Cisco. Алексей Лукацкий. "Внутренние угрозы. Обзор технологий противодействия"

Editor's Notes

• #3: Another thing that makes Cisco a security company like no other: We have a world class defense of our own enterprise and clouds. Visibility is Key in Catching threats BEFORE they can do harm Massive global network… under constant attack Customers care about how Cisco protects Cisco => Want to learn from us Opportunity for Sales to change the customer relationship Share Cisco on Cisco expertise Use Cisco as a showcase for how we use technology, processes, and policies to protect Cisco and our customers Leverage Cisco on Cisco in EBCs, etc. to expand sales opportunities and position Cisco as a Trusted Partner 2 days to roll out openDNS across cisco Transition from Fireeye to Threat Grid- 85% increase in incidents detected
• #4: We need to be threat­–centric, and think like an attacker. Why? You are up against a highly motivated and compensated workforce. Who are using advances in technology, changing business models and user behaviors to their advantage . The dynamic threat landscape is demanding an adapt or die strategy.   We think like you do. We have taken a threat–centric approach in creating our cybersecurity solutions to tackle your biggest issues .  
• #7: Apple + Patching = You’re Doing It Wrong http://www.tombom.co.uk/blog/?p=492
• #8: Apple + Patching = You’re Doing It Wrong http://www.tombom.co.uk/blog/?p=492
• #9: Apple + Patching = You’re Doing It Wrong http://www.tombom.co.uk/blog/?p=492
• #10: Apple + Patching = You’re Doing It Wrong http://www.tombom.co.uk/blog/?p=492
• #11: Gartner predicts by 2018, the average company will have 25% of its corporate data traffic bypassing the network perimeter. Some industries are already there or surpassed this depending on how mobile your workforce is.
• #15: Cisco ASA with FirePOWER Services addresses the full attack continuum before, during and after an attack, with a truly integrated threat defense. THE WAY WE ANALYZE THE PROBLEM IS BY LOOKING AT THE ENTIRE ATTACK CONTINUUM OF THINGS YOU MUST DO: BEFORE, DURING AND AFTER AN ATTACK TAKES PLACE. IN ORDER TO DEAL WITH THE INDUSTRIALIZED THREAT, WE NEED TO LOOK AT THESE PHASES COMPREHENSIVELY: BEFORE AN ATTACK: WE NEED TO KNOW WHAT WE ARE DEFENDING….YOU NEED TO KNOW WHATS ON YOUR NETWORK TO BE ABLE TO DEFEND IT – DEVICES / OS / SERVICES / APPLICATIONS / USERS WE NEED TO IMPLEMENT ACCESS CONTROLS, ENFORCE POLICY AND BLOCK APPLICATIONS AND OVERALL ACCESS TO ASSETS. HOWEVER POLICY AND CONTROLS ARE A SMALL PIECE OF WHAT NEEDS TO HAPPEN. THEY MAY REDUCE THE SURFACE AREA OF ATTACK, BUT THERE WILL STILL BE HOLES THAT THE BAD GUYS WILL FIND. ATTACKERS DO NOT DISCRIMINATE. THEY WILL FIND ANY GAP IN DEFENSES AND EXPLOIT IT TO ACHIEVE THEIR OBJECTIVE. DURING THE ATTACK: WE MUST HAVE THE BEST DETECTION OF THREATS THAT YOU CAN GET ONCE WE DETECT ATTACKS, WE CAN BLOCK THEM AND DEFEND OUR ENVIRONMENT AFTER THE ATTACK: INVARIABLY ATTACKS WILL BE SUCCESSFUL, AND WE NEED TO BE ABLE TO DETERMINE THE SCOPE OF THE DAMAGE, CONTAIN THE EVENT, REMEDIATE, AND BRING OPERATIONS BACK TO NORMAL YOU ALSO NEED TO ADDRESS A BROAD RANGE OF ATTACK VECTORS, WITH SOLUTIONS THAT OPERATE EVERYWHERE THE THREAT CAN MANIFEST ITSELF – ON THE NETWORK, ENDPOINT, MOBILE DEVICES, VIRTUAL ENVIRONMENTS. FINALLY, TRADITIONAL SECURITY TECHNOLOGIES ONLY OPERATE AT A POINT IN TIME. THEY HAVE ONE SHOT TO DETERMINE IF SOMETHING IS BAD OR NOT. WITH TODAY’S THREAT LANDSCAPE FULL OF ADVANCED MALWARE AND ZERO DAY ATTACKS POINT IN TIME ALONE DOES NOT WORK. WHAT IS NEEDED IS A CONTINUOUS CAPABILITY, ALWAYS WATCHING, ALWAYS ANALYZING AND CAN DETECT, CONTAIN AND REMEDIATE A THREAT REGARDLESS OF TIME.
• #20: Apple + Patching = You’re Doing It Wrong http://www.tombom.co.uk/blog/?p=492
• #32: Breached and Blind 26% One away from being fired
• #33: So Now What? We need to evolve. Evolve our thinking. Evolve our strategy.