Encrypted Visibility Engine (EVE)

Hello everyone and thank you for watching. My name is Mohammed Zamzam, a customer success specialist at Cisco. In this video, we're diving into one of the most critical innovations in the Cisco Secure Firewall portfolio, the encrypted Visibility Engine or.00:04For Eva. As the world moves toward total encryption, the old ways of managing security are hitting a wall. Today I'll show you how Eva allows us to see into that black box of encrypted traffic without the traditional headaches of decryption.00:21To give you a roadmap for this video, I have structured the presentation into five key areas. 1st, we will address the visibility gap, exploring why modern encryption makes traditional inspection so difficult. Second, I will provide an introduction to Eve.00:43Defining the encrypted visibility engine and its role in your security stack. 3rd, we'll go under the hood to look at the mechanics of how this technology works without requiring decryption. 4th, we will discuss key use cases and capabilities, specifically how this translates to real world protection and performance.01:00And finally, we will conclude with a live demo so you can see the visibility and intelligence of Eve in action within the management interface. To understand why we need Eve, we have to look at where we came from. For years firewalls relied on deep packet inspection, basically opening.01:20The mail to see what was inside.01:40But then came the going dark era with the rise of DLS 1.3, encryption became stronger and more private. Standard decryption, what we call man in the middle started failing us. It's a massive drain on firewall performance.01:42Often cutting throughput by half, and it raises serious privacy and legal concerns with things like banking data. We needed a way to identify threats without actually opening the mail, and that's why Cisco introduced Eve starting in version 7.1. So why.02:01By Eve. 1st, it's about speed because we aren't decrypting and re encrypting traffic, the firewall runs at wire speed. Second, it's about precision. Eve can identify over 5000 different client processes. It knows the difference between a legitimate.02:21Put Chrome browser and a malicious script trying to phone home. 3rd, it's about compliance. You can maintain strict privacy for your users due to end to end encryption while still able to catch and identify malwares. It gives you the best of both worlds, the security of visibility and the.02:41See of encryption.03:01You might wonder if it's encrypted, how do we see anything? The secret lies in the TLS client hello. Think of this like a digital handshake. Even before the conversation is encrypted, the client tells the server what language.03:05Or cipher suites it speaks. Cisco analyzes over a billion of these fingerprints daily.03:23By looking at these unique patterns and utilizing machine learning capabilities to enhance the contextual analysis, Eve can identify the application with incredible accuracy. It's like identifying a person by their gate or their voice, even if you can't see their face. Within the secure firewall ecosystem eve.03:30Eve is a powerhouse. It doesn't just identify apps, it assigns a threat confidence score. If Eve sees a fingerprint associated with known malware, it can block it instantly. One of my favorite new features in the latest releases is intelligent decryption bypass. Eve can.03:50Tell the firewall.04:10Hey, this is a known trusted Google process with a very low threat score. Don't waste CPU cycles decrypting it. This makes your entire security stack more efficient. The best part for administrators, it's incredibly easy to turn it on.04:11Let's see the demo how to configure and monitor it. Enabling Eve is a straightforward process within the FMC. 1st, access your desired access control policy.04:31And head over to the advanced settings. Under the Eve section, switch the toggle to enable. Before proceeding, verify that your VDB updates are scheduled and the Cisco Success Network is.04:53Connected, as these are prerequisites for the engine.05:06Beyond basic visibility, you can also utilize Eve for enhanced application detection. This gives you the granular control to block suspicious traffic based on its confidence score. Simply adjust the threshold to match your network security requirements. Now that Eve is active, let.05:10Let's leverage it to block specific traffic. We'll begin in the objects menu under application detector.05:30We're going to define a new application detector specifically for TOR. Under the settings, use the encrypted visibility engine filter to pinpoint the TOR protocol. Once selected, add it to your active filters to finalize the object.05:53To wrap up, we'll apply this intelligence to our live environment, head over to policies and select access control policy to integrate the new block rule.06:16To monitor your results in real time, navigate to the dashboard and switch to the application dashboard view. Here, you'll find a dedicated.07:19Encrypted visibility engine tab, providing a high level summary of your traffic. If you need to perform a more detailed forensic analysis navigate to analysis, and open the unified view. From there you can adjust your column configuration to include all encrypted visibility data points.07:29Giving you full transparency into the encrypted traffic passing through your perimeter.07:49To wrap things up, let's look at the five essential takeaways. Eve is not a replacement of decryption.08:08But a powerful teammate Eve provides high fidelity visibility into encrypted traffic without need to decryption with NO performance degradation. It identifies applications and threats by analyzing the unencrypted handshake fingerprinting backed by Cisco's ML database. You will get a.08:15Clear threat confidence score that allows you to block known malicious fingerprints immediately. As starting from firewall V 7.7 plus Eve can automatically bypass decryption for trusted low risk traffic to save critical CPU resources. And finally remember that for Eve to work, you must.08:35It have snort three enabled on the firewall and a valid threat license on the FMC. This concludes the video hoping that you enjoyed it and found it useful.08:55