Cisco Umbrella SIG What’s New and Next

Thank you Rachel. Hi everyone, I'm Nikisa Taymorian. I'm on our Cisco security product team. Thank you so much for joining our umbrella product update today. Really happy to have you all. So today we're gonna be talking about new AI driven capabilities, as well as new upgrade.00:04The paths to help you maximize the potential of your existing umbrella subscription.00:23Okay, so let's take a look now at our journey forward for today's session. We're gonna start with an important but brief administrative update around your AWS S3 bucket key rotation. And after we get that quick administrative update out of the way, we're gonna be talking.00:31Talking about new DNS security innovations. These are new AI driven innovations that are available today for all of you with your umbrella six subscription.00:51And you do not need to pay more to get these, these new capabilities and that strengthened security. From there, 2nd half of the, the webinar today, we're gonna be talking about the SSE evolution at Cisco. So the, the evolution.01:03Of Umbrella to secure access and for this portion I'm we're gonna be detailing for you the the details of that SSE evolution at Cisco and how we're simplifying for you our umbrella customers that evolution to zero trust. So for this portion of our presentation.01:23My colleague Prabhu is going to cover key differentiators for Cisco Secure Access and do some really exciting demos. So he'll be talking about our unified CTNA with a single client, a single dashboard, and then we will wrap up the presentation by.01:44You're talking to you about how we can help simplify your upgrade.02:03So I I do want to make it clear that when you are ready to upgrade to secure access, we are here to help you. You are not required to upgrade to secure access, but when you learn about all the great added capabilities you're gonna get with secure access at NO added cost.02:09I definitely want to encourage all of you to consider planning your migration to Cisco Secure Access. As Rachel mentioned when she opened the session, we definitely want to hear your questions, so please post those in the Q and A window. We do have experts on the line.02:29And who are ready to answer your questions. And with that, I will hand it over to my colleague Matt to talk to us about the AWS key rotation.02:49Thanks, just wanted to kind of go through a minor change that we introduced for both Umbrella and the secure access product for folks that have offline storage of their reporting, so they would be using the S3 service from Amazon to maintain a backlog or log of your logs that keep.02:59Being offline storage of your reporting. You can have, there's two ways you can configure this. One of them can be via Cisco managed S3 storage or you can have self managed. You can have your own Cisco or sorry, your own Amazon S3 bucket. A lots of folks have chosen to have the Cisco managed one, and as part of our best security best practices.03:18We've introduced a rotation key requirement. We're asking folks to rotate their keys to log into their own bucket every 90 days. This is just to ensure security best practice. Those Amazon S3 buckets are, you know, they contain the logging information from your organization, and the authentication.03:39To that bucket is, is owned by you, but at the end of the day, we don't want people losing access to a Cisco managed offline storage where there is.03:58PII and important important sensitive data. So this rotation has been put in place already. It's a mandatory rotation. Every 90 days you'll be asked to rotate those keys. You will receive in product notification, so when you log into your umbrella dashboard, there will be a or a secure access dashboard. There'll be a reminder to rotate your key.04:09As you get closer to that 90 day expiry. There are ways you can do this automatically. So one of the recommendations we would have for folks who don't want to have to, you know, log in every 90 days and do this is set up an API, the script to do the rotation on your behalf, and this can be done via an automated script and.04:29Pretty pretty easily pro programmable to fit into into any integrations you have. That information's available on our API documentation website. I'll post a link in the chat after I'm wrapped up here. And then lastly, you know, this is a major hurdle for you.04:49We do offer the ability to have your own self self managed bucket, meaning that you you you would own the rotation times and requirements around how long your data retention would be. So it's it really, really depends on, you know, what your requirements are for your organization, but we want to make sure that we're protecting our customers with best practices here. So that.05:05That's been the the security update on our side.05:25And with all that said, I'll hand it over to my colleague Phil for some more introductions about security innovations. Thank you Matt. Hi, I'm Phil Dignard. I'm a product manager with the DNS resolvers. I've I'm really excited to talk about something that we've started doing since the early January this year.05:29That's AI based real time detection for DNS tunneling if we want to advance the slide. I'm gonna spend a little bit of time, actually I'm probably gonna spend more time defining the problem than defining the solution, but that's why you come to us at the end of the day, this is just a box for you to check.05:48And speaking of checks, you don't have to pay any more for this, you don't have to migrate off the platform. If you wanted to vendor me, I think there's gonna be a QR code up here.06:09No, we weren't, we weren't gonna do that. Okay, but ultimately this is, you know, this is not a sales pitch. This is something that we've already done and it's available in Umbrella as, as well as in secure access, so NO big changes required. Typical DNS protection will we'll talk about this 1st sort of.06:19Like what we think about most of the time when you're using DNS as an added layer in, in your protection suite, you have, before any web traffic occurs, the clients will make a DNS lookup. And there's a destination that the client has in mind, and we're just asking for the name of that. The question.06:39And comes to the DNS resolvers, whether it's us or whoever else is either, you know, locally configured or somebody else's public resolver anycast or local DNS forwarders, and they go and they find the answer. They recurse from their routes, they talk to the authoritative name servers for.com.org.06:59And all the other TLDs and then they follow delegations and they reach an answer. And.07:19As that answer is coming back, the resolver will look at whatever rules or policies are configured and will apply them accordingly. So if there's a content restriction because the destination matches something unsavory like, you know, productography or.07:25It has a malware classification that's known then that's where the block will happen and that's usually a redirect to a single.07:45So, the, the, the danger here or the place where this, where harm can usually be caused is after the DNS lookup has happened and the client then takes that IP address and makes an HTTP or HTTPS connection or, you know, SSH.07:52For FTP or some other protocol.08:12Towards their evil destination, and we're performing our block just by intercepting a client for getting information about where it's planning to go. So if we go to the next slide, we can talk about the new emergent threat that's really been.08:14You know, at least in theory around for for probably the better part of a decade and a half now. Next slide please. Ah yes, there we go.08:34Alright, so DNS tunneling is really a data exfiltration encoded in the DNS query itself. And this is different than just taking evil traffic and disguising it as port 53 to sneak through a firewall. This is regular DNS requests that are being passed through by the resolvers.08:52And forwarders that have encoded data in the name itself. Firewalls will pass this traffic because you're still talking to.09:12Your normal DNS server, this is building a covert channel that's really hard for even things like intrusion prevention systems to get any context or understanding of. It's, something where, you know, once again, like if you're looking at just port and protocol, source and destination.09:21None of that is really outside of the ordinary because you're still talking to your, what maybe very trusted DNS server and sometimes even with an end to end encrypted connection. And the harm is that data is able to be exfiltrated while the resolver is doing its normal job and that is, I have a name that.09:42I have to look up and I start contacting all the authorities in order to trace the delegations to get to a final result.10:01But in that process, the contents of a name, have to be provided to whoever the name's owner is. And if the owner of that name is somebody evil, then, just the question itself is going to be causing harm. Usually.10:08Really for you know leaking large amounts of information, maybe, you know, something like password harvesting or any other types of data exfiltration or even two way communication for things like a reverse shell or even a, a VPN. So if we take a look at the next slide, we can see the.10:28We can sort of see the layout here. So, so we're looking at the same layout as we did last time. We have a client that has now been compromised with something that is going to start generating DNS requests for to perform tunneling or command and control through it or.10:47Or any sort of beaconing. And if we, I think if we hit advance, you'll get some overlay there. All right, so I'm gonna steal Curtis, my colleague, Curtis I'm gonna steal his password, which is 1234. It's funny it's the same one I use.11:08I'm gonna encode that base 32 and I'm gonna put that into the name of, name that I control off of evil.com, and I'm gonna just send a DNS lookup for it. And once again I'm I'm not really gonna care about the information that's coming back. I don't care if this resolves to an IP address or.11:21Or an NX domain response or a block page. If this name is able to go through the DNS resolver during its recursion, and it eventually reaches, where the bad stuff's happened with the delegated name service for evil.com, then as soon as I get a lookup for that name, I've got Curtis's password or any other.11:41Other data that I wanted to exfiltrate.12:01So our solution to this is, you know, to augment traditional, you know, list based detection systems evil.com looks very evil, you know, Talos and all of their proactive research and their data sharing and, you know, agreements with over, you know, three.12:05Hundred individual parties for for sharing threat data. If they know about evil.com ahead of time, then it'll have a classification already.12:24And, you know, their goal is to just shorten that time as much as possible, so problem solved. DNS tunneling is very, sometimes it can be very targeted. These name servers can be very ephemeral. Usually there's NO prior indication.12:33To, to their evilness, and so it's very difficult to sort of proactively block them especially because they'll they're so ephemeral, they'll be spun up for a specific purpose. The name will be purchased or somebody will purchase a name and sit on it for a long period of time and then execute and then they'll be gone in less than 24.12:49Hours. So we need something, we need something that can react to that a little bit faster and something that we've been relying on for quite some time has been machine learning algorithms, and we've, as of earlier this January, we've gone to a convolutional neural network, which is AI, but it's very different.13:09Then somebody saying oh we've added AI to the product by adding a chatbot to your thermostat. This is, this is not generative AI. This is.13:29Very specifically trained on data sets that our Talos research team has accumulated of tunneling traffic, and with these very, very large data sets, we've been able to not only train this convolutional neural network, but we're able to run this in real time inside of our resolvers to look at.13:39At these names as they're being formulated and queried through us in order to make a determination in real time. And once we've accumulated enough of of a match to these patterns for known exfiltration techniques, we're able to block in real time on the resolvers without having to go back with maybe what some of our competitors.13:59Maybe doing and that is serve all the DNS requests, gather up the logs, ship them centrally, run that through somebody's scripts, and then make a determination and then try to ship that as a list back for blocking. We do everything on the resolver and we're able to perform this checking with.14:19Less than one millisecond of overhead while serving a DNS request and applying all of your other, you know, security policies and, and other protections as well. So, and this is not a new feature checkbox that you have to check. We've rolled this into the DNS tunneling VPN category.14:38So if you look in your security categories for what you're blocking in umbrella or possibly secure access, if you have this category selected, you are already protected. There is nothing additional for you to do other than check your reports and see if you start noticing any hits and if so.14:57You may need to chase down some machines and and look for sources of compromise.15:17But, we're really excited about that. If you have any other really specific or deep dive questions, I can't wait to answer them for you. But the next question that you may have is, now that we've done this, where do we go from here? And the answer is we go to Curtis. Curtis?15:23Okay, so next slide please. We're gonna take it right over to our actually two more slides from now that the one thing that and I'll tell you what, we'll go back one slide here just for a second. So one of the things that I'll I'll talk about in particular with the DNS tunneling is we do we do a lot of research with our Talos threat intelligence team.15:44And and as a product team, we're continually looking at how do we take, you know, the future or forward looking threats, whether that's things that, that we see in the field or we are informed through our our threat research or incident response teams and just general trends in the field. So as part of the DNS tunneling.16:04You know, algorithm that we built. One of the things that's I think it's kind of interesting to call out is that what we've been able to do is improve our real detections in real time to 99.1 %. And so, you know, for, for those of you that are are you know statisticians or or working these algorithms, this is the the.16:24Monic mean of precision and recall. So recall is your ability to continually detect these things consistently and precision is with the the accuracy of false positives and false negatives. So, you know, when you have aa99 .1 %, you know, F one score, it's, it's really, really good. We've also.16:44Through through this process being able to reduce our false positive rates from 26 % down to 2 %. And Phil had mentioned kind of the the performance of this.17:04As it stands, you know, as we launch this, we are seeing upwards of 500 DNS tunneling detections per second. Now, this doesn't necessarily mean that there's 500 attempts to, to exfiltrate data, but cause a lot of times you'll see things like retries or you know a request will fail. So, so the client.17:13It will just continually retry. But at the end of the day, this is, this is a threat that we're seeing, you know, very much within, you know, our global worldwide resolver fleet, and it's a it's a we're very proud of the fact that you know we can do this detection in real time using an AI algorithm in the backend.17:33So now to hop over to what is the the next evolution? This is our our domain generation algorithm detection. And so just to give you a little bit of background, you know, what are dgas? So dgas are domain generation algorithms, and effectively what what adversaries will do is they'll generate this large number of.17:52Of of domains in order to maintain their persistence you know once they they obtain a foothold within your your environment. And so whether that's for command and control, data exfiltration or what have you, what it is, it's effectively a resiliency tactic for attackers you know that have that have you know.18:12Did your your territory and the primary use for djas are actually within malware.18:32And so as I mentioned, you know, it's intended for abating detection and resiliency. And, you know, when you look at what the general challenges are and trying to detect djas, it's the general scale of how quickly these domains can be generated, the algorithms as they evolve, things like doing fast blocks where they rotate the IP addresses that are by.18:39Kind of domain name, and then at the end of the day, the other part that's really difficult with both DGA detection and DNS tunneling is that there's a large amount of similarity with legitimate domains. So, you know, you think about things like you know goods and API calls and such, and you'll see what would appear to be in many cases, you know, encoded data.18:59Or, you know, a lot of these, these evolving requests and it's actually legitimate. So, you know, it becomes very, very difficult to to kind of separate the good from the bad. Now, that's then when you look at the scale of what we're dealing with over, you know, 90 % of command and control malware uses DNS.19:19For communication, and there are over currently over 50 malware families that use DGA or DGA like techniques to avoid detection and maintain their, their foothold.19:39To give you an idea, what we see from a scale perspective is that there's, you know, over a hundred thousand domain registrations per day. We see within our resolver fleet over 300000 new domain requests per day. And looking at some of the netcraft stats.19:51There's over 1.1 billion registered websites with 35.4 million added in 2025 and we're in now in June so I would suspect that my my number there is probably about a month out of date and that's grown again. We see over 800 billion requests.20:08After that.20:27Phil quite often at this point will usually jump in and remind me that there are times where we peek over a trillion requests per day, so I'll preempt you this time Phil. So what are the general problems you know as we start to try and detect this? If you look at the the general solutions that have been in the.20:29Industry today, there's reputation systems. So the challenge being is that by the time you understand that, you know, this is a potentially a domain generation algorithm and you've seen a large set of domains being generated.20:48You have this lag time between the reputation, the reputation conviction, and then the update of, you know, kind of these DGA lists or or you know convictions, if you will. The other thing that, that you can do and and we do this as well is reverse engineer some of the DJA algorithms. Same sort of thing.21:01In that it's reactive, in that you need to get a sample, the algorithm, you need to reverse engineer it, and it's a little bit better than reputation because what it allows you to do by understanding the algorithm is you can do predictive algorithms against what are the domains that it's going to generate, but still at the end of the day, given that the, these.21:21Quickly, you're kind of on your back foot from a defense perspective. And then the other obvious is that to try and do this manually with a, with a non per sock type team, it's virtually impossible.21:42And to give you an idea, this is going way back to to 2008 to give you some sort of a view as to what the malware families are doing. Conflictor A released in 2008, initially started out with 250 domain generation.21:54I guess generations per day. Configure C, which was only released nine months later, was actually generating 50000 new domains per day. So, you know, you can just imagine now how the scale of the problem that we're trying to deal with, has, has evolved. And so what we've done, you know.22:12I mean you can go on to the next slide here.22:32So what we've done is we've taken this, the kind of same sort of convolutional neural network and we've applied this, the same problem that we've dealt with in DNS tunneling to DGA detection Cause what you find is that there are patterns and that there are similarities between encoded data and large number of domain generations, so again.22:34Working with our threat research team, we took, you know, this massive data set that we have and we trained our algorithm to detect domain generation algorithms.22:54What this has done for us is we've been able to improve from 68 % detection to 88.1 % detection, and again, this is the harmonic mean of precision and recall. We've been able to actually take the false positive and false negative rates because again, this is a very difficult problem to detect.23:05And we've narrowed this aperture by reducing the false positive and the false negative rates by 50 %. And so when you take this in conjunction with.23:24The DNS tunneling detection and DGA detection in the, the malware that is generating these domains that are used for DNS tunneling. It's all part of this continual updates and this layered defense approach. So similarly, this is, you know, where we've taken AI and applied it to security. As Phil previously mentioned, this.23:33Comes for free. This is already built into our security category for malware, so if you are a customer that has the malware security category checked, the day that we released this, your.23:53Action just immediately expanded by, by a lot. And so this is just some of the things that that we're doing behind the scenes, if you will, to continually improve our product and better protect your, your estate. And with that, I'll hand it off.24:07Thank you Curtis, and thank you Phil. I really appreciate those updates and amazing work to both of you getting these innovations into into the product. Okay, so for 2nd part of our webinar today, I want to talk to you all about the SSE evolution. So.24:25In this portion of the presentation, we're gonna be talking about the evolution of Umbrella to secure access. And as I mentioned earlier in the presentation, when you are ready to upgrade from Umbrella to Secure Access, we are here to support you and to make that transition s.24:44Move and seamless for you. You are not required to make this move, but I definitely want to encourage you all to do so. And when you see all of the added capability, you're gonna get with secure access when we get to probe's portion of the presentation and that you're getting all of.25:04This capability with NO added cost, it's really a NO brainer to make the move to secure access. It's really just a matter of when it works for you.25:24And I've personally spoken to a number of, of umbrella customers who've moved to secure access and they are just thrilled with the added capabilities, the improvements to their user experience, especially with regards to accessing private applications, the unified dashboard, so.25:35So again, really wanna encourage you all to, to consider migrating when it works for, for you.25:55Okay, so a lot of you may have seen this product family, slide before. Those of you on the call today, you are umbrella SIG customers, so you are familiar with the SIG capability. Secure access is our full SSE solution, and it is.26:02The evolution of umbrella. I've heard some of our customers call it Umbrella two dotto. And it includes all of that core umbrella SIG capability, but it also includes the, the private access capability. So this is the zero trust network access.26:22VPN as a service, AI access, digital experience monitoring from thousand eyes and more.26:42Next slide, please. Okay, so now I wanna share with you guys a little bit about what the packages look like. So on the left hand side, we have our umbrella SIG package, and in the middle here we have the secure internet access SIA package of secure access.26:51So you have the ability as an umbrella SIG customer to migrate to secure internet access at NO additional cost. So you're getting all of that core SIG capability and you're also getting digital experience monitoring. This is one of the the features that our customers get most excited about.27:11When they see the demo, so it really simplifies your troubleshooting. You're also getting that full AI access, capability that my colleague Prabhu is gonna demo in just a moment, as well as you're getting the remote browser isolation, and this is available in both the essentials and Advantage SIA packages.27:31And on the right hand side here, you have the secure access SPA package secure private access. So this is an optional add on, and this is where that ZTNA and VPN as a service capabilities coming in. And what's great about this is SIA and SPA share the.27:51Same policy construct. So you have unified policies, unified dashboard, same client, single client. So it's really a differentiated experience in the SSE arena. Next slide please.28:11Okay, so now I'm gonna hand it over to my amazing colleague Prabhu, who's gonna talk us through the key differentiators for secure access. Over to you Prabhu. Awesome. Thank you. Thank you, Naghia. Hey, everyone, good to meet you all. My name is. I'm a global security tech.28:27Here at Cisco. So the next couple of minutes, we'll talk about a few key capabilities in secure access that will sort of help provide some differentiation and hopefully gives you an idea of what are some of the capabilities within secure access. But before I start, I wanted to sort of start where, you know.28:47A lot of times when we think about traditional ZTNA, traditional ZTNA or zero trust network access is something that really took off when you think about the pandemic as an example, right?29:06Where we wanted to be able to provide a way for us to provide a managed user who was a remote user in that situation, provide them access to private applications without the need for a VPN sort of in the middle. Now, as folks started to come back to the office, specifically, we started to notice a couple things.29:18The number one was a sort of, you know, different policies, especially when you were at home versus the office. 2nd one is more fundamental where if you think about how we've sort of done policy for.29:38You know, forever pretty much is that there is a little bit of a blind trust between authentication and access. And I want to what I mean by that is once you have created sort of, you've provided access to a user, they're sort of free to go access whatever private application or internet application they want to be able to sort of get to, without sort of.29:49The continuous way for us to monitor that activity in the middle.30:09This is one of the things that we're sort of trying to solve with how we're sort of approaching universal detailing from Cisco. So the 1st one is, as you would expect, you know, we want to be able to provide a fantastic experience to users coming in from a managed device, be it, be there if they're in the home office or remote.30:13And 2nd one is we want to be able to extend these capabilities to also unmanaged devices. So we we we're seeing a huge number of folks obviously wanting to access private applications from things like mobile devices. And what we've done is actually embedded the zero trust access client into more the mobile operating systems like iOS.30:33It's an android.30:53But then also take that experience one step further with things like the enterprise browser that we get from Google Chrome. So it's the same google Chrome experience that everyone loves, but being able to also provide enterprise grade capabilities like, you know, being able to do things like copy blocking copy paste, downloads, data loss prevention locally on.30:54From the chrome browser itself. We also want to be able to address things like, you know, when I say things, think about the explosion of things like cameras, smart factories, and, you know, enginetic AI systems as well, but also be able to extend the security to non human users in that sort of situation. But if you think about what's common between all of.31:14These things that are on the left, they all need access to applications. This could be private applications, these could be internet applications and so on and so forth. But we want to be able to do this in a very, very seamless way. So sort of pointed to this a little bit earlier.31:34Using something like a unified policy engine that we have within secure access, this allows us to provide a very, very seamless access to all apps, and we also are able to deliver this without hairpinning traffic to the cloud for all for reinforcement. So think about the use case where if you're a an office user.31:50Even though you're in office, you would be, you would require to be and do your policy enforcement would happen at one of our cloud pops, but what what if you didn't have to do that? So what if we had a mechanism for us to do that enforcement on premises? That's one of the things that we're allowed we're offering with our FDD firewall integration that we offer.32:10Offer with secure access.32:30The thing that powers all of this, and I want you to sort of take one of the key takeaways that I want you to think about is that all of this is powered because of the fact that we have a single unified client insecure client, but it provides multiple functions. So what started to traditionally as a, as our anyconnect VPN client, we've.32:31Obviously modularize that over time to be able to deliver obviously ZTNA.32:51But also extend this to things like, you know, secure internet access, all the DNS link DNS capabilities that we talked about previously, but also be able to extend that into digital experience monitoring, device posture. So one of the key takeaways that I will want you to sort of think about is all of this is powered ultimately by a secure client that you already sort of got.32:55Actually using onto the hook.33:15And from a user perspective, this is very, very key and this is something we've heard very a lot of times from a lot of our customers is the user experience. You know, we oftentimes talk about security, but security only will go as far as, you know, how easy it is for the user to access or user to you know be able to absorb.33:17Those things. So from a user perspective, think about like, you know, we step one, we go ahead, authenticate the user, we can couple that with something like dual passport, which allows us to provide a seamless authentication experience to the user. And they're kind of off the races, right? You know, they get access, secure access and are.33:37The hood we take care of the plumbing. But in addition to that, we're also continuously assessing whether, you know, who you say you are. We are not just we're sort of going past that 1st step of just authenticating and providing your access, but we're also continuously assessing.33:57Along the way as to like whether you're doing all the actions that you're saying you're gonna be able to do. This is one of the things that allows us to sort of provide this flexible journey for customers to be able to adopt universal. A lot of times when we talk to customers.34:12We oftentimes find that, you know, the, the ZTNA projects are kind of stalled, and one of the key reasons is because folks still require a need to continue using a VPN, and because we're able to provide this functionality within the same secure client, we're able to say you're able to now set the pace of your ZTNA adoption.34:27We talked about the same client, but also the common policy framework. That is one of the key things that allows us to sort of take this journey. So if you think about where you started, like, you know, a lot of folks are still using traditional VPN which provides that network level access. But the 1st step in that situation is to leverage something like VPN as a service where we can lift and shift the existing VPN.34:47Controls and move this into the cloud. This is a truly cloud delivered service where we're actually providing you a true VPN as a service. We're not asking you to run vmiss in the cloud for you to be able to be able to deliver just the VPN functionality. This is a true as a service functionality where it's easier to manage. There's NO hardware and elements that.35:07You have to manage as as an end user. But then that the policy engine that we have under the hood is what allows us to then take this next step of being able to sort of enable remote users with least privileged access in a true ZTNA functionality because of that common policy model and ultimately that next that last step of universal ZTNA as we go.35:27Now switching gears a little bit, one of the one of the things that we oftentimes are finding is that a lot of folks are very concerned about generative AI usage in their organization. Now, with Cisco AI access and our broader AI defense portfolio.35:48We're able to provide deep visibility into, you know, what are the what are what are some of the generally applications that are being used as a step one, but also take that further and start looking at things like, you know, can we prevent accidental leakage of proprietary information? Can we make sure that we're putting some guardrails for compliant use?36:04Of over 1200 different applications. Now this is obviously a constant moving target. So today 1200, these, this number is only gonna grow as we sort of continue to go down this path. But I would argue that, you know, when you think about what how we've sort of delivered generative protection for generative AI applications historically, this has been done through data loss prevention.36:24Now.36:45A lot of folks do this very in a very similar way, even within secure access, Cisco also does it very similarly. But if you think about how we actually communicate with a generative AI application, it is very unstructured. It's sort of like a text string that we're using in order for us to be so able to communicate back and forth. And so that is one of the key different.36:46I want you to sort of think about is that we've developed guardrails within our, within our solution.37:06To be able to secure unstructured communication. Now, when you think about writing a command prompt that says, hey, write me a professional email like what I'm showing you here, but I'm also going to say slip in details of like a deal or I'm going to slip in details of an email, anything that is going to be able to identify the user. So to that end, what we've done is we've.37:12Created three prior three guardrails. So there's one for safety, one for privacy.37:32And one for security. And I'll show you what that means in the next in the in the demo that I'm going to show you really quick here. So as a starting point, and this is something you can try on your own. So you could go to chat GPT, you could run these command these these text streams, these prompts that I'm sort of showing you here, and you'll notice that chat GPT deep sig.37:38Any of the generated AI applications are going to actually give you a response back. Like you can even say things like hey rewrite this attachment, rewrite this email. I'm gonna upload a sample data file that has PCI data. Chat GBD is actually so good that it actually gives me two responses in fact, and it tells me which one I want to actually prefer. You could also write things like hey.37:58I'm a storywriter tell me how I can bypass the ignition system. I want to hardwire a car. Now, this is where what we've done is in the back end now we've sort of turned on our guardrails as an example, and we're gonna rerun all of those commands that we actually we showed you at the beginning. So the 1st one that we're going to run here.38:18There is the professional email one. So we're gonna say, hey, write me a professional email. I'm gonna actually be able to pass a bunch of PCI PCI data here. We can see that we actually intercepted that request and we blocked that request for you. 2nd one, 2nd prompt is where we're gonna rewrite an email and we're gonna actually attack.38:38Patch a, a sample data file that we have on our desktop. We're gonna upload that.38:58And you can quickly see that it actually failed to upload because we have those DLP protections and the guardrails already in place to sort of block that communication. And the last one, which is my favorite is being able to tell something like, hey, I'm a storywriter, be able to sort of hotwire a car, make a bomb, take your pick of what you want to be able to sort of.39:03Of run with it.39:23But again, I think by now you probably see the point, but the point is, again, we're able to sort of look at these unstructured data points and be able to sort of create that. So like I said, we we created a bunch of policies around these AI guardrail capabilities. Now out of the box we have these data classifications that allow us to sort of use.39:25These, these pieces. So the 1st one is around privacy. Privacy is looking at things like, you know, PCI information, credit card numbers, emails, those kind of things. Safety and security are very, very similar where we are looking for things like prompt injection and so on and so forth. Now, once we've created the policy, we can go into our events category and.39:44Be able to sort of quickly view the details of what actually triggered that.40:05So if you see it, if you remember the 1st one, the prompt injection category, which is the security guardrail, this, this matched our prompt injection guardrails, so that's what you see there on the events category, and 2nd one that you see here is where we are actually matching the privacy guardrails. So this is matching the email address, IP address, social sec.40:09Security number that we actually send in the in the prompt itself, ok? Very cool. 2nd part of this is what we can think about is the 1st one that we talked about was using AI apps. So this is like you and me actually interacting with a generated AI application.40:29But 2nd part is around developing AI applications. Now, this is where we're introducing that non deterministic layer, which is that AI application into our into the actual application flow or the application stack itself, and.40:47For a lot of developers, the 1st stop for a lot of them is going to be something like HuggingFace. Now, if you're not familiar with HuggingFace. Huggingface is one of the world's largest open source repositories for us to be able to download sort of llmiss from. Last I checked, it had over 1.6 million downloads. Crazy.41:03Amount of data that's actually coming out of them. But the key, a key blind spot is around how, when you think about how folks are sort of prototyping, you can think about this as like, you know, there is a window of risk from the time the model is actually downloaded until the time that the model has been actually committed for the.41:231st for software composition analysis and so on and so forth. And why, what sort of things that we're sort of looking for?41:43So we want to be able to stop risky models before a user is starting to sort of use them. You can almost think of this as like pre use enforcement and there's three main categories that we want to be able to look for. So number one is around malicious code, so being able to sort of detect and be able to see that, hey, if someone's downloading.41:49An open source LLM, does that LLM itself have malicious code locks in it that someone can execute remotely? 2nd one is around intellectual property compliance. There's a ton of models out there which have copy left licensing implications. So making sure that as developers are downloading these models, making sure that they are.42:09Are in compliance from a copy left licensing standpoint. The 3rd one is around origin compliance, making sure that when people are downloading models, what is the origin of the model itself? Are there certain, certain places that we want to be able to sort of block for as an example, right?42:29So what does this look like from a user standpoint? So here we have a user who goes to deepseq because they heard, you know, we should be using deepsec R one which came up. Now this is this demo was actually recorded a couple months about a month ago in May and back then we had about 1.3 million downloads for deep seekar one.42:46You know, very, very popular these days. Now.43:07We want to be able to get started with one of the, one of the sage tensor files. Now, as the user goes, clicks on it, we immediately are able to intercept that and say, hey, this is actually sourced from a prohibited geo. You should be actually using the private repository that we offer you. 2nd example is that it is one where we've actually embedded a.43:11A pickle bomb exploit in the file. Now this isn't this is a repository that our AI threat research team actually uses, and we're able to quickly detect that that actually has potential malicious code execution in there. Now, how does this look inside the admin console? You'll see that we have three risk categories for those things that I mentioned. You have the ability to allow or block them.43:30On day one, obviously everything will be allowed and then you could go ahead and block them as you see fit. But this screen sort of gives you an access view of all the models that people are actually accessing. Once you've sort of once you're able to sort of create those boundaries, you can then sort of see that, hey, what was the actual user? You can see the user identity, what was the desk.43:51The host name, what, what was the category of what we actually were able to block there?44:12Now that we've provided guardrails for AI usage and that seamless experience, we want to be able to provide a very, very clear end to end visibility with digital experience monitoring. Because as we sort of roll out or any of these projects, one of the key things that we oftentimes hear is the fact that we want to be able to get.44:18Visibility down to the client level. So with digital experience monitoring, we can drive really, really deep into the client itself, so being able to troubleshoot and pinpoint to say, hey, this problem actually resides on the client.44:38Versus the Wi Fi that they're on or the broadband network that they're on or is it the application itself, but be able to pinpoint really, really quickly and seamlessly to tell where that problem actually resides? I'll show you a quick demo of what this functionality looks like. Now, a key thing to sort of highlight here is the fact that DEM has a functionality.44:50It's actually embedded into the same dashboard from a use from a from for a user to be actually to be able to consume this, but you can quickly see that we're able to get a health statistics for our various endpoints. We can see, you know, there's a bunch of endpoints that have that are obviously healthy, some are at risk. We can narrow that down and say Kara is one.45:09Such user. We also are monitoring common SaaS applications for you out of the box. Now, if you want to be able to drill down specifically into Kara's user statistics and what our performance looks like, we have a very unique user specific dashboard where we could see all the user rules that are associated with her. We could also get an idea.45:30Of the allowed and blocked events that are relevant to Kara as an example. We could also look at performance stats that are coming off of the machine that she's on. We can also look at collaboration summary and endpoint posture. You can see disk encryption is not running as an example. But as an, but what's more useful here is as an example is like sec.45:50Visualization where we could see hop by hop and be able to drill down into one of those things. So in this case, we're gonna do a segment visualization for Microsoft Teams. You can see that quickly that in the, in this case the agent that's running is reporting high CPU, but you can see that all other steps that we sort of go through, the gateway, internet.46:10Even the application itself, every single point that we're able to sort of drill down into will is gonna give us information on what that user experience is like when they're actually trying to access Microsoft Teams. You could drill down obviously further in this by going into the full thousand eyes view to get an understanding of what are some of the unknown points.46:29Portions of the network in this case. E.g., if they're going over a private network, a VPN or if they're going over unknowned customer networks, we're able to also surface that information, provide statistics like loss, jitter or latency, a lot of very, very important information we could be able we are able to surface from the.46:50Full thousand eyes view as well. So God went through a lot of material there, if there are any questions, please put them in the chat, then happy to answer them for you. And I'll pass it back to you Nikisa. Thank you, Prabhu, amazing demos, great presentation, really appreciate it.47:10Yeah, so much goodness there as you can all see from the digital experience monitoring to the AI access, just a wealth of of awesome capabilities that are included with secure access. So I want to talk about.47:28Investment protection. So with, with, with the migration of Umbrella SIG to secure access SIA, you're getting that digital experience monitoring from thousand eyes. You're getting that AI access, the supply chain management capability. These are all capabilities that are part of security.47:43Your access, and you are not paying more to get access to them.48:03And beyond not having to pay more, there's more that we're doing to simplify this migration for you. So I want to share with you all that we have an upgrade manager in the works. We are expecting to roll out, this upgrade manager tool in September in the umbrella.48:08SIG dashboard. And what this does if you have a larger complicated policy set, a policy set and makes it easier for you to transition to secure access. And this upgrade manager is available for you to have your Cisco partner activate and they.48:28Activated at your request only. And another thing that I want to make sure you all are aware of as our umbrella sick customers, another great reason to consider upgrading now is to take advantage of our elevate program. So this is something I wanna make sure that you are all.48:48Aware of so next slide please. Whether you have 90 days left in your umbrella subscription or two years left, you will get investment credit for that entire unused balance that's applied to secure access. So not only is the cost the same when you upgrade.49:08From umbrella SIG to Secure Access SIA. If you want to upgrade now, you can get that investment protection.49:28So this is a partner led offer, so the reason why we say up to full subscription balanced credit is because it is up to the partner's discretion to pass on the credit, but we have recommended to our partners that they pass on that full credit to all of you.49:38As part of the elevate offer. And what's also great about the elevate offer and what our customers love about it is that they get an additional one year of umbrella for free when they upgrade to secure access. And, you know, what, what I hear from customers is that they.49:58Already have their projects planned for the next three to six months. So what this helps them do is to work that migration into their schedule whenever is best for their business, whether it be three months, six months or nine months down the line.50:17Okay, so now let's take a look at eligibility for the elevate program. So this offer is available for all umbrella SIG customers anywhere in their contract cycle, and as far as the key details, so the new term may not be less than the.50:34Existing remaining term and also you get that additional year of umbrella with $0 entitlement on top for your secure for your secure access subscription, so that enables you to migrate at your own pace, whenever it is convenient for you.50:53Okay, so let's talk now about, next steps. My colleague Rachel is going to put in the chat for you guys some recent customer stories we've put together of umbrella customers that have made them.51:18Move to secure access and have been really delighted with their transition and all the benefits they're seeing, the improved user experience, faster access to applications, less calls to their help desk, less tickets. So there's lots of great benefits our customers are seeing with the migra.51:33So again, really want to encourage you guys to consider making that move to secure access and contact your Cisco security contact a Cisco security specialist today. We'll put this link for you guys in the chat, but they're gonna help make things really smooth with the transition in terms of coordinating with your.51:54Cisco partner as well as your account team. If you have any other questions, feel free to put them in the chat. We'll be on the line here continuing to to answer those questions for the next 8 min or so that we have for this webinar. I want to thank you all for joining. Thank you so much. We hope you have a great rest of your day.52:13Okay.52:33Thank you so much Nikisa and team. Really great content shared, and we hope that you found this impactful, helpful, and as Nakisa had mentioned, we have a remaining eight or 7 min now for any final questions that you may have top of mind. So feel free to take advantage.52:37Of this time to submit those top of mind questions into the Q and A box, the question and answer box. So our technical team who is on the line can answer those for you. And additionally, if, if you don't have any questions, feel free to stay on and review que.52:57Questions that are submitted by others if they maybe relevant or of interest to you. And lastly, we do have a survey that will generate once you exit today's session. We do welcome and request your feedback. This helps us to continually improve and look at.53:17Topics that you are interested in seeing from us in the future. So please take a few moments. It's a quick survey and we look forward to hearing from you. And we also hope to see you at future sessions. We will be sending those out via newsletter and emails to keep you in tune.53:37With what we've got coming up on the calendar. Thank you again and feel free to continue to submit those final questions. We'll get those addressed before we end the session today.53:57Thank you.54:09Jumping in with a few final res.55:27Reminders. We have seen a few questions about the session. Yes, it has been recorded for today and you will receive a follow up email from us within the next 24 h with a link to today's recording. So be on the lookout for that as well. And additionally.55:29A quick reminder to utilize the Q and A box, the Q and A window for questions rather than chat so we can best keep track of the responses with our technical team. Thank you so much.55:49