Cisco Secure Firewall feature focus Encryption Visibility Engine

Oh, and great feature that we would like to discuss in this event. So.00:00Let's start with our discussion by reviewing today's landscape. So encrypted is pervasive and in the last ten years, we have seen a rapid increase of encrypted traffic. And today almost 100 % of internet traffic is encrypted. And this is not surprising as we have continued to rely on.00:15Communications to share sensitive information and protecting that data.00:36Is critical for many of our organizations. Before encryption was so pervasive, early internet traffic was not protected. It looked like this, a plain text HTTP web connection.00:41And it's basically the equivalent of putting a postcard in the mail. Anyone who intercepted this message could read and understand exactly what was going on in the communication. As forward to today, we have less visibility than ever before.00:57The most basic information about a web connection is still available to us, but encrypted connections are now hiding more information than ever. PLS connections already hit most information and now with quick protocol, there can even be an encrypted client hello that.01:15The server name indication or SNI. This leave us with a challenge because the information needed for threat services like like like IPS, malware protection and URL filtering, identified threats in web connections are NO longer available to us.01:36So, and those are not longer available to us without decryption. And we know that encryption is crucial because it keeps our data private and secure. But we also know that over 70 % of attacks are expected to use encryption. That includes web application.01:57Tax and malware, which album decryption can often help stop before they get into the organization.02:17And in a situation where a system is successfully compromised, there's post exploit activity. E.g., data expectation where attackers sneak sensitive info out of the organization or use encryption to move through the network laterally.02:24That's why decryption is a necessary security step. We want to stay ahead of this risk as effectively as possible. We know that decryption is a feature where we use a firewall to convert encrypted data into a readable format for analysis.02:40Detect and block threats, but declusion can.03:00Really can be really challenging and it's becoming more difficult to execute decryption strategies as encryption practices evolve. One of the key issues with decryption is the performance impact on the network. Every decryption rule applied creates a performance straightf.03:04And the more traffic you decrypt, the more likely the need for higher capacity or additional firewalls to maintain network performance levels expected. Another challenge is configuration complexity. There's a constant balance needed between granularity and simplicity when implementing decryption rule set.03:22On one hand, focusing on granularity, making sure the cryption rules are applied correctly and in the right order is challenging enough. But micromanaging doesn't always have the best outcome. Some level of simplicity is required because networks are dynamic with many changes in applications.03:42Services and user behavior. So those rule sets need to be updated regularly and adapt to be effective against new threats and traffic patterns. Plus, you're going to need to bypass decryption altogether for certain traffic according to compliance standards.04:03For things like financial and healthcare data. Both of these trade offs result in operational overhead. After discussing all these challenges.04:23The question that we are trying to solve is how we can regain visibility into all these encrypted traffic without so many trade offs? Well, of course it will not be possible to remove all the barriers of decryption.04:40And Cisco is making some unique and important advancements in removing a lot of these barriers to implement decryption best practices. Thanks to Talos threat intelligence, Cisco global Threat Intelligence research Organization.04:56There is valuable data set for AI and machine learning models that can drive positive outcomes in day to day operations. With global visibility from Talos over encrypted visibility engine can power intelligent decryption.05:12Both Talos and if are unique to Cisco. So now we are going to discuss about these two main areas. Most of you, most of you are likely familiar with Cisco Talos, but I would like to share some insights.05:29It's about a day in the life of this threat intelligence research of the organization. One of the main strengths of Talos is global visibility. Talos receives and processes telemetry from over 45 million endpoints globally.05:48Detects more than 3 million malware samples every day and more than 800 billion security events and in 190 countries and regions. Visibility into this much data is difficult for any organization to achieve.06:06Meaning that Cisco is uniquely positioned to see threats at a massive scale. The other component to regain visibility is if, if or the visibility engine.06:24It's an AI machine learning power engine that helps detect applications and malware within encrypted traffic. Actually, if what was introduced in version seven.one of Cisco secure Firewall threat Defense a few years ago, and it has continued to evolve with new capabilities in real.06:41Recent versions. One of the main characteristics of if is that it supports multiple protocols as TLS, HTTP, and quick. If is high performing, as we generally see only 1 % CPU increase when using.07:01If in our secure firewall devices and helps to preserve privacy and address some compliance requirements like, like the ones for healthcare and financial data. If serve.07:21As an additional layer within a defense in depth strategy for our.07:40Cisco secure firewall deployment. Rather than replacing existing capabilities, it enhanced our overall security posture and complements features such as decryption by helping to make better decryption decisions.07:45So how does if works? If uses threat intelligent insights to offer a surprising amount of visibility without requiring decryption. Simply put, if it's a feature that helps you with better decryption decision making based on risk.08:09It's able to make very reliable calculated predictions with the limited information provided in the client hello of TLS and quick traffic to give you more visibility into your traffic than you will have otherwise.08:28To achieve this goal, we have to start with a distilled set of data that I showed you earlier. Talos gets telemetry from millions of endpoints every day, but we have agents installed across more than.08:44500000 endpoints that share flow data with us to help us build our TLS and quick fingerprint data, as well as TLS data that collected from our global data centers and other partners.09:02In case you are not familiar with what a TLS fingerprint is, it is a unique combination of settings and choices a device makes when it creates a secure connection. We take 4 billion TLS sessions a day and feed them through an automatic.09:19Automated pipeline to train if 4 billion is the same number as half of the globe's population. So that's the impressive scale we are talking about here. Finally, we put around 10000 malware samples a day from our malware analytics.09:38Capability to fit into if so it can recognize patterns associated with malware. Now the really amazing part is that if takes that data and when it evaluates outbound encrypted traffic.09:57It will assign a malware thread score to that file. Depending on the thread score, the package will be allowed or blocked throughout the whole process, if it will be high performing or will not consume a lot of CPU resources.10:14And as we already described, it will still preserve privacy and will be a great compliment for decryption efforts. So here's behind the scenes details in two.10:31Into how IFS arise as a threat and a threat score to help you make better decryption decisions. Remember, the main purpose of if is to tell you which process initiated an encrypted connection and tie it into a certain promoability and assign it and assign a score to it.10:471st, if it's going to inspect the client hello portion of the TLS handshake and calculate TLS or quick fingerprint based on the best database base is pulling from. However, fingerprinting isn't enough to reduce risk to the stent we are comfortable with.11:07Because many apps and processes use the same TLS libraries, so if may not be able to accurately predict the risk of the connection. That's why if it's also going to assess the destination.11:27Support and server name indication or SNI because Cisco has the capability to collect vast amount of data to assess the risk of server destinations if does not have to rely on fingerprinting alone to make a risk calculation.11:42From this combination of data, if, if can guess with a high probability, the application that initiated the connection, operating system details and the probability of the connection containing malware. If then delivers a threat score.11:59Of zero to 100. This threat score indicates the likelihood that a specific network connection is associated with malicious activity within encrypted traffic. A higher score indicates a greater likelihood.12:16Ultimately, it depends on Talos intelligence to supply malware data necessary for this final calculation. So let's see an example.12:33Consider this a scenario where a user tried to access a site, Cisco.com using the Firefox browser on PC. During the initiation of the connection, the TLS client hello is inspected to calculate.12:50A TLS fingerprint. Also the destination context is evaluated. By correlating the TLS fingerprint with the destination context, it can identify with a high degree of probability that the traffic was originated from a firefox.13:08Docs.exe process on a windows Ten operating system and classifying the client application as a browser. Now I will hand it over to Alexander for the demonstration of today.13:28Alexander, the floor is yours. Right, so thank you everyone again for joining and for attending this session. For this 1st part of the, this demo will be.13:45Showing how to enable if and some of the of the options available in the version seven.six. For that case we are running an FMC on, on seven six on this video here.14:01And it is managing also an STD on version 764. Enabling if it's a pretty straightforward process. We got to go to policies edit our access control policy and.14:22Under advanced settings, I will find the encrypted visibility engine section down at the bottom in this version by clicking edit, we'll be prompted with the encrypted visibility engine edit window from where we can.14:38Fine and information Mark mentioning that exception lists are only supported on FTD version 760 onwards. This is a feature that was included specifically on seven.six version.14:58Because if relies so heavily on vulnerability database updates is recommended to configure a periodic PDB update and to enable Cisco success network. You can easily enable if.15:14By toggling the encrypted visibility engine switch here, as you can see, the options to use if to enhance application detection and block malware traffic are now visible. For the time being, we'll have these options disabled.15:31Which is practically configuring if in a monitor only mode. We click ok, save our changes and deploy the configuration. So while this is deploying.15:48Just start deploying the configuration. While this is deploying, let's take a look to a few things. 1st in our access control policy, we have configured a rule to block applications.16:05We have to specify that we wanna block Firefox web browser among other apps. Please note that we haven't we haven't configured a decryption policy on this for this device. So let's monitor our traffic in analysis unified events windows.16:19In the unified events view, you'll have the option to enable custom columns if related columns are not visible by default, so we have to explicitly enable them by clicking in the concept icon.16:39We can reorganize the columns as needed. So I'm moving the encrypted visibility process name column right next to the web application column for comparison purposes. Let's set the event view for the last minute and.16:55We'll try to do some browsing in our test machine, now the deployment is complete. So we're going to Cisco.com and it looks like.17:12Even though we have configured a block rule for firefox, as you can see, we can easily navigate the internet using the browser. Let's see what's happening. So as noticed in the events view, HTTPS traffic is being allowed.17:27While only HTTP is being blocked, the ftd's regular application detector is having issues to identify the web application as Firefox without a decryption policy. Whereas we can see on this the encrypted visibility process.17:46Name column that if is successfully identifying Firefox as the application. So let's see what happens when we enable Eve's option to associate its identified process with an application for that.18:06We simply activate the use E for application detection switch, and deploy the configuration.18:23Let's do some browsing again. Our attempts to use Firefox as our web browser are now failing, as we can see we cannot, we can NO longer do web browsing here and the connections are.18:49As we can see in the unified events view, the firewall is successfully blocking Firefox web traffic. Let's take a closer look to the fingerprint window.19:05We do that by right clicking in the fingerprint cell and clicking in the view encrypted visibility engine process analysis link. This will redirect us to the app ID cisco.com site from where we find the prevalence column.19:19Showing the probability of a certain process to be the source of the traffic with the created fingerprint and the destination IP context data. We'll talk about that a little bit more later from this window we can also submit a feedback request in the event this is a.19:35Inaccurate prediction. This will be received by Talos team. The malware blocking option if can be enabled just as easily by activating the blocked traffic based on if a score option.19:55Doing so will give us the option to specify the threshold for blocking traffic based on if score, which is the level of confidence if has about a certain traffic of being created by a malicious process. It is recommended of course to keep it on at least a high level to avoid false positive.20:13As it is highlighted in this warning, when we try to go below medium levels. Alternatively, you could enable advanced mode to specify the threshold value based on if score.20:33FMC version seven.six introduces the option to add exception rules for processes or destination IPs, which you consider are trusted and should be bypassed even when he determines that the likelihood of a process being malicious is.20:53It's is high so the interesting part of this.21:10Part of our demo as discussed is basically the fact that we were able to identify an encrypted application without having to use a decryption policy for that purpose. In this second part of our demo, we highlight if Unix malware detection cap.21:27Abilities and the power of the power of TLS fingerprints with destination context metadata.21:47We'll be using a malware sample with a threat score value of 95 in secure malware analytics and high TLS network activity. So the sample was identified by 21 antiviruses as malicious.21:53As a malicious 32 bit portable executable, this ample connects to a high risk domain which is usually blocked by umbrella. It also modifies the registry to load itself upon a startup.22:10Concerning its network activity, the malware starts by resolving the name of a NO malicious site, which is space been.com from where it downloads 2nd stage payload over an encrypted TLS session.22:302nd name resolution targets its common and control server as we can see here. The malware connects to the common and control server over HTTP. So let's check the.22:46There are two DNS requests in totals, one for.com and 2nd one to the common and control server. Let's check our access policy in our sandbox firewall. The 1st rule allows DNS.23:06Next resolution to an internal server. We're protecting our internal net internal network in 2nd rule, since we already know how the sample works, a 3rd rule is configured to geographically block access to the suspicious command and control servers just in case.23:24The 4th rule allows internet access only and a cleanup rule at the bottom to deny everything else. So now we're going to configure if to block malicious traffic based on a threshold value of 95.23:44Click ok save and so in our sandbox Windows PC, this is the sample we downloaded from secure malware analytics.24:06When we extract the sample, it is instantly detected by local antivirus and recognized as a backdoor threat. To run the sample, we need to temporarily disable the antivirus protection.24:25Now we should be able to extract the sample.24:48And executing it after enabling live logs. So let's do that. So almost immediately after running this block with the reason encrypted visibility block.24:51If successfully identified this traffic has been created by process with a confidence confidence score of 99 %, the details in the fingerprint show the power of adding destination context IP to the equation.25:15So even though only 33 % of the samples with a given fingerprint are sourced from 96 % of them reached out to the IP address we blocked. So this is what anyone was talking about before and.25:31A closer look to the network activity shows that the process started by resolving the name of basebin.com. Right after that it connects to the website trying to download 2nd stage code.25:51And this is the connection if not. Interestingly.com is not a malicious site, it's not it is a non malicious collaboration application with a low risk scored medium business relevance as we can see.26:06Here. We could even go to the website and see what it is about so so even though this is a well known collaboration application.26:22It can be used by a malicious actor to post an base 64 encoded second stage binaries. So now let's disable if and run the sample again. Well, basically we're disabling here ifs capabilities to block malware traffic.26:42So we're refreshing live logs and running the malware sample again. And as you can see, we were able to block 2nd common and control connection thanks to our geolocation rule. This is the just in case rule we can figure because we were aware of the behavior.27:13Of the sample full network inspection shows that the connection based pin.com was successful this time. This means the malware was able to download 2nd stage binaries and I tried to connect to the command and control server, so.27:31And basically the connection to pacebin.com was successful even though now that we have disabled if the connection was blocked, 2nd stage connection was blocked only because we were aware.27:50Of the behavior of the sample, right? So I hope these examples were useful to highlight the value of each application detectors and malware blocking capabilities court in the fingerprint and destination context information.28:08Thank you. Great, thank you, Alexander for a great demo. So as we saw, it's all about calculating risk and we have discussed how it will operate with high risk connections.28:27But we have taken the, this capability capabilities one step further with intelligent decryption bypass, which is a feature that is available from version seven.28:45The traffic is low risk enough to bypass decryption altogether.29:19The way we determine if traffic is truly low risk is from Talos URL categorization. Talos assigns an untrusted through trusted reputation score to the destination server. This way we have a strong confidence that client and server can.29:24Create such a low risk connection that you can avoid decryption and focus resources on medium to higher risk. So let's look at some examples. Let's say that we have malware and similar to the one that Alexander showed.29:42In the demo, if it's going to already identify that this connection is high risk and it will be blocked, Health reputation is being factored in, but it will.29:59Doesn't outweigh the risk posed by malware. Next, if we have Firefox running and it's connecting to.com, it's still going to be decrypted because the connection doesn't meet the threshold to be bypassed.30:15Tells is still indicating this website has a favorable reputation, but the risk is still too high to not decrypt this traffic. Now in this example, we are in a situation where Firefox is running.30:35But it is now connecting to a site marked as entrusted by Talos.30:54Intelligence will block that, that connection because the risk can be more accurately accessed because of that additional data that is available to us from Talos. Finally, we have this example.31:00Of Cisco secure endpoint which which has a very low threat level connecting to which has a profit reputation. If if says that the client process is a very low risk.31:19And the server that it's being connected to is a trusted server, the likelihood that anything bad will happen in this connection is very low. Actually, in testing, we have seen that up to 45 % of outbound connections.31:35Meet the criteria of a low risk connection, which means there is a fantastic opportunity to decrypt intelligently and continue to maintain the important balance of granularity and simplicity in your decryption practices.31:51So we have addressed high risk and low risk connections, but at the end of the day, we are still going to be decrypting the majority of outbound traffic which falls in that medium risk category. That's why we take our intelligent decryption software capabilities another step further.32:12By offering hardware optimized for decryption.32:32When you do need to decrypt, hardware capabilities like crypto acceleration and flow offload will help you to boost performance. And the best news is.32:36We have been able to prove the value of our software and hardware combination in 3rd party testing. Let's take open, which is a non profit that conducts open and transparent testing in partnership with top labs, tested the ability of Cisco secure Firewall to maintain threat detection and prevent.32:53While simulating real world traffic both legit user traffic and malicious traffic. We actually saw a 2.4 X better price for performance than our leading competitor in this test.33:14Which is pretty cool and validates effectively discussed decryption advantage. In summary, we have seen today how encrypted visibility engine can help organizations to make better decryption decisions with.33:29Fewer trade offs.33:49We have continued to invest in making decryption something as straightforward to implement as possible. When it comes to decryption, it's possible to make the best possible decryption decisions without trade offs. But it's only possible because of extensive feasibility Cisco is.33:51Uniquely positioned to take advantage of and we are excited to share that visibility with you. And with that, we are going to conclude the presentation. I don't know if there's any unanswered questions.34:11In the Q and A panel, I don't see any at this time yeah but if you have any any questions alright thank you Onya and Alexander for a great presentation, and thank you all again for spending time with us in this topic and for all the good for the questions that we.34:29Did get. Are the one just popped up? Are there any performance considerations for the 2120 FTD? Oh, actually.34:49For based on overall testing that has been done when enabling if, the percentage of CPU increase is approximately 1 %. And that's be that's the behavior that we have seen across multiple platforms.35:07I think it's worth noting as well that the trade off as you were mentioning is very minimal when you compare that with other solutions like having full encryption policy configured.35:29Which requires not only like more usage of the CPU or resources on the machine, but also like it of course impacts the speed of the traffic or on the performance of the of the traffic through the unit when the firewall has to resign certificate.35:47It's right. So the, the good thing about if in this part is that the trade off is way minimal in terms of performance even for a unit like the for our family finished as the 2100s.36:07So yes, just wanted to add the issue. Any other questions? Alright, thank you again please you'll receive a serve.36:23Day and be on the lookout for both Q and A, email and invites for our next feature focus session. So thank you again and enjoy the rest of your day.36:41