An ounce of prevention is worth a pound of cure.
Any time we can stop the user or the system
from getting to a malicious site,
it's a lot better to prevent that connection
than having the user go to the site
and perhaps get malicious code on their computer
and then have software locally identify that the problem
and stop it.
The sooner we can stop the attack,
the sooner we can prevent it, the better.
In this video, you reinforced the idea
that we can use security intelligence in the cloud WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we can use security intelligence in the cloud
to identify the reputation of a file, of a site, of a domain
simply by using the tools that are provided by that security
intelligence provider.
In this example we used talosintelligence.com.
so I'll see you in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.