SlideShare a Scribd company logo

NetFlow Monitoring for Cyber Threat Defense

Cisco Canada, profile picture
Cisco Canada

The document discusses netflow monitoring as a strategic approach for cyber threat defense, highlighting the evolution of cyber conflict and the importance of visibility in security architecture. It presents various netflow deployment architectures, configuration best practices, and tools for effective flow data collection and analysis. Additionally, it addresses common myths about netflow and emphasizes the importance of context in monitoring activities within network environments.

TechnologyEducation
1 of 89
Downloaded 172 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
NetFlow Monitoring for Cyber Threat Defense
NetFlow Monitoring for Cyber Threat Defense T-SEC-10-I Matthew Robertson Security Technical Marketing Engineer
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public 3 “The whole art of war consists of guessing at what is on the other side of the hill.” Arthur Wellesley, 1st Duke of Wellington
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Defending against Humans 4 http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Evolution of Cyber Conflict War Dialing, Phone Phreaking … Manual Attacks (1980s) Viruses, Worms … Mechanized Attacks (1988) Google, RSA … Talented Human / Mechanized Attackers (2009) Cyrptocurrency Ransoms, Store-bought Credentials ... DIY Human / Mechanized Attackers (2011) Intelligence Driven Human Defenders 5 Manual Defenses Unplug Mechanized Defenses Firewall, IDS/IPS Targeted Human/Mechanized DefendersReputation, App-aware FirewallAPT, Multi-Step Attacks… Target, Neiman Marcus …
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 6 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Working with NetFlow Flow ExportAdding Context Summary Organizing the data Running Queries and Investigations Flow Collection
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public About this session 7 https://learningnetwork.cisco.com/community/certifications/s ecurity/cybersecurity/scyber_exam http://www.cisco.com/go/securedatacenter http://www.cisco.com/go/threatdefense
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public About the Speaker Matthew Robertson  Security Technical Marketing Engineer  ½ year at Lancope  5½ years at Cisco – Development and Technical Marketing  Focused on advanced threat detection  Author of 2 CVD’s  I am Canadian! 8
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Thinking beyond the perimeter 9 Once the walls are built monitor for security visibility
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Signals Intelligence 10 Traffic Analysis: • Deduce information from communication patterns
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow 11 10.2.2.2 port 1024 10.1.1.1 port 80 eth0/1 eth0/2 Start Time Interfac e Src IP Src Port Dest IP Dest Port Proto Pkts Sent Bytes Sent TCP Flags 10:20:12.221 eth0/1 10.2.2.2 1024 10.1.1.1 80 TCP 5 1025 SYN,ACK,PSH 10:20:12.871 eth0/2 10.1.1.1 80 10.2.2.2 1024 TCP 17 28712 SYN,ACK,FIN Start Time Interfac e Src IP Src Port Dest IP Dest Port Proto Pkts Sent Bytes Sent TCP Flags 10:20:12.221 eth0/1 10.2.2.2 1024 10.1.1.1 80 TCP 5 1025 SYN,ACK,PSH
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow = Visibility Router# show flow monitor CYBER-MONITOR cache … IPV4 SOURCE ADDRESS: 192.168.100.100 IPV4 DESTINATION ADDRESS: 192.168.20.6 TRNS SOURCE PORT: 47321 TRNS DESTINATION PORT: 443 INTERFACE INPUT: Gi0/0/0 IP TOS: 0x00 IP PROTOCOL: 6 ipv4 next hop address: 192.168.20.6 tcp flags: 0x1A interface output: Gi0/1.20 counter bytes: 1482 counter packets: 23 timestamp first: 12:33:53.358 timestamp last: 12:33:53.370 ip dscp: 0x00 ip ttl min: 127 ip ttl max: 127 application name: nbar secure-http … A single NetFlow Record provides a wealth of information 12
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 13 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Flow Export
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment Architecture 14 Management/Reporting Layer: • Run queries on flow data • Centralize management and reporting Flow Collection Layer: • Collection, storage and analysis of flow records Flow Exporting Layer: • Enables telemetry export • As close to the traffic source as possible NetFlow
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Considerations: Flow Exporting Layer 15 1. NetFlow support 2. Which version of NetFlow to use 3. How to configure/what to measure 4. Where in the network to enable NetFlow export
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Cisco NetFlow Support Cisco 2900 Cisco 7200 VXR Cisco Nexus 7000 Cisco XR 12000 Cisco 2800 Cisco 7600 Cisco 1700 Cisco Catalyst 6500 Cisco 3560/3750-X/3850 Cisco ASR Cisco ASA Cisco ISR G2 Hardware Supported Cisco Catalyst 4500 Cisco NGA 16 Cisco Nexus 1000v
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Versions of NetFlow Version Major Advantage Limits/Weaknesses V5 Defines 18 exported fields Simple and compact format Most commonly used format IPv4 only Fixed fields, fixed length fields only Single flow cache V9 Template-based IPv6 flows transported in IPv4 packets MPLS and BGP nexthop supported Defines 104 fields, including L2 fields Reports flow direction IPv6 flows transported in IPv4 packets Fixed length fields only Uses more memory Slower performance Single flow cache Flexible NetFlow (FNF) Template-based flow format (built on V9 protocol) Supports flow monitors (discrete caches) Supports selectable key fields and IPv6 Supports NBAR data fields Less common Requires more sophisticated platform to produce Requires more sophisticated system to consume IP Flow Information Export (IPFIX) AKA NetFlow V10 Standardised – RFC 5101, 5102, 6313 Supports variable length fields, NBAR2 Can export flows via IPv4 and IPv6 packets Even less common Only supported on a few Cisco platforms NSEL (ASA only) Built on NetFlow v9 protocol State-based flow logging (context) Pre and Post NAT reporting Missing many standard fields Limited support by collectors 17
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public How do I want to cache information Which interface do I want to monitor? What data do I want to meter? Router(config)# flow record my-record Router(config-flow-record)# match ipv4 destination address Router(config-flow-record)# match ipv4 source address Router(config-flow-record)# collect counter bytes Where do I want my data sent? Router(config)# flow exporter my-exporter Router(config-flow-exporter)# destination 1.1.1.1 Router(config)# flow monitor my-monitor Router(config-flow-monitor)# exporter my-exporter Router(config-flow-monitor)# record my-record Router(config)# interface s3/0 Router(config-if)# ip flow monitor my-monitor input 1. Configure the Exporter 2. Configure the Flow Record 3. Configure the Flow Monitor 4. Apply to an Interface Configuring Flexible NetFlow 18 Best Practice: include all v5 fields
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment 19 Access Catalyst® 3560/3750-X Catalyst® 4500 Catalyst® 6500 Distribution & Core Catalyst® 4500 ASA ISR Edge ASR Each network layer offers unique NetFlow capabilities
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment 20 Access Catalyst® 3560/3750-X Catalyst® 4500 Access: • New network edge • Detect threats as the enter the network • Detect threats inside the switch • east-west • Layer 2 traffic • Fewer false positives • Higher-granular visibility • Identify the endpoint • collect MAC Address
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Catalyst 3650-X,3750-X Flow Record 21 ! flow record CYBER_3KX_FLOW_RECORD
 match datalink mac source- address match datalink mac destination-address match datalink mac source-vlan-id match ipv4 tos match ipv4 ttl match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port
 collect interface input snmp
 collect interface output snmp
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first collect timestamp sys-uptime last !
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Catalyst 4500 Flow Record 22 ! flow record CYBER_4K_FLOW_RECORD match ipv4 tos match ipv4 protocol match ipv4 source address
 match ipv4 destination address match transport source-port match transport destination-port collect ipv4 dscp collect ipv4 ttl minimum collect ipv4 ttl maximum collect transport tcp flags collect interface output collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last !
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment - Converged Access 23 Converged Access: • NetFlow for the first time on Wireless • Visibility in BYOD environments • Consistent configuration for wired and wireless • Single flow monitor can be applied to wired ports and SSID • Natively available in the UADP ASIC • Can monitor East-West and North-South flows • 48k flows on the 48 port model
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment 24 Catalyst® 6500 Distribution & Core Catalyst® 4500 Distribution & Core: • Traditional deployment • Minimal recommended deployment • Enable at critical points/bottle necks • Typically done on a Layer 3 boundary • Detect threats internal to the VLAN • When deployed on an SVI interface • Detect threats as they traverse the internal network • Move between subnets
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Catalyst 6500 (Sup 2T) Flow Record 25 ! flow record CYBER_6K_FLOW_RECORD match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input collect transport tcp flags collect interface output collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last !
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment 26 ASA ISR Edge ASR Edge: • Detect threats as they enter and leave the network • Monitor communication between branches • Gain context from edge devices • Application - NBAR • Events & User-ID - NSEL
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public ISR Flow Record 27 !
flow record CYBER_ISR_RECORD match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input collect routing next-hop address ipv4 collect ipv4 dscp collect ipv4 ttl minimum collect ipv4 ttl maximum collect transport tcp flags collect interface output collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last collect application name ! Enable NBAR
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public ASA NSEL Configuration 28 ! flow-export destination management <ip-address> 2055 ! policy-map global_policy class class-default flow-export event-type all destination <ip-address> ! flow-export template timeout-rate 2 logging flow-export syslogs disable !
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Monitor Configuration 29 ! flow monitor CYBER_MONITOR
 record CYBER_RECORD exporter CYBER_EXPORTER cache timeout active 60 cache timeout inactive 15 ! Active Timeout: • Longest amount of time a flow can be in cache without exporting a Flow Record • Recommended 60 seconds • All exporters should have the same timeout Inactive Timeout: • How long a flow can be inactive before being removed from cache • Recommended 15 seconds • All exporters should have the same timeout
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Aside: Myths about NetFlow Generation 30 Myth #1: NetFlow impacts performance • Hardware implemented NetFlow has no performance impact • Software implementation is typically significantly <15% processing overhead Myth #2: NetFlow has bandwidth overhead • NetFlow is a summary protocol • Traffic overhead is typically significantly <1% of total traffic per exporting device
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 31 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Flow ExportFlow Collection
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Collection Considerations 32 Flow Handling • De-duplication • Stitching • Replication Scalability & Performance • # of NetFlow sources • # of users • Flows per second • Sustained vs. burst Your time, resources and budget Feature set • Reporting • Drill down • Retention • Analysis NetFlow NetFlow NetFlow
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Components for NetFlow Security Monitoring 33 Cisco Network StealthWatch FlowReplicator • UDP Packet copier • Forward to multiple collection systems NetFlow StealthWatch FlowSensor • Generate NetFlow data StealthWatch FlowSensor VE • Virtual environment • Visibility into ESX StealthWatch FlowCollector • Collect and analyze • Up to 2000 sources • Up to sustained 120,000 fps StealthWatch Management Console • Management and reporting • Up to 25 FlowCollectors • Up 3 million fps globally Best Practice: Centralize collection globally
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Collection: Flow Stitching 34 10.2.2.2 port 1024 10.1.1.1 port 80 eth0/1 eth0/2 Start Time Interface Src IP Src Port Dest IP Dest Port Proto Pkts Sent Bytes Sent 10:20:12.221 eth0/1 10.2.2.2 1024 10.1.1.1 80 TCP 5 1025 10:20:12.871 eth0/2 10.1.1.1 80 10.2.2.2 1024 TCP 17 28712 Start Time Client IP Client Port Server IP Server Port Proto Client Bytes Client Pkts Server Bytes Server Pkts Interfaces 10:20:12.221 10.2.2.2 1024 10.1.1.1 80 TCP 1025 5 28712 17 eth0/1 eth0/2 Uni-directional flow records Bi-directional: • Conversation flow record • Allows easy visualization and analysis
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Collection: De-duplication 35 Router A Router B Router C Router A: 10.2.2.2:1024 -> 10.1.1.1:80 Router B: 10.2.2.2:1024 -> 10.1.1.1:80 Router C: 10.1.1.1:80 -> 10.2.2.2:1024 • Without de-duplication: • Traffic volume can be misreported • False positive would occur • Allows for the efficient storage of flow data • Necessary for accurate host-level reporting • Does not discard data 10.2.2.2 port 1024 10.1.1.1 port 80 Duplicates
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Conversational Flow Record 36 Who WhoWhat More Details When How
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Integrating with a SIEM 37 Log alarms and summary info to SIEM • Complete visibility throughout network • Leverage specialty data handling NetFlowSyslog SDEE SIEM Security Events API API’s to access database • Directly access flow data (ex. getFlows) • Improved scale - collection and retention • Decreased cost
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 38 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Flow ExportAdding Context Flow Collection
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Context is Critical 39
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public ISE as a Telemetry Source 40 Monitor Mode • Open Mode, Multi-Auth • Unobstructed Access • No impact on productivity • Profiling, posture assessment • Gain Visibility Authenticated Session Table Cisco ISE • Maintain historical session table • Correlate NetFlow to username • Build User-centric reports StealthWatch Management Console syslog
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Configuration: Logging on ISE 41 1. Create Remote Logging Target on ISE 2. Add Target to Logging Categories 1 2 Required Logging categories: • AAA Audit • RADIUS Accounting • Profiler • Administrative and Operational Audit
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Configuration: Add ISE to SMC 42 3 3 4. Add additional ISE nodes 1. (Not Shown) Create Admin User on ISE 2. (Not Shown) Configure ISE or CA certificate on SMC 3. (Shown) Add Cisco ISE to SMC Configuration 4. (Shown) Add additional ISE nodes
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Global Intelligence 43 List of known Command and Control Servers
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Adding Situational Awareness 44 Client Host Client Host Group Server Host Server Host Groups Application Duratio n Total Traffic Start Active Time 10.201.3.149 Sales and Marketing, End User Devices 89.108.67.143 Russian Federation HTTP 23s 256.56K Jan 11, 2014
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Adding Situational Awareness 45 Client User Name Client Host Client Host Group Server Host Server Host Groups Application Duratio n Total Traffic Start Active Time Ken 10.201.3.14 9 Sales and Marketing, End User Devices 89.108.67.143 Russian Federation, Zeus HTTP 23s 256.56K Jan 11, 2014
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 46 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Working with NetFlow Flow ExportAdding Context Organizing the data Running Queries and Investigations Flow Collection
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Behavioural Analysis & Anomaly Detection 47 Behavioural Analysis: • Leverages knowledge of known bad behaviour Anomaly Detection: • Identify a change from “normal”
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public StealthWatch: Indices 48 Concern Index: Track hosts that appear to compromising network integrity Target Index: Track hosts that appear to be victims of the suspicious behaviour of other hosts File Sharing Index: Tracks behaviour that is indicative of peer-to-peer activity
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public StealthWatch: Alarms 49 Alarms • Indicate significant behaviour changes and policy violations • Known and unknown attacks generate alarms • Activity that falls outside the baseline, acceptable behaviour or established policies
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups 50 Virtual container of multiple IP Addresses/ranges that have similar attributes Lab servers Best Practice: classify all known IP Addresses in one or more host groups
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Policy Tuning 51 Policies can be created for individual host groups Tune alarm thresholds Default policy for Inside and Outside hosts
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Query Basics – The Flow Table 52 Filter Filter conditions Details More details
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Query Basics - Filtering 53 Select host to investigate All flows in which this host was a client or server
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Query Basics - Filtering 54 All flows for 10.10.200.79 in the last hour
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Table: Visibility across NAT 55 Inside local Outside global Server User
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Querying Events - Leveraging NSEL 56 Flow denied events over many ports
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Table – IPv6 57
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Targeted Monitoring 58 Suspiciously behaving hosts Alarms Host Group Dashboard for Engineers
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Application Report 59 Applications outbound Applications inbound
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Targeted Reporting 60 Geo-IP-based Host Group Summary chart of traffic inbound and outbound from this Host Group
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Targeted Reporting 61 Traffic inbound Traffic outbound
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Discovering Rogue Hosts 62 Catch All: All unclassified RFC1918 addresses Table of all individual hosts
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Discovering Rogue Hosts 63 Rogue Hosts
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Indicator of Compromise 64 Raw flow analysis Log analysis (SIEM) IDS Alert Outside notification Behavioural analysis Activity monitoring an artifact observed on a network or in operating system that with high confidence indicates a computer intrusion • http://en.wikipedia.org/wiki/Indicator_of_compromise
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public 65 Attack Lifecycle Model Exploratory Actions Footprint Expansion Execution Theft Disruption Staging Initial Compromise Initial Recon Infiltration (C&C)
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public 66 Attack Lifecycle Model Exploratory Actions Footprint Expansion Execution Theft Disruption Staging Initial Compromise Initial Recon Infiltration (C&C) IOC Found: Investigate forwards and backward
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Concept: OODA Loop 67 Observe Orient Decide Act Feedback Feedback • Unfolding circumstances • Implicit guidance • Outside information • Unfolding interaction with environment • Cultural Traditions • Genetic Heritage • Analysis & Synthesis • New information • Previous Experiences Unfolding interaction with environment http://en.wikipedia.org/wiki/OODA_loop
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Identifying the Culprit Indicator of Compromise Is a worm indicated? • Alarm • Alarm Table • Alarm Summary • IDS Alert • Other Host IP Address Worm Tracker Yes Host Snapshot Supplemental Information: • Most recent flows/Active flows • Traffic volume/type • Other Alarms • Exporter interfaces • Activity – scanning? • Thresholds • Touches Identity: • Username • Device type and OS • Access location • Organization/Geo • Role – Client or Server • Hosts affected • Host Groups Affected • Subnets Affected • Ports Used • Protocols Used Is the behaviour normal or permissible? Tune Yes Respond No No 68
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Responding to an IOC 69 Create a Host Group for BlackPOS Servers IOC: Crowdstrike publishes list of IP addresses identified as BlackPOS servers IP Addresses
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public BlackPOS – Host Locking Violation Alarm 70 Create a Host Lock Violation Alarm for communication to BlackPOS servers Set client hosts to POS terminals Set server hosts to BlackPOS Servers Alarm on FTP traffic Trigger alarm on unsuccessful connections
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public BlackPOS - Investigate You know today what you didn’t know yesterday 71 Run a Flow Query Over the last 90 days Server or client includes the known bad BlackPOS IP Addresses Configure application to be FTP
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public BlackPOS – Returned Flows 72 Infected hosts BlackPOS Servers FTP Transfers
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Investigating Malware Spread: Worm Tracker 73 IOC: IDS Alert indicating a known worm operating inside your network Worm tracker Initial infection Secondary infections Subnets being scanned
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Investigating Malware Spread: Host Snapshot 74 Everything the system knows about 10.10.200.59 Start with CI Events. We notice significant scanning activity
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Investigating Malware Spread: Identity 75 Telemetry from the ISE Username Infected machine
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Investigating Malware Spread: Touched Hosts 76 This infected host has established a connection with another host
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Investigating Malware Spread: Touched Hosts 77 All hosts touched by 10.10.200.59
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public High Concern Index 78 Baseline deviated by 2,432%!
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public What was this Host up to? 79 Target – entire subnet? Scanning on TCP-445
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow and (D)DoS Detection 80 Identify targets • Target of suspicious activity • Abnormal traffic volume • Decrease in performance Identify attackers
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Volumetric DDoS 81 Traffic Spikes
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Identifying a DDoS Participant 82 IOC: Notification from 3rd party that your IP Address is participating in a DDoS Public IP address Target server Time of reported attack
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Identifying a DDoS Participant 83 Time of reported attack Inside local Outside global Target Server Validate attack activity User
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Identify a DDoS Participant 84 Host snapshot Other suspicious activity
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 85 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Working with NetFlow Flow ExportAdding Context Summary Organising the data Running Queries and Investigations Flow Collection
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Links and Recommended Reading More about the Cisco Cyber Threat Defense Solution: http://www.cisco.com/go/threatdefense http://www.lancope.com 86 Recommended Reading Cyber Threat Defense Cisco Validated Design Guide: http://www.cisco.com/en/US/solutions/collateral/ns1015/ns1238/cyber_threat_defense_design_guide.pdf Cyber Threat Defense Cisco Validated Design Guide: http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/ctd-first-look-design-guide.pdf Securing Cisco Networks with Threat Detection and Analysis (SCYBER) https://learningnetwork.cisco.com/community/certifications/security/cybersecurity/scyber_exam
Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Key Takeaways 87 Modern threats are consistently bypassing the security perimeter Threat Detection requires visibility and context into network traffic NetFlow and the Lancope StealthWatch System provide actionable security intelligence
Q & A
NetFlow Monitoring for Cyber Threat Defense

More Related Content

PPTX
Network Traffic Search using Apache HBase
Evans Ye
 
PPT
Netflow slides
Jose Manuel Vega Monroy
 
PPTX
How to Configure NetFlow v5 & v9 on Cisco Routers
SolarWinds
 
PDF
Implementing BGP Flowspec at IP transit network
Pavel Odintsov
 
PPTX
BGP Flowspec (RFC5575) Case study and Discussion
APNIC
 
PDF
Taking Security Groups to Ludicrous Speed with OVS (OpenStack Summit 2015)
Thomas Graf
 
PDF
Short Introduction to IPv6
Martin Schütte
 
PDF
IPsec Basics: AH and ESP Explained
Andriy Berestovskyy
 
Network Traffic Search using Apache HBase
Evans Ye
 
Netflow slides
Jose Manuel Vega Monroy
 
How to Configure NetFlow v5 & v9 on Cisco Routers
SolarWinds
 
Implementing BGP Flowspec at IP transit network
Pavel Odintsov
 
BGP Flowspec (RFC5575) Case study and Discussion
APNIC
 
Taking Security Groups to Ludicrous Speed with OVS (OpenStack Summit 2015)
Thomas Graf
 
Short Introduction to IPv6
Martin Schütte
 
IPsec Basics: AH and ESP Explained
Andriy Berestovskyy
 

What's hot (20)

PDF
NetBSD syslogd with IETF Syslog Protocols
Martin Schütte
 
PDF
The IPv6 Snort Plugin (at DeepSec 2014)
Martin Schütte
 
PDF
Linux Native, HTTP Aware Network Security
Thomas Graf
 
PDF
Cisco CSIRT Case Study: Forensic Investigations with NetFlow
Lancope, Inc.
 
PDF
Make the internet safe with DNS Firewall
Bangladesh Network Operators Group
 
PDF
Stun turn poc_pilot
Mihály Mészáros
 
PDF
MUM Middle East 2016 - System Integration Analyst
Fajar Nugroho
 
PDF
DDoS Mitigation using BGP Flowspec
APNIC
 
PDF
Silverlight Wireshark Analysis
Yoss Cohen
 
PDF
PLNOG 9: Robert Dąbrowski - Carrier-grade NAT (CGN) Solution with FortiGate
PROIDEA
 
PDF
Preventing Traffic with Spoofed Source IP address
Bangladesh Network Operators Group
 
PDF
Actual Condition Survey of Malware Download Sites for A Long Period
APNIC
 
PDF
Extending Zeek for ICS Defense
James Dickenson
 
PDF
2015.7.17 JANOG36 BGP Flowspec Interoperability Test @ Interop Tokyo 2015 Sho...
Shuichi Ohkubo
 
PDF
MUM Europe 2017 - Traffic Generator Case Study
Fajar Nugroho
 
PDF
Accelerating Envoy and Istio with Cilium and the Linux Kernel
Thomas Graf
 
PPTX
Implementing MPLS Services using Openflow
APNIC
 
PDF
SDN & NFV Introduction - Open Source Data Center Networking
Thomas Graf
 
PPT
Firewall - Network Defense in Depth Firewalls
phanleson
 
PDF
LF_DPDK_Mellanox bifurcated driver model
LF_DPDK
 
NetBSD syslogd with IETF Syslog Protocols
Martin Schütte
 
The IPv6 Snort Plugin (at DeepSec 2014)
Martin Schütte
 
Linux Native, HTTP Aware Network Security
Thomas Graf
 
Cisco CSIRT Case Study: Forensic Investigations with NetFlow
Lancope, Inc.
 
Make the internet safe with DNS Firewall
Bangladesh Network Operators Group
 
Stun turn poc_pilot
Mihály Mészáros
 
MUM Middle East 2016 - System Integration Analyst
Fajar Nugroho
 
DDoS Mitigation using BGP Flowspec
APNIC
 
Silverlight Wireshark Analysis
Yoss Cohen
 
PLNOG 9: Robert Dąbrowski - Carrier-grade NAT (CGN) Solution with FortiGate
PROIDEA
 
Preventing Traffic with Spoofed Source IP address
Bangladesh Network Operators Group
 
Actual Condition Survey of Malware Download Sites for A Long Period
APNIC
 
Extending Zeek for ICS Defense
James Dickenson
 
2015.7.17 JANOG36 BGP Flowspec Interoperability Test @ Interop Tokyo 2015 Sho...
Shuichi Ohkubo
 
MUM Europe 2017 - Traffic Generator Case Study
Fajar Nugroho
 
Accelerating Envoy and Istio with Cilium and the Linux Kernel
Thomas Graf
 
Implementing MPLS Services using Openflow
APNIC
 
SDN & NFV Introduction - Open Source Data Center Networking
Thomas Graf
 
Firewall - Network Defense in Depth Firewalls
phanleson
 
LF_DPDK_Mellanox bifurcated driver model
LF_DPDK
 
Ad

Viewers also liked (6)

PDF
Network Security and Visibility through NetFlow
Lancope, Inc.
 
PPT
Manageengine Netflow analyzer - An Insight
Sai Sundhar Padmanabhan
 
PDF
Building a Security Architecture
Cisco Canada
 
PDF
Plugging Network Security Holes Using NetFlow
NetFlow Analyzer
 
PPTX
Application Visibility and Experience through Flexible Netflow
Cisco DevNet
 
PPT
NetFlow Auditor Anomaly Detection Plus Forensics February 2010 08
NetFlowAuditor
 
Network Security and Visibility through NetFlow
Lancope, Inc.
 
Manageengine Netflow analyzer - An Insight
Sai Sundhar Padmanabhan
 
Building a Security Architecture
Cisco Canada
 
Plugging Network Security Holes Using NetFlow
NetFlow Analyzer
 
Application Visibility and Experience through Flexible Netflow
Cisco DevNet
 
NetFlow Auditor Anomaly Detection Plus Forensics February 2010 08
NetFlowAuditor
 
Ad

Similar to NetFlow Monitoring for Cyber Threat Defense (20)

PDF
Krzysztof Mazepa - Netflow/cflow - ulubionym narzędziem operatorów SP
PROIDEA
 
PPT
Botprobe - Reducing network threat intelligence big data
DATA SECURITY SOLUTIONS
 
PDF
TakeDownCon Rocket City: Bending and Twisting Networks by Paul Coggin
EC-Council
 
PPTX
Analise NetFlow in Real Time
Piotr Perzyna
 
PPTX
Leverage the Network to Detect and Manage Threats
Cisco Canada
 
DOCX
How to configure flexible netflow export on cisco routers
IT Tech
 
PPTX
NFA - Middle East Workshop
ManageEngine, Zoho Corporation
 
PDF
RAZORPOINT TCP/UDP PORTS LIST
Razorpoint Security
 
PPTX
2014/09/02 Cisco UCS HPC @ ANL
dgoodell
 
PDF
Go with the Flow
Bangladesh Network Operators Group
 
PDF
Go with the Flow-v2
Zobair Khan
 
PPTX
Session Initiation Protocol
Matt Bynum
 
ODP
Open Source Tools for the Systems Administrator
Charles Profitt
 
PDF
Advanced Topics in IP Multicast Deployment
Arrive Technologies, Inc.
 
PPTX
PLNOG 13: P. Kupisiewicz, O. Pelerin: Make IOS-XE Troubleshooting Easy – Pack...
PROIDEA
 
PDF
How to Speak Intel DPDK KNI for Web Services.
Naoto MATSUMOTO
 
PPT
T C P I P Weaknesses And Solutions
eroglu
 
PDF
Practical steps to mitigate DDoS attacks
Security Session
 
PPTX
Presentation on CISCO ACI basic fundamental
mdmahmuduli427
 
PPT
TCP/IP Basics
SMC Networks Europe
 
Krzysztof Mazepa - Netflow/cflow - ulubionym narzędziem operatorów SP
PROIDEA
 
Botprobe - Reducing network threat intelligence big data
DATA SECURITY SOLUTIONS
 
TakeDownCon Rocket City: Bending and Twisting Networks by Paul Coggin
EC-Council
 
Analise NetFlow in Real Time
Piotr Perzyna
 
Leverage the Network to Detect and Manage Threats
Cisco Canada
 
How to configure flexible netflow export on cisco routers
IT Tech
 
NFA - Middle East Workshop
ManageEngine, Zoho Corporation
 
RAZORPOINT TCP/UDP PORTS LIST
Razorpoint Security
 
2014/09/02 Cisco UCS HPC @ ANL
dgoodell
 
Go with the Flow
Bangladesh Network Operators Group
 
Go with the Flow-v2
Zobair Khan
 
Session Initiation Protocol
Matt Bynum
 
Open Source Tools for the Systems Administrator
Charles Profitt
 
Advanced Topics in IP Multicast Deployment
Arrive Technologies, Inc.
 
PLNOG 13: P. Kupisiewicz, O. Pelerin: Make IOS-XE Troubleshooting Easy – Pack...
PROIDEA
 
How to Speak Intel DPDK KNI for Web Services.
Naoto MATSUMOTO
 
T C P I P Weaknesses And Solutions
eroglu
 
Practical steps to mitigate DDoS attacks
Security Session
 
Presentation on CISCO ACI basic fundamental
mdmahmuduli427
 
TCP/IP Basics
SMC Networks Europe
 

More from Cisco Canada (20)

PDF
Cisco connect montreal 2018 net devops
Cisco Canada
 
PDF
Cisco connect montreal 2018 iot demo kinetic fr
Cisco Canada
 
PPTX
Cisco connect montreal 2018 - Network Slicing: Horizontal Virtualization
Cisco Canada
 
PDF
Cisco connect montreal 2018 secure dc
Cisco Canada
 
PDF
Cisco connect montreal 2018 enterprise networks - say goodbye to vla ns
Cisco Canada
 
PDF
Cisco connect montreal 2018 vision mondiale analyse locale
Cisco Canada
 
PDF
Cisco Connect Montreal 2018 Securité : Sécuriser votre mobilité avec Cisco
Cisco Canada
 
PDF
Cisco connect montreal 2018 collaboration les services webex hybrides
Cisco Canada
 
PDF
Integration cisco et microsoft connect montreal 2018
Cisco Canada
 
PDF
Cisco connect montreal 2018 compute v final
Cisco Canada
 
PDF
Cisco connect montreal 2018 saalvare md-program-xr-v2
Cisco Canada
 
PDF
Cisco connect montreal 2018 sd wan - delivering intent-based networking to th...
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 DNA automation-the evolution to intent-based net...
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 IOT - unlock the power of data - securing the in...
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 DevNet Overview
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 DNA assurance
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 network-slicing
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 the intelligent network with cisco meraki
Cisco Canada
 
PDF
Cisco Connect Toronto 2018 sixty to zero
Cisco Canada
 
Cisco connect montreal 2018 net devops
Cisco Canada
 
Cisco connect montreal 2018 iot demo kinetic fr
Cisco Canada
 
Cisco connect montreal 2018 - Network Slicing: Horizontal Virtualization
Cisco Canada
 
Cisco connect montreal 2018 secure dc
Cisco Canada
 
Cisco connect montreal 2018 enterprise networks - say goodbye to vla ns
Cisco Canada
 
Cisco connect montreal 2018 vision mondiale analyse locale
Cisco Canada
 
Cisco Connect Montreal 2018 Securité : Sécuriser votre mobilité avec Cisco
Cisco Canada
 
Cisco connect montreal 2018 collaboration les services webex hybrides
Cisco Canada
 
Integration cisco et microsoft connect montreal 2018
Cisco Canada
 
Cisco connect montreal 2018 compute v final
Cisco Canada
 
Cisco connect montreal 2018 saalvare md-program-xr-v2
Cisco Canada
 
Cisco connect montreal 2018 sd wan - delivering intent-based networking to th...
Cisco Canada
 
Cisco Connect Toronto 2018 DNA automation-the evolution to intent-based net...
Cisco Canada
 
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
Cisco Canada
 
Cisco Connect Toronto 2018 IOT - unlock the power of data - securing the in...
Cisco Canada
 
Cisco Connect Toronto 2018 DevNet Overview
Cisco Canada
 
Cisco Connect Toronto 2018 DNA assurance
Cisco Canada
 
Cisco Connect Toronto 2018 network-slicing
Cisco Canada
 
Cisco Connect Toronto 2018 the intelligent network with cisco meraki
Cisco Canada
 
Cisco Connect Toronto 2018 sixty to zero
Cisco Canada
 

Recently uploaded (20)

PDF
Advanced Soft Computing BINUS July 2025.pdf
University of Hertfordshire
 
PDF
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
PDF
GamePlan Trading System Review: Professional Trader's Honest Take
SOFTTECHHUB
 
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
PDF
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
PDF
[발표본] 너의 과제는 클라우드에 있어_KTDS_김동현_20250524.pdf
ssuserf8b8bd1
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
GDG Cloud Iasi [PUBLIC] Florian Blaga - Unveiling the Evolution of Cybersecur...
athlonica
 
PDF
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
PDF
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
PDF
Modernizing your data center with Dell and AMD
Principled Technologies
 
DOCX
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PDF
CIFDAQ's Market Insight: SEC Turns Pro Crypto
CIFDAQ
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
PPTX
breach-and-attack-simulation-cybersecurity-india-chennai-defenderrabbit-2025....
defencerabbit Team
 
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
Advanced Soft Computing BINUS July 2025.pdf
University of Hertfordshire
 
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
GamePlan Trading System Review: Professional Trader's Honest Take
SOFTTECHHUB
 
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
[발표본] 너의 과제는 클라우드에 있어_KTDS_김동현_20250524.pdf
ssuserf8b8bd1
 
Approach and Philosophy of On baking technology
30anthuong17
 
GDG Cloud Iasi [PUBLIC] Florian Blaga - Unveiling the Evolution of Cybersecur...
athlonica
 
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
Modernizing your data center with Dell and AMD
Principled Technologies
 
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
CIFDAQ's Market Insight: SEC Turns Pro Crypto
CIFDAQ
 
MYSQL Presentation for SQL database connectivity
Swati270511
 
breach-and-attack-simulation-cybersecurity-india-chennai-defenderrabbit-2025....
defencerabbit Team
 
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 

NetFlow Monitoring for Cyber Threat Defense

  • 2. NetFlow Monitoring for Cyber Threat Defense T-SEC-10-I Matthew Robertson Security Technical Marketing Engineer
  • 3. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public 3 “The whole art of war consists of guessing at what is on the other side of the hill.” Arthur Wellesley, 1st Duke of Wellington
  • 4. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Defending against Humans 4 http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html
  • 5. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Evolution of Cyber Conflict War Dialing, Phone Phreaking … Manual Attacks (1980s) Viruses, Worms … Mechanized Attacks (1988) Google, RSA … Talented Human / Mechanized Attackers (2009) Cyrptocurrency Ransoms, Store-bought Credentials ... DIY Human / Mechanized Attackers (2011) Intelligence Driven Human Defenders 5 Manual Defenses Unplug Mechanized Defenses Firewall, IDS/IPS Targeted Human/Mechanized DefendersReputation, App-aware FirewallAPT, Multi-Step Attacks… Target, Neiman Marcus …
  • 6. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 6 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Working with NetFlow Flow ExportAdding Context Summary Organizing the data Running Queries and Investigations Flow Collection
  • 7. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public About this session 7 https://learningnetwork.cisco.com/community/certifications/s ecurity/cybersecurity/scyber_exam http://www.cisco.com/go/securedatacenter http://www.cisco.com/go/threatdefense
  • 8. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public About the Speaker Matthew Robertson  Security Technical Marketing Engineer  ½ year at Lancope  5½ years at Cisco – Development and Technical Marketing  Focused on advanced threat detection  Author of 2 CVD’s  I am Canadian! 8
  • 9. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Thinking beyond the perimeter 9 Once the walls are built monitor for security visibility
  • 10. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Signals Intelligence 10 Traffic Analysis: • Deduce information from communication patterns
  • 11. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow 11 10.2.2.2 port 1024 10.1.1.1 port 80 eth0/1 eth0/2 Start Time Interfac e Src IP Src Port Dest IP Dest Port Proto Pkts Sent Bytes Sent TCP Flags 10:20:12.221 eth0/1 10.2.2.2 1024 10.1.1.1 80 TCP 5 1025 SYN,ACK,PSH 10:20:12.871 eth0/2 10.1.1.1 80 10.2.2.2 1024 TCP 17 28712 SYN,ACK,FIN Start Time Interfac e Src IP Src Port Dest IP Dest Port Proto Pkts Sent Bytes Sent TCP Flags 10:20:12.221 eth0/1 10.2.2.2 1024 10.1.1.1 80 TCP 5 1025 SYN,ACK,PSH
  • 12. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow = Visibility Router# show flow monitor CYBER-MONITOR cache … IPV4 SOURCE ADDRESS: 192.168.100.100 IPV4 DESTINATION ADDRESS: 192.168.20.6 TRNS SOURCE PORT: 47321 TRNS DESTINATION PORT: 443 INTERFACE INPUT: Gi0/0/0 IP TOS: 0x00 IP PROTOCOL: 6 ipv4 next hop address: 192.168.20.6 tcp flags: 0x1A interface output: Gi0/1.20 counter bytes: 1482 counter packets: 23 timestamp first: 12:33:53.358 timestamp last: 12:33:53.370 ip dscp: 0x00 ip ttl min: 127 ip ttl max: 127 application name: nbar secure-http … A single NetFlow Record provides a wealth of information 12
  • 13. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 13 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Flow Export
  • 14. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment Architecture 14 Management/Reporting Layer: • Run queries on flow data • Centralize management and reporting Flow Collection Layer: • Collection, storage and analysis of flow records Flow Exporting Layer: • Enables telemetry export • As close to the traffic source as possible NetFlow
  • 15. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Considerations: Flow Exporting Layer 15 1. NetFlow support 2. Which version of NetFlow to use 3. How to configure/what to measure 4. Where in the network to enable NetFlow export
  • 16. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Cisco NetFlow Support Cisco 2900 Cisco 7200 VXR Cisco Nexus 7000 Cisco XR 12000 Cisco 2800 Cisco 7600 Cisco 1700 Cisco Catalyst 6500 Cisco 3560/3750-X/3850 Cisco ASR Cisco ASA Cisco ISR G2 Hardware Supported Cisco Catalyst 4500 Cisco NGA 16 Cisco Nexus 1000v
  • 17. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Versions of NetFlow Version Major Advantage Limits/Weaknesses V5 Defines 18 exported fields Simple and compact format Most commonly used format IPv4 only Fixed fields, fixed length fields only Single flow cache V9 Template-based IPv6 flows transported in IPv4 packets MPLS and BGP nexthop supported Defines 104 fields, including L2 fields Reports flow direction IPv6 flows transported in IPv4 packets Fixed length fields only Uses more memory Slower performance Single flow cache Flexible NetFlow (FNF) Template-based flow format (built on V9 protocol) Supports flow monitors (discrete caches) Supports selectable key fields and IPv6 Supports NBAR data fields Less common Requires more sophisticated platform to produce Requires more sophisticated system to consume IP Flow Information Export (IPFIX) AKA NetFlow V10 Standardised – RFC 5101, 5102, 6313 Supports variable length fields, NBAR2 Can export flows via IPv4 and IPv6 packets Even less common Only supported on a few Cisco platforms NSEL (ASA only) Built on NetFlow v9 protocol State-based flow logging (context) Pre and Post NAT reporting Missing many standard fields Limited support by collectors 17
  • 18. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public How do I want to cache information Which interface do I want to monitor? What data do I want to meter? Router(config)# flow record my-record Router(config-flow-record)# match ipv4 destination address Router(config-flow-record)# match ipv4 source address Router(config-flow-record)# collect counter bytes Where do I want my data sent? Router(config)# flow exporter my-exporter Router(config-flow-exporter)# destination 1.1.1.1 Router(config)# flow monitor my-monitor Router(config-flow-monitor)# exporter my-exporter Router(config-flow-monitor)# record my-record Router(config)# interface s3/0 Router(config-if)# ip flow monitor my-monitor input 1. Configure the Exporter 2. Configure the Flow Record 3. Configure the Flow Monitor 4. Apply to an Interface Configuring Flexible NetFlow 18 Best Practice: include all v5 fields
  • 19. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment 19 Access Catalyst® 3560/3750-X Catalyst® 4500 Catalyst® 6500 Distribution & Core Catalyst® 4500 ASA ISR Edge ASR Each network layer offers unique NetFlow capabilities
  • 20. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment 20 Access Catalyst® 3560/3750-X Catalyst® 4500 Access: • New network edge • Detect threats as the enter the network • Detect threats inside the switch • east-west • Layer 2 traffic • Fewer false positives • Higher-granular visibility • Identify the endpoint • collect MAC Address
  • 21. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Catalyst 3650-X,3750-X Flow Record 21 ! flow record CYBER_3KX_FLOW_RECORD
 match datalink mac source- address match datalink mac destination-address match datalink mac source-vlan-id match ipv4 tos match ipv4 ttl match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port
 collect interface input snmp
 collect interface output snmp
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first collect timestamp sys-uptime last !
  • 22. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Catalyst 4500 Flow Record 22 ! flow record CYBER_4K_FLOW_RECORD match ipv4 tos match ipv4 protocol match ipv4 source address
 match ipv4 destination address match transport source-port match transport destination-port collect ipv4 dscp collect ipv4 ttl minimum collect ipv4 ttl maximum collect transport tcp flags collect interface output collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last !
  • 23. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment - Converged Access 23 Converged Access: • NetFlow for the first time on Wireless • Visibility in BYOD environments • Consistent configuration for wired and wireless • Single flow monitor can be applied to wired ports and SSID • Natively available in the UADP ASIC • Can monitor East-West and North-South flows • 48k flows on the 48 port model
  • 24. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment 24 Catalyst® 6500 Distribution & Core Catalyst® 4500 Distribution & Core: • Traditional deployment • Minimal recommended deployment • Enable at critical points/bottle necks • Typically done on a Layer 3 boundary • Detect threats internal to the VLAN • When deployed on an SVI interface • Detect threats as they traverse the internal network • Move between subnets
  • 25. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Catalyst 6500 (Sup 2T) Flow Record 25 ! flow record CYBER_6K_FLOW_RECORD match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input collect transport tcp flags collect interface output collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last !
  • 26. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Deployment 26 ASA ISR Edge ASR Edge: • Detect threats as they enter and leave the network • Monitor communication between branches • Gain context from edge devices • Application - NBAR • Events & User-ID - NSEL
  • 27. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public ISR Flow Record 27 !
flow record CYBER_ISR_RECORD match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input collect routing next-hop address ipv4 collect ipv4 dscp collect ipv4 ttl minimum collect ipv4 ttl maximum collect transport tcp flags collect interface output collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last collect application name ! Enable NBAR
  • 28. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public ASA NSEL Configuration 28 ! flow-export destination management <ip-address> 2055 ! policy-map global_policy class class-default flow-export event-type all destination <ip-address> ! flow-export template timeout-rate 2 logging flow-export syslogs disable !
  • 29. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Monitor Configuration 29 ! flow monitor CYBER_MONITOR
 record CYBER_RECORD exporter CYBER_EXPORTER cache timeout active 60 cache timeout inactive 15 ! Active Timeout: • Longest amount of time a flow can be in cache without exporting a Flow Record • Recommended 60 seconds • All exporters should have the same timeout Inactive Timeout: • How long a flow can be inactive before being removed from cache • Recommended 15 seconds • All exporters should have the same timeout
  • 30. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Aside: Myths about NetFlow Generation 30 Myth #1: NetFlow impacts performance • Hardware implemented NetFlow has no performance impact • Software implementation is typically significantly <15% processing overhead Myth #2: NetFlow has bandwidth overhead • NetFlow is a summary protocol • Traffic overhead is typically significantly <1% of total traffic per exporting device
  • 31. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 31 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Flow ExportFlow Collection
  • 32. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Collection Considerations 32 Flow Handling • De-duplication • Stitching • Replication Scalability & Performance • # of NetFlow sources • # of users • Flows per second • Sustained vs. burst Your time, resources and budget Feature set • Reporting • Drill down • Retention • Analysis NetFlow NetFlow NetFlow
  • 33. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Components for NetFlow Security Monitoring 33 Cisco Network StealthWatch FlowReplicator • UDP Packet copier • Forward to multiple collection systems NetFlow StealthWatch FlowSensor • Generate NetFlow data StealthWatch FlowSensor VE • Virtual environment • Visibility into ESX StealthWatch FlowCollector • Collect and analyze • Up to 2000 sources • Up to sustained 120,000 fps StealthWatch Management Console • Management and reporting • Up to 25 FlowCollectors • Up 3 million fps globally Best Practice: Centralize collection globally
  • 34. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Collection: Flow Stitching 34 10.2.2.2 port 1024 10.1.1.1 port 80 eth0/1 eth0/2 Start Time Interface Src IP Src Port Dest IP Dest Port Proto Pkts Sent Bytes Sent 10:20:12.221 eth0/1 10.2.2.2 1024 10.1.1.1 80 TCP 5 1025 10:20:12.871 eth0/2 10.1.1.1 80 10.2.2.2 1024 TCP 17 28712 Start Time Client IP Client Port Server IP Server Port Proto Client Bytes Client Pkts Server Bytes Server Pkts Interfaces 10:20:12.221 10.2.2.2 1024 10.1.1.1 80 TCP 1025 5 28712 17 eth0/1 eth0/2 Uni-directional flow records Bi-directional: • Conversation flow record • Allows easy visualization and analysis
  • 35. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow Collection: De-duplication 35 Router A Router B Router C Router A: 10.2.2.2:1024 -> 10.1.1.1:80 Router B: 10.2.2.2:1024 -> 10.1.1.1:80 Router C: 10.1.1.1:80 -> 10.2.2.2:1024 • Without de-duplication: • Traffic volume can be misreported • False positive would occur • Allows for the efficient storage of flow data • Necessary for accurate host-level reporting • Does not discard data 10.2.2.2 port 1024 10.1.1.1 port 80 Duplicates
  • 36. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Conversational Flow Record 36 Who WhoWhat More Details When How
  • 37. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Integrating with a SIEM 37 Log alarms and summary info to SIEM • Complete visibility throughout network • Leverage specialty data handling NetFlowSyslog SDEE SIEM Security Events API API’s to access database • Directly access flow data (ex. getFlows) • Improved scale - collection and retention • Decreased cost
  • 38. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 38 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Flow ExportAdding Context Flow Collection
  • 39. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Context is Critical 39
  • 40. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public ISE as a Telemetry Source 40 Monitor Mode • Open Mode, Multi-Auth • Unobstructed Access • No impact on productivity • Profiling, posture assessment • Gain Visibility Authenticated Session Table Cisco ISE • Maintain historical session table • Correlate NetFlow to username • Build User-centric reports StealthWatch Management Console syslog
  • 41. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Configuration: Logging on ISE 41 1. Create Remote Logging Target on ISE 2. Add Target to Logging Categories 1 2 Required Logging categories: • AAA Audit • RADIUS Accounting • Profiler • Administrative and Operational Audit
  • 42. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Configuration: Add ISE to SMC 42 3 3 4. Add additional ISE nodes 1. (Not Shown) Create Admin User on ISE 2. (Not Shown) Configure ISE or CA certificate on SMC 3. (Shown) Add Cisco ISE to SMC Configuration 4. (Shown) Add additional ISE nodes
  • 43. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Global Intelligence 43 List of known Command and Control Servers
  • 44. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Adding Situational Awareness 44 Client Host Client Host Group Server Host Server Host Groups Application Duratio n Total Traffic Start Active Time 10.201.3.149 Sales and Marketing, End User Devices 89.108.67.143 Russian Federation HTTP 23s 256.56K Jan 11, 2014
  • 45. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Adding Situational Awareness 45 Client User Name Client Host Client Host Group Server Host Server Host Groups Application Duratio n Total Traffic Start Active Time Ken 10.201.3.14 9 Sales and Marketing, End User Devices 89.108.67.143 Russian Federation, Zeus HTTP 23s 256.56K Jan 11, 2014
  • 46. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 46 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Working with NetFlow Flow ExportAdding Context Organizing the data Running Queries and Investigations Flow Collection
  • 47. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Behavioural Analysis & Anomaly Detection 47 Behavioural Analysis: • Leverages knowledge of known bad behaviour Anomaly Detection: • Identify a change from “normal”
  • 48. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public StealthWatch: Indices 48 Concern Index: Track hosts that appear to compromising network integrity Target Index: Track hosts that appear to be victims of the suspicious behaviour of other hosts File Sharing Index: Tracks behaviour that is indicative of peer-to-peer activity
  • 49. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public StealthWatch: Alarms 49 Alarms • Indicate significant behaviour changes and policy violations • Known and unknown attacks generate alarms • Activity that falls outside the baseline, acceptable behaviour or established policies
  • 50. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups 50 Virtual container of multiple IP Addresses/ranges that have similar attributes Lab servers Best Practice: classify all known IP Addresses in one or more host groups
  • 51. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Policy Tuning 51 Policies can be created for individual host groups Tune alarm thresholds Default policy for Inside and Outside hosts
  • 52. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Query Basics – The Flow Table 52 Filter Filter conditions Details More details
  • 53. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Query Basics - Filtering 53 Select host to investigate All flows in which this host was a client or server
  • 54. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Query Basics - Filtering 54 All flows for 10.10.200.79 in the last hour
  • 55. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Table: Visibility across NAT 55 Inside local Outside global Server User
  • 56. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Querying Events - Leveraging NSEL 56 Flow denied events over many ports
  • 57. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Flow Table – IPv6 57
  • 58. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Targeted Monitoring 58 Suspiciously behaving hosts Alarms Host Group Dashboard for Engineers
  • 59. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Application Report 59 Applications outbound Applications inbound
  • 60. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Targeted Reporting 60 Geo-IP-based Host Group Summary chart of traffic inbound and outbound from this Host Group
  • 61. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Targeted Reporting 61 Traffic inbound Traffic outbound
  • 62. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Discovering Rogue Hosts 62 Catch All: All unclassified RFC1918 addresses Table of all individual hosts
  • 63. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Host Groups – Discovering Rogue Hosts 63 Rogue Hosts
  • 64. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Indicator of Compromise 64 Raw flow analysis Log analysis (SIEM) IDS Alert Outside notification Behavioural analysis Activity monitoring an artifact observed on a network or in operating system that with high confidence indicates a computer intrusion • http://en.wikipedia.org/wiki/Indicator_of_compromise
  • 65. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public 65 Attack Lifecycle Model Exploratory Actions Footprint Expansion Execution Theft Disruption Staging Initial Compromise Initial Recon Infiltration (C&C)
  • 66. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public 66 Attack Lifecycle Model Exploratory Actions Footprint Expansion Execution Theft Disruption Staging Initial Compromise Initial Recon Infiltration (C&C) IOC Found: Investigate forwards and backward
  • 67. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Concept: OODA Loop 67 Observe Orient Decide Act Feedback Feedback • Unfolding circumstances • Implicit guidance • Outside information • Unfolding interaction with environment • Cultural Traditions • Genetic Heritage • Analysis & Synthesis • New information • Previous Experiences Unfolding interaction with environment http://en.wikipedia.org/wiki/OODA_loop
  • 68. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Identifying the Culprit Indicator of Compromise Is a worm indicated? • Alarm • Alarm Table • Alarm Summary • IDS Alert • Other Host IP Address Worm Tracker Yes Host Snapshot Supplemental Information: • Most recent flows/Active flows • Traffic volume/type • Other Alarms • Exporter interfaces • Activity – scanning? • Thresholds • Touches Identity: • Username • Device type and OS • Access location • Organization/Geo • Role – Client or Server • Hosts affected • Host Groups Affected • Subnets Affected • Ports Used • Protocols Used Is the behaviour normal or permissible? Tune Yes Respond No No 68
  • 69. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Responding to an IOC 69 Create a Host Group for BlackPOS Servers IOC: Crowdstrike publishes list of IP addresses identified as BlackPOS servers IP Addresses
  • 70. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public BlackPOS – Host Locking Violation Alarm 70 Create a Host Lock Violation Alarm for communication to BlackPOS servers Set client hosts to POS terminals Set server hosts to BlackPOS Servers Alarm on FTP traffic Trigger alarm on unsuccessful connections
  • 71. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public BlackPOS - Investigate You know today what you didn’t know yesterday 71 Run a Flow Query Over the last 90 days Server or client includes the known bad BlackPOS IP Addresses Configure application to be FTP
  • 72. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public BlackPOS – Returned Flows 72 Infected hosts BlackPOS Servers FTP Transfers
  • 73. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Investigating Malware Spread: Worm Tracker 73 IOC: IDS Alert indicating a known worm operating inside your network Worm tracker Initial infection Secondary infections Subnets being scanned
  • 74. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Investigating Malware Spread: Host Snapshot 74 Everything the system knows about 10.10.200.59 Start with CI Events. We notice significant scanning activity
  • 75. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Investigating Malware Spread: Identity 75 Telemetry from the ISE Username Infected machine
  • 76. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Investigating Malware Spread: Touched Hosts 76 This infected host has established a connection with another host
  • 77. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Investigating Malware Spread: Touched Hosts 77 All hosts touched by 10.10.200.59
  • 78. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public High Concern Index 78 Baseline deviated by 2,432%!
  • 79. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public What was this Host up to? 79 Target – entire subnet? Scanning on TCP-445
  • 80. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public NetFlow and (D)DoS Detection 80 Identify targets • Target of suspicious activity • Abnormal traffic volume • Decrease in performance Identify attackers
  • 81. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Volumetric DDoS 81 Traffic Spikes
  • 82. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Identifying a DDoS Participant 82 IOC: Notification from 3rd party that your IP Address is participating in a DDoS Public IP address Target server Time of reported attack
  • 83. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Identifying a DDoS Participant 83 Time of reported attack Inside local Outside global Target Server Validate attack activity User
  • 84. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Identify a DDoS Participant 84 Host snapshot Other suspicious activity
  • 85. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Agenda 85 Introduction Understanding the Landscape Introduction to NetFlow Design and Deployment Working with NetFlow Flow ExportAdding Context Summary Organising the data Running Queries and Investigations Flow Collection
  • 86. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Links and Recommended Reading More about the Cisco Cyber Threat Defense Solution: http://www.cisco.com/go/threatdefense http://www.lancope.com 86 Recommended Reading Cyber Threat Defense Cisco Validated Design Guide: http://www.cisco.com/en/US/solutions/collateral/ns1015/ns1238/cyber_threat_defense_design_guide.pdf Cyber Threat Defense Cisco Validated Design Guide: http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/ctd-first-look-design-guide.pdf Securing Cisco Networks with Threat Detection and Analysis (SCYBER) https://learningnetwork.cisco.com/community/certifications/security/cybersecurity/scyber_exam
  • 87. Cisco and/or its affiliates. All rights reserved.T-SEC-10-I Cisco Public Key Takeaways 87 Modern threats are consistently bypassing the security perimeter Threat Detection requires visibility and context into network traffic NetFlow and the Lancope StealthWatch System provide actionable security intelligence
  • 88. Q & A