Now, before we start getting into some API examples later on in the skills,
I want to clear up some other information that has changed between older
versions
of what we're doing and where we're at right now.
And some of that is some of the software suite's ASISCO offers in order to be
able to perform
those better secure functions.
So let's take a look at a couple of them and see where we're at.
The first one we're taking a look at is Cisco Secured Network Analytics.
Now, this used to be known as Cisco StealthWatch and it is a security product WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, this used to be known as Cisco StealthWatch and it is a security product
that provides
comprehensive visibility and network traffic analysis.
The uses that data from various sources like routers, which is another network
device
across our organization to detect advanced threats, track network performance,
and ensure
compliance with the security policies.
It'll provide us with deep visibility into network traffic patterns and flows,
enabling
detection of malicious activities and performance issues.
So kind of a real-life, real-world dashboard of data from the actual network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So kind of a real-life, real-world dashboard of data from the actual network
device itself
to be able to tell us if we're utilizing all of our resources or if we need to
allocate
some more.
And we could use the security analytics provided to be able to give us more
detail on how
to detect and alert on unusual behavior and potential security threats at real
time.
That threat detection helps identify a wide range of security issues from
malware infections
to data exfiltration extamps by analyzing that network to limited.
So it's going into a little bit of the packet inspection and utilizing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it's going into a little bit of the packet inspection and utilizing
information we provide
as security and network administrators to be able to identify things that are
going in
and out of the network that may be needed for security reasons.
And for the forensic side of the house, we're going to have some tools for
conducting forensic
investigations into historical network activity to trace the root cause of some
of those
security incidents that may take place.
And this is really good for folks like myself who really dig into the forensic
side of the
house and hand it out. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
house and hand it out.
And we can seamlessly integrate other Cisco security products and solutions to
make sure
that the overall security posture is coordinated with proper responses to those
threats.
Next program we're going to take a look at is Cisco Secure Cloud Analytics.
Now this used to be called StealthWatchCloud.
And it's a cloud-based security service that offers visibility and threat
detection across
your cloud and on-on-premises environments.
It'll provide comprehensive visibility into user and device activity across WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It'll provide comprehensive visibility into user and device activity across
your entire
network, including those cloud environments and private networks.
So like earlier when we were talking about the private or hybrid/community
cloud, we also
do get threat detection here as well.
And we use the advanced analytics and machine learning to detect unusual
behavior and potential
security threats in real time.
So we can start developing rules that are either static or built around machine
learning,
for example AI and things like that.
To be able to kind of gather the best information we can to be able to build WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
To be able to kind of gather the best information we can to be able to build
the best rules that
we can for unusual behavior that may lead to a threat.
And this will generate security alerts based on those detected anomalies that
could indicate
a breach in other security issues.
Now this one also integrates with other Cisco products and cloud environments
to enhance
that security posture overall without requiring additional hardware.
So this can lay on top of the hardware that we already have in place and be a
little bit
more economical for us in the long run because we don't have to buy any more WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
more economical for us in the long run because we don't have to buy any more
hardware or
third-party resources.
This go cognitive intelligence.
Now this one used to be Cisco-Cognitive Threat Analytics.
It was a component of Cisco's broader security platform.
This also uses machine learning and AI to analyze that network traffic to
develop patterns
and identify abnormalities that may indicate a security threat.
This does it in a little bit more detail since we are focusing around a
solution here that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
solution here that
is more heavily involved in the machine learning and AI development of some of
those rules.
It leads into the behavioral analysis of that traffic.
So we can monitor the users and devices across network to detect unusual
activities that
could signify a security breach.
This would be done based on the abnormality behavior that our machine learning
is helping
us develop through the patterns of use on our network.
We can develop automated responses that are capable of automatically responding WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can develop automated responses that are capable of automatically responding
to those
identified threats.
So think of this in terms of developing a rule within an IPS or Intrusion
Prevention System.
The rules that we develop in there are either anomaly based or signature based.
We develop a response that goes with those rules because of IPS takes action.
Well, so does Cisco-Cognitive Intelligence.
This can help reduce the time and the resources required for manual WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This can help reduce the time and the resources required for manual
interventions.
Faster, we are able to detect something and build a rule around it for an
action that
follows detection.
The faster we're able to remediate based on that automated response.
And just like the previous two, we're able to integrate this with the other
Cisco products
to make sure that we have usability across the different platforms.
This is delivered through the cloud allowing for that scalability and ease of
deployment
across multiple networks.
So we're really focusing in on the cognitive intelligence system being able to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we're really focusing in on the cognitive intelligence system being able to
go through
and detect abnormalities developed machine learned and AI based rules for that
cloud infrastructure.
And the last one we're going to be covering is the Cisco Secure Client Network
Visibility
Module.
This would used to be called any connect network visibility module.
So if you're familiar with any of the previous names, these are the new names
that I'm presenting
to you.
And this one, NVM for short for network visibility monitor, is a feature of the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this one, NVM for short for network visibility monitor, is a feature of the
Cisco Secure
Client that provides detailed insights into network traffic from the client's
perspective.
So anything that's happening on the client side is what we're going to be
looking at specifically
because overall the previous programs were just taking a look at the overall
network as
traffic went from point eight point B. In this particular case, we're going to
be looking
at it from how the client's system sees it.
Not necessarily the user, but the actual system itself.
And this will help our organization monitor network activity for security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this will help our organization monitor network activity for security
purposes, such
as identifying that malicious traffic that may enter or exit that particular
system
that's being monitored or unauthorized applications.
So if an organization has a strict policy on organic applications that need to
be restricted
or installed or whatever the case may be, NVM can allow us to be able to go
through
and apply that same level of security that on the network side that we would WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and apply that same level of security that on the network side that we would
normally have
to configure manually through things like app locker inside of Microsoft.
We do get data collected from various network parameters such as like the
application protocol,
source and destination IPs, port numbers, and volumes of data transferred.
So this goes back to looking at what the actual client system is receiving and
transmitting
in terms of information across the network.
And by looking at these different points of data or that particular collection, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And by looking at these different points of data or that particular collection,
we're
able to develop more detailed rules based on what our norm is or floor of
traffic.
Now while this program does work with other Cisco software suites, we're
specifically
wanting to integrate this with our stealth watch and our Cisco ISE or ISE.
And this allows us to be able to develop a more detailed reporting for our
network traffic.
But because we're taking a look at the client side of the network traffic
itself, we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
itself, we're
also able to dive in a little bit more and assist those different departments
within
our organization like the help desk and troubleshooting network issues because
we can take a deep
dive into what the actual endpoint is taking a look at.
So let's say a website is blocked and we're only seeing it on one or two
systems.
The NVM software suite would allow us to be able to go through and take a look
at it from
the client's perspective and see if it's something within our own network or if
it's just something
from the actual website itself that blocks that particular system for whatever WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
from the actual website itself that blocks that particular system for whatever
reason.
Now should we go through all those security measures and we still need to be
able to implement
something a little bit different or more detailed, we can do policy enforcement
with the software
suite.
And by doing this, we're providing network policies that can be used to refine
access controls,
not just the ACLs, but also the traffic on that individual client system based
on the
policy that we have within our organization that was developed from observed WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
policy that we have within our organization that was developed from observed
traffic patterns
that were machine learned through this particular program.