Feature Focus: Cisco Secure Firewall Threat licenses Demo

Once again, thank you for joining us for this feature focused session covering the Cisco secure firewall threat licenses. My name is Harry Davis. I'm the director of customer success for the secure Firewall product line.00:10Joining me today and leading this presentation are on you Martinez Foster and Joseph Moore both customer success specialists with secure product firewall product line. Before we start a couple of housekeeping notes, please feel free to ask questions in the Q and A section and our panel will answer as many as possible.00:20In the time we have. We anticipate the material taking nearly a full hour, but we will try to answer some questions live if that's possible. Once the event ends, we'll capture and answer any outstanding questions and follow up email to all attendees. Finally, there will be a short survey asking about the webinar and an option to request further adoption assistance. With that completed, I will hand this over to kick off the session.00:35Thank you, Harry. Good morning everyone, thanks for joining us today. As Harry expressed we will be talking about the IPS threat license feature for Cisco secure firewall. This is the agenda that we have prepared for today.00:571st we will do a quick overview about Talos. Then we will go over the Cisco secure firewall licensing just to share which are the main, the main licenses that are available for Cisco secure firewall. Then we will talk about the specific features related to the IPS or.01:13Previously known as red license and we at the end we will share some resources.01:34Let's start by talking about Talos, and most of you are likely familiar with Cisco Talos, but I would like to share some insights about some insights into a day in the life of this threat intelligence research organization.01:43One of the main trends of Talos is global visibility. Talos receives and processes telemetry from from over 45 million endpoints globally detects more than 3 million malware samples every day.02:00Amounting to more than 800 billion security events observed every day, planning 193 countries and regions. Visibility into this much data is difficult for any organization to achieve. Meaning that Cisco is uniquely positioned to see threats at a massive scale.02:16Thanks to Talos threat intelligence, we have the we have valuable data set for AI and ML models to use effectively in a way that positively impacts day to day operations. Let's go now with.02:36With.02:56The Cisco secure firewall licensing. License types for Cisco secure Firewall Devices include a standard based firewall license and term based subscriptions for advanced features. Every Cisco secure Firewall comes with a perpetual essentials.02:57License, previously known as base, which provides firewalling, routing, switching, NAT VPN, user, and application control. Then we have the IPS license, previously known as threat, which provides features mainly focused on traffic inspection to block vulnerability.03:16The Exploit and anomals network behavior powered by snort.03:36We also have malware defense license that let you perform malware defense and secure malware analytics. With this feature, you can detect and block malware in files transmitted over your network. And finally we have the URL filtering license which provides category and reputation based.03:42URL filtering. In this webinar, we will be focusing on the capabilities provided by the IPS license. Which are the features that we will be covering today?04:02With the IPS or red license, there are four main features that we could enable and leverage. These features are security intelligence, intrusion prevention, we have control and we have encrypted visibility engine.04:20So let's do a deep dive on each of these features. Starting with security intelligence, we need to remember one important concept and that concept is defense in depth.04:37Defensing depth, even within a firewall is a key design goal for any security policy. FTD has a variety of controls to ensure the highest security layer as well as in four acceptable use policies.04:54The flexibility in place includes inspection and controls across layer four to layer seven packet information. Also the FTD can be configured to pull in feeds from Talos in the form of security intelligence.05:09This fits allow the firewall to intelligently block or allow flows based on IPs, URLs, and fqdns or domains. Additional layers are application control to identify and control over 7000 predefined apps.05:24Or even custom applications by creating custom application detectors and URL categories. Based on Cisco's intelligence administrators can define the processing of DNS layer requests.05:42Do you want to block certain categories or just want to want to report then user visiting those sites? Do you want to block on the reputation of a specific site based on the possibility of a site being compromised? Combining all these controls within the control policy definition process.05:58Provides a superior defense in depth layer of security. We can specifically about security intelligence. This is a function that can block the connections with the bad, with bad IP address, bad URLs or bad domains.06:18So secure intelligence can be considered as a 1st line of defense because it can block malicious traffic before it goes to further inspection. We recommend customers to use security intelligence to block known and malicious traffic as well as custom IPs, URL or domains that you want to block.06:38It can improve the efficiency to block those type of traffic at an early stage. House provides access to regularly updated security intelligence feeds. Sites representing security threats such as malware.06:58And buttons and phishing appear and disappear faster than you can update and deploy custom configurations. The system downloads updates regularly and those new threat intelligence is available without requiring you to redeploy the configuration.07:13Security intelligence allows you to block suspicious IPs, URL, domains without manual modification to the access control policy, so that's a very important feature of this, of security intelligence. Packets are inspected and blocked before it is evaluated by the access control policy or.07:36For the inspection. In this way we are reducing the risk of potentially malicious traffic that could be the that could be our network. Bits are defined and adjusted via objects menu on the FMC.07:56Also, you have the ability to immediately block any IP from events viewer dashboard by a simple right click action. And as previously mentioned, it is recommended that all the Talos, all the Talos provided URLs reputation lists are added to the security intellig.08:13Block list to maximize your security posture.08:33With this, I will pass it over to Joseph for the 1st demo of today. Thank you, Anya. I'll go ahead and share my screen here. All right, so we'll talk about how to.08:39Enable the security intelligence feature here. I did want to show the dashboard before we jumped over there. I have a couple of firewalls where we already have security intelligence enabled. So in the dashboards, in the summary dashboard, the threats tab, there is the security intelligence widgets here. These can help you get an idea of what's going on in your network and how you might.08:55You want to change your protections. There is also a dedicated security intelligence dashboard if you go to switch security intelligence. Did also want to mention this is a version ten FMC, so if the UI looks a little bit different, that is why, but everything is most of the items will still be in relatively the same place.09:15So in for the security intelligence statistics dashboard gives you a little bit more information about how those different categories are.09:35You know how much traffic is, is hitting those various categories. So from here, I'd like to jump over to a policy and show you where we can enable our security intelligence. So we'll go into our access control policies and I will select one here.09:43So this is like a new policy where we haven't set much up yet. At the top here we can see pack the flow of traffic through the firewall, so packets, pre filtered decryption, and then security intelligence is our 3rd stop.10:02So in the security intelligence tab, we have a few items that we can to go over. We have the do not block list and block list for networks and URLs, and these are pre populated with system defined objects. These system defined objects we can add to from events such as by.10:17Right clicking on an IP address and clicking add to block list and it will add it to this object.10:36So that's one of the ways we can populate these. In addition to that, you can also use custom objects, you can use custom network objects and object groups, custom URL objects and lists and feeds. You can also use.10:43The Talos provided feeds, which is they you can find those on the networks tab at the near the bottom of the list. It will be from attackers.11:03Down to tourexit node. You can optionally choose a zone, in this case, we're just gonna leave it at any and click add to block list. And the same feeds are available under the URL tab here.11:13Couple of things to note over here, you do have logging options for each of these sections separately. So if you need the logging for your security intelligence to be different than what your default settings are, say for if you're enabling syslog, then you would come in here and change those logging settings in this place. Now you'll notice.11:32Notice when we added these, by default they go into a blocking mechanism as identified by the circle with the minus. If you do have a feed that you want to test or where you just want to alert, if you right click on any of those feeds, you have the option of switching it to monitor only and it'll change to this icon.11:50So.12:10Certainly we want to be able to block as much as possible so that we're saving firewall resources by, you know, getting rid of malicious traffic as soon as possible, so we're not doing deeper inspection on things that we should already know should be gone. But if you have a scenario where you need to do monitor that is how you do it. In addition to the network, that.12:12I'm sorry I should pause there. The block list and the do not block list how those interact, the do not block list is an exception to the block list. So won't prevent traffic from being blocked by other mechanisms in the firewall, but it will.12:31Be an exception to the related security intelligence block list. In addition to the network and URL block list, we also have the DNS policy, which has a similar function that it can, it can operate on. In the DNS policy, we also have the pre populated system.12:47Created objects, and then we have the ability to do additional DNS rules. So if we come in here, give this a name, we can leave the action as do not found, and we go to the DNS tab.13:06We have the same categories here, attackers down to, to our exit node that we can add to the rule here. So that gives us the ability to block at the DNS request against domains that are known to be involved in malicious activity.13:20Once you've of course configured all this, you'll want to save and deploy. I'm gonna go ahead and jump over to our events, however. So in unified events.13:40Is where we can see our known traffic getting through here. We have a quick search here for security related connection events, now you'll notice this also has encrypted visibility.13:52And it also has these DNS block.14:11URL block, there's also IP block. You can also save a quick search. I've actually done one of those by adding additional filters such as doing this. You can do add inclusion to filter and then apply. And when you have a few filters up there, maybe you wanna come back to that easily. I have a quick search here for all security intelligence events.14:14So that's IP block URL block and DNS block, and we can look through and see the different actions and reasons that they did those blocks. Now, we can also get more details on any connection event by expanding the details on the right here.14:34Of course, a lot of the same details are here and the items that are in event details can be added to the table by using the column selector. You can also save column sets by clicking on this star here and that'll add a, a set there that you can later.14:54Reference.15:12But in this case we see the security intelligence category that was picked up on is URL malicious. I do want to mention in the configuration guide there is a list of the categories and what those categories mean if you'd like to get more details on, on how they operate. So as far as the security.15:14The intelligence portion of this?15:33That is the, the most relevant part is to know what category you're hitting so that if you, need to submit like a recategorization, you know what category it was in, you can request that from the Talos intelligence website.15:35Now, I do also want to mention in the objects menu is where the feeds and lists are stored, so under object management, we would come down to security intelligence.15:54And we would go to network list and feeds. Now you'll see the global block list is here, I didn't actually add anything yet, but you would be able to see the IP addresses that are added from events there. And then we have the system provided feed here, Cisco security intelligence. You see the update frequency is the only thing we.16:08Can change here. So you can set that down to 5 min or you can change it to a different frequency depending on your need. And likewise for DNS and URL, you can set that down to 30 min and adjust it as you need. And this is also where you would add additional custom listing feeds if you have say a 3rd party intelligence that you.16:28Like to include. So, that is the information I wanted to share on configuring security intelligence and I'll hand it back over to Anya. Perfect. Thank you, Joseph. Let me share again my screen.16:48Now let's talk about intrusion prevention and just as an overview, IPS is an inspection based solution which helps to look deeper into the data to detect and block malicious traffic.17:13It takes advantage of the experience of Cisco Talos threat intelligence. Intrusion policy consists of a set of configurations that controls snort traffic inspection. This primarily consists of.17:28Which rules are enabled and whether they are assets are set to alert or drop traffic. Snort rules can be used to detect security or policy violations as well as malicious inbound inbound or outbound traffic.17:43In inline deployment, the system can also block malicious traffic. Intrusion policy is implemented for various traffic flows via allow rules in the access control policy. Primary function of IPS is to identify potentially malicious traffic based on packet conditions.17:59Alerting based on the detected signature or stopping traffic from proceeding. Firewall brings the power of context to IPS, allowing administrators to tackle those critical alerts 1st.18:17We prioritize the events by impact flags. These are buckets of categories that segment alerts by potential impact. Administrators will want to investigate and remediate alerts that have an impact flag of one or red that are signaling an event happening against a device in your network that has the.18:35Vulnerability to the attack. Focus on those 1st and then work your way through the others. This prioritization of workflow greatly reduces the burden of overloaded IPS events. We can then pivot to tune the IPS definitions to meet the environment.18:55With the automated recommendation tool, the firewall can signal which signatures should be in place to have the highest protection while reducing the number of rules that will neighbor trigger. This allows the administrator to tune the IPS signatures with ease and reduce the rule set to improve performance.19:14And reduce IPS chatter or knowing. The system is delivered with system provided policies such as balanced security and connectivity, security over connectivity et cetera.19:34Which you can take advantage of experience of Talos. For these policies, Talos sets intrusion and inspector rule states, as well as provides the initial configurations for inspectors and other advanced settings.19:50In addition to this, Talos also provides extensive zero day coverage, offering protection against vulnerabilities which have not yet been publicly disclosed in the form of profle hunter rules.20:07These rules are discovered through in house research of private disclosure from a vendor or partner and deliver as compiled code to ensure confidentiality. More than 2500 rules are currently enabled enabled in security over connectivity based.20:22Policy.20:42In the current landscape, there are too many vulnerabilities and exploits for one organization to protect against. Even if we had signature for every single exploit out today, there will be more tomorrow. So we need an approach to def.20:48To defense that doesn't require prior knowledge to detect the function. Traditional IPS rules are based on known and fixed patterns and slight changes to payload patterns can evade static signatures. On disclosure or new vulnerabilities take time to become signatures.21:05But based on these challenges, Cisco developed snort ML, which uses machine learning to expand IPS capabilities. Train on all known embarrasements of a given vulnerability type detects new patterns for the vulnerability without an static signature.21:23Machine learning models provide a fundament fundamentally new way of detecting and blocking exploits. Machine learning models don't require knowledge of the specific vulnerability to function. Training machine learning models on entire exploit classes.21:46Provide coverage on any new exploit within that class. And with this, we will do a demo on, on IPS. And once again, starting in the dashboards, I do want to mention in the summary dashboard, there's the insurger events.22:03Dashboard which again can help you understand, you know, what kind of threats are hitting your devices and what you might need to modify to to continue addressing those threats. So, as far as configuring intrusion policy, there's a few things to talk about. So we're actually gonna go back to our access control policy 1st.22:23And in the access control policy there are two places where you can apply intrusion policy. So it's taken a little longer to load this time. I've had this happen a couple of times today where it's just a little bit longer, and we'll we'll just hit discard there. So in the.22:46Individual intrusion rules, of course, we can set the allow action and then we have the ability to set the intrusion policy on that. So there's a dropdown available here, set the intrusion policy, and it'll also set a variable set. You do have the option of changing that to a custom variable set. In this case, we're gonna use that default, and then.23:06And confirm. And we can see it adds the shield there, so any.23:26Traffic that matches that rule will now also have intrusion policy applied to it. In addition to to that, there is an option in the advanced settings I want to mention, and in this case, this has to do with the packets we firewall needs to see while it is.23:31Determining the URL and application that is in the traffic. So under network analysis and intrusion policies, we have this setting intrusion policy used before access control was determined. So when those 1st few packets are sent through the firewall before we have determined what the URL application are, this intrusion policy that we.23:51Inside here, you know, you can use one of the, the.24:11Built in base policies or one of your custom ones can be set here to apply to those 1st few packets. And that'll allow us to get, to catch some potential threats early on in the connection. So that's how we apply it to the access control policy, that is a critical part, but of course we have to configure the intrusion policy itself. So we'll.24:15Let's jump over to the intrusion policy here.24:35And you can click edit here to look at a couple of settings. So we're in inspection mode prevention and we have the base policy of balanced security and connectivity. So balanced security and connectivity is probably the most commonly used base policy, it's it's the middle ground between.24:40Lower or higher security. When you load into an intrusion policy for the 1st time, you'll get this menu. Suggests you peruse that at your own leisure, and then we load usually into the summary tab, so we have an overview of what types of rules are enabled, whether we're using any overrides I do have a couple set there.24:59In the individual rule overrides, but not in the group overrides, and whether we're using recommendations. You can also generate a report and export the policy from here. I'll mention the view effective policy. So we have these tabs at the top and we notice there's the arrows going between them. That is because these are policy layers. So we start with the base policy at the bottom.25:18And then we layer group overrides recommendations and rule overrides on top of that, and then we flatten the entire stack into the effective policy, and that's what's actually loaded onto the firewall. So I'm not gonna click on the base policy, but I do want to show you the overrides. In group overrides, we have.25:38A couple of different ways we can look at the groups here. So rule categories, these are traditional groupings of the intrusion policy, like we've had for a very long time. And you'll notice we have the security level. You'll see the security level in a few different places in the intrusion policy. The security levels are roughly.25:58In line with the base policy, so you'll notice we have 2nd bar filled in there. If we edit that, we can see, we can select any of these 4 bar. So the connectivity over security on the left balanced security over connectivity and then what we call maximum detection. Maximum detection, we don't recommend a.26:17The base policy, but it maybe relevant in some.26:36Places to use that for your security level changes individually on groups or in recommendations. But what that will do is it will enable additional rules within this group based on that higher policy without switching the entire base policy. We also have these MITRE groups, so these are based on the MITRE attached.26:42Framework. So these are more about the types of techniques that are, are used to threaten our networks.27:01And in a similar way, we have security levels here. You'll notice it shows none of those are set, but that doesn't actually mean none of the rules in that group are enabled, it's just that we're not enabling them through the MITRE group yet. We can actually click here on view rules and rule overrides, which will take us over to the rule overrides section.27:09And we can see that actually quite a lot of these rules are enabled so the alert rules and then the block rules, those are ones that are actively.27:29Detecting traffic and taking action either by eventing or blocking traffic. So in addition to the overrides, we also have the recommendations option here. So in recommendations.27:39We have a few options, so I've already generated some recommendations cause it can take a few minutes and I didn't I didn't want to have to wait for that. But we're gonna show you the settings here. So when you 1st come in here, it'll just show a button that says start using recommendations and you edit it and you'll see a screen like this. The 1st.27:55Thing to note is this section in the very middle where it currently says NO impact. So as you change settings in here, so such as me clicking on this next bar, that will change to state the, how that will affect the recommendations.28:15With that new setting, so if we click up to that top one, it shows increased security. So it's enabling additional rules that match vulnerabilities on discovered host in the security over connectivity rule set. Those are rules that it would not normally be enabled in the balanced rule set. So we have.28:32The chance to enable additional rules tailored to our network based on the types of hosts that are discovered in our network. So that is based on the network discovery policy, as the firewall sees traffic, it passively detects those hosts, does a good.28:47Check at what their operating system is and then attaches potential vulnerabilities. Those potential vulnerabilities have CVEs and those CVEs are also present in the intrusion rules that we would enable to, in these recommendations. So that's how it determines what to give you as recommendation.29:04In addition to the security levels, you have the option to click accept recommendations to disable rules. So.29:24In this case it changes to focus security. What it's doing there is if you have rules enabled in the base policy that are not relevant to your current hosts that have been discovered by the firewall, you will actually disable those rules. So you might do that if you're.29:32Needing to free up some, some resources on your device, could, could be a little bit better performance, you maybe on one of the lower end models, but you know it's up to your organization whether it's acceptable to disable those rules or keep all of the base policy rules.29:51And then we have the option to either generate, sorry, the protected networks I should mention 1st. So by default it has all IP four and IP six networks in here, but you can change this if you say you have a policy where you're only working with your web servers, servers that are, are presenting web resources to the internet. You can.30:12Change this to only care about those protected networks so that you're only getting recommendations for those devices. And then.30:32You can either generate or generate an apply. So generate will do what we have here in the background where we have a list of rules, what the recommended change to those rules are and what gives you the option to either accept or discard those. Generate and apply is where you've decided to.30:41Trust the recommendation system and it will go ahead and make those rule state changes as soon as you, you hit the button once it goes through its process. I will mention you can also set the generation of recommendations through the system schedule.31:01Not showing that in this demo, but I do want to mention that. And then once you've done that, you'll get a list like this and you have the option to go through and look at it and decide whether or not to accept those rules. If you, and you'll see here on the left, if they are not in use, it'll say not in use and if they are, it will say in use. So you the other option too.31:18Accept to refresh, which will regenerate those rules. Say you've generated them a week ago and you come back, you say, well, let's make sure nothing has changed. You can go ahead and hit refresh and do that. And it takes you back to this menu. And then you can, if you decide you do not like them, you can hit discard.31:37And that will bring you back to the starting page. So I mentioned this is, this is how it looks when you 1st get in here and when you hit start, it'll come up with that menu and you can start again. So in addition to that, we're gonna go back to rule overrides and we're gonna talk about that snort ML rule. Before we get into that one.31:53Now I do also want to show, one more thing.32:13In most intrusion rules, when you expand them out, there is some useful information, so it tells you, for one thing, it'll have usually have one or more variables, so in this case it's external net to SMTP servers. That is defined by that variable set I mentioned before, and I'll show you where the.32:18Does here very shortly, and then some other information about what it's checking. It will also, if it's attached to a CVE, have that CVE information here. You can also click on this button, the rule documentation button, and that will take you to the smart.org site for with information about that particular.32:38Rule. Usually in the references tab, we'll have information about the CVE and it will also list more details about those CVEs here down at the bottom along with the link to go to get more information on this. So for snort ML specifically, we're gonna go to all rules here and show you how we would find that if you.32:57Don't already have it enabled. So you're gonna search for GID that's for generator ID 04:11. Right now the only thing under generator ID 04:11 is this snort ML rule, which I've already set to block, and of course you can set it to various settings. Typically we're gonna use alert or block.33:17Alert would just be to log an event and block to actually block that traffic, right? So the message will be this snort ML potential threat found and HTTP parameters, and there's in the role details, there's also a link to the blog post where we talk about snortal MLs development. So by default.33:38This is only enabled in the max detect.33:57Base policy, the max detection one, which we typically don't use. But there is some expectation that it will be added into security over connectivity in the future. Now, once you have it enabled, you'll start seeing, of course, the traffic that, that matches it where we can see the payload.33:59Hit that rule. So before you go look at those events.34:19Quickly show you the variable set, once the objects menu loads here, so near the bottom here we have variable set. So in the variable set, we're using the default set in our traffic.34:24You'll want to set at the very least the home net and external net variables. So home net you're typically going to set that to the networks that your firewall is protecting. So often you can put in here, you know, RFC 1918 and then your.34:42Public IPs you can also include especially if they're behind the firewall, and then you save that the external net variable, which you're gonna do with that is if it's an internet edge firewall at the least, you're gonna take the home net variable and you're gonna put it in exclude. So that's basically saying from the.35:01On anything that is in home net has to be considered external.35:20And once you've got that in place, your intrusion rules will work more effectively and efficiently because we're able to determine that directionality that we weren't able to determine before. So going over to unified events.35:26Oh. And I have a saved search in place for this one. So we're gonna go up here and I'm gonna select this one for the quick server server with snort ML, and I'm gonna expand our time frame.35:46So I have the URL column added here, and we can see that we have an unusual request here. This is a SQL injection attack. We can expand our event details.36:02To see a little bit more, right? So we get some enrichments that pop up, and then we see we're hitting the snort ML intrusion rule. We see the snort ID down here, the full host name of what we're, we're detecting on, the details of that snort rule and the URL here. So.36:22Yeah, that is that's a known string that looks like a SQL injection attack, so SNORTML is able to pick up on that and say that looks like an attack. Let's go ahead and alert and block that traffic.36:42Oh, alright, so that is what I had for intrusion policy. I'm gonna hand it back over to Anya. Perfect. Thank you, Joseph, let me share again. Now let's briefly talk about five.36:54File control.37:13So the fire policy is a set of configurations that the secure firewall uses to control file transmission. It is a part of the overall access control configuration. Associating a file policy to an access control rule ensures that before the system passes a.37:16File in traffic that matches an access control rules conditional inspects the file. Sure secure firewall its malware and file protection capability barriers.37:34As discussed previously, malware analysis and blocking requires malware defense description. But for file control, we only need the IPS or thread license. Let us take a more detailed look at how this engine process a file. When the traffic contains.37:53Any files come into a managed device.38:12It 1st go to the policy. If this rules has a file policy assigned to it, then it will inspect those files. We need to define two things in the file policy. The conditions that we want to trigger on and the action that we want to.38:15Take when the when we match those conditions. There are different conditions to choose from. We can match on the application protocol that is being used such as HTTP, SMTP, imap POP3 FTP, and SMB protocols.38:32The direction of traffic and the type of file that is identified. Once we have identified identified files matching the policy, then we can take different actions when we trigger on those conditions. So to enable file detection and control.38:48We can navigate to policies, access control, malware and file section. Then we can click where it says new file policy and that will allow us to create a new policy. In the policy editor page, we can select a rule to add new file rules.39:06File rules allow granular control over files. Each file rule has an associated action that determines how the system handles traffic that matches the rules condition. The two actions that are available for file control are detect files, which will allow us to lock the detection of.39:26Specific file types to the database while still allowing their transmission or block files. In this case, in this scenario that we are showing here, we are, we selected the action to block files. Then we select the file types required.39:46We have the option to select specific file types or entire categories. In this example, we selected the category of executables and a specific office document file type. As mentioned, we have the option to select.40:04The application protocol based on the traffic that we are, what we want to review and the direction of transfer if it is applicable, we can select from the options that are upload, download or any.40:21Now let's talk about encrypted visibility engine. So if our encrypted visibility engine is an AI machine learning power engine that helps detect applications and malware within encrypted traffic without having to decrypt it.40:41To achieve this goal, it is used a much distilled set of data from Talos, telemetry from more than 500000 endpoints malware samples and TLS sessions. It supports multiple protocols such as TLS, HTTP.40:58Quick, it is high performing as we generally see only 1 % CPU increase when using if and helps to preserve privacy and address some compliance requirements since traffic is not decrypted. If was introduced in version seven.one of Cisco secure firewall for defense.41:16Few years ago and it has continued to evolve with new capabilities in recent.41:36Releases. We will talk about those capabilities in a in a minute. Here's the behind the scenes details into how if arrives at a threat score to help you make better decision if to decrypt which traffic to allow.41:42The main purpose of this is to tell you which process initiated the encrypted connection and tied to a certain probability and assign a score. 1st, if it's going to inspect the client hello portion of the TLS handshake and calculate the TLS or quick fingerprint based on the vast.42:01Database it's pulling from. However, fingerprinting isn't enough to reduce risk to the extent we are comfortable with because many applications and processes use the same TLS libraries. So if may not be accurate.42:21Predicting the risk of that connection. That's why if it's also going to assess the destination IP port, server name indication or SNI, because Cisco has the capability to collect vast amount of data to assess the risk of server destinations if does not have to rely on fingerpri.42:38Printing along to make a risk calculation. For this combination of data, if can guess with a higher probability the application that initiated the connection, operating system details and the probability of the connection containing malware. Then it delivers a threat score of.42:57Zero to 100. This threat score indicates the likelihood that specific network condition is associated with malicious activity within encrypted traffic. A higher score indicates a greater likelihood. Ultimately, it depends on Talos intelligence to supply malware.43:17Data necessarily for this final calculation.43:37Now let's see a quick example. Consider this is a scenario where a user user accesses Cisco.com using the Firefox browser on a Windows PC. During the initiation of the connection, the TLS client hello is inspected to calculate a TLS fingerprint.43:44Also, the destination context is evaluated and by correlating the TLS fingerprint with the destination context, it can identify with a high degree of probability that the traffic was originated from a firefox.exe process on a windows ten operating system.44:03And classifying the client application as a browser.44:24In version ten.o, there is a new dashboard for if with different widgets. Also, if configuration was moved from the advanced settings option to the main access control policy base, we will see that in a minute during the demo, including the new modes.44:30Or new modes were introduced in this version monitor and protect. Monitor mode provides visibility, detect application to detect client applications and indications of compromise and protect mode, which if monitors and also block malicious connections based on the.44:48Threshold level configure. Now we will go with the next demo, do so. Thanks, Sonia. All right. So for encrypted visibility, we have the.45:07Dashboard here that covers all of the Eve detections and how much traffic we're seeing for it. So, certainly that'll be useful in determining, you know, what Eve is doing and what you might need to modify in your settings to better protect your network. So we'll go ahead and jump over to the policy and we're gonna come back to our our policy.45:23We'll see we've been working on.45:43Yeah, give that a second to load here, and what we'll find when we hit the more button here is we have encrypted visibility engine as its own.45:46Menu. So in.46:05Earlier versions, this was part of the advanced settings, but we feel this is an important enough feature that we need to have it in its own menu, bring more attention to it. So to enable encrypted visibility engine, we'll hit the toggle here and we have a few things to look at in the recommended settings, it mentions you should enable the automatic updates for.46:08The VDB and enable the success network. So the VDB will make sure that you have up to date detections for Eve and the success network sends data to us that we can use to improve the feature. So we have two modes for Eve. Monitor is gonna be the default. This is just to add visibility function.46:27To the access control, detections. So that'll show up in your unified events, your connection events, where you can see additional columns related to Eve. And then we have the protect mode.46:48In addition to monitor and protect here, enabling encrypted visibility engine also allows certain application detectors to function more effectively, which you can see that in access control rules, there is an Eve category in there. So.47:04In the protect mode, we now have two options. We can either do high or very high.47:23In most cases, we're gonna recommend very high, as is mentioned here, but you do have the option of going a little lower with your threshold if you want to be more aggressive on the security here. So these thresholds are based on a threat risk score that is determined by Eve as it's doing its detections, and I'll show you what that looks like when we jump over to the events.47:31Now I do also want to mention this manage exceptions button. I'm gonna go ahead and click it, but we'll come back to that after we've looked at events and there is there's a reason I want to do that. So, we'll give that a second to load and we'll come back here. So in earlier versions you did all of that through the ACP editor, but now the exceptions list is in the objects menu.47:51Here.48:11So once you've got this in place, you'll save and deploy and then you should start getting events for Eve. So I've got that running on a couple of other firewalls, so we'll jump over to unified events, and as we saw earlier.48:13The security related connection events includes both security intelligence as well as encrypted visibility actions. So we see we have encrypted visibility block and encrypted visibility IOC.48:33Where it says IOC, what that's doing is it's attaching an indication of compromise to a host and saying there might be something worth checking out on this host, but it's not enough to say let's outright block it. For when it shows encrypted visibility block, we are saying the risk score is high enough that we are blocking this traffic.48:46So if we expand out the event details.49:06We can find, a few items of interest for Eve and these items again can be added through the column selector if you want to have that in the table, and you can save that to a column set if you'd like to.49:10Now, the Eve fingerprint, that's the identifier that Eve uses, to understand what process we're looking at and, and all of the details that are related to it. The Eve process name is a, basically a descriptor of the process. And then we also have our confidence score. That's how confident we are that it is this process.49:27And then we have our threat confidence. So here it shows very high, 99 %. So that means it's high enough that we're gonna match it against the Eve settings we set with the very high threshold. So that is why we blocked this connection. Now, in addition to the security related connection events, we're also going.49:46To see Eve details in.50:06Other connections. So I do have those added, so we're gonna just go back to connection events or move the security connection events here. And we'll scroll over to the right and we'll see where we have some Eve detections so.50:10Good one here we see shows Cisco secure client and we have a fingerprint threat confidence of course is low for that one. Now, anytime you see the fingerprint, you can do this either through this table view or through the expanded details. You can right click.50:29On that and you can click view Eve Process analysis. And that will take you to the app ID.Cisco site where you can get support for process analysis. So.50:46What this will bring over is the individual IPs, server name and port you connected to, as well as the fingerprint. It'll also tell the system what VDB version your FMC is on. And you can add additional details here by getting some information from the command line. And once you have that, you can pop it in.51:01Here and, do some you can hit view request or you can select an item down here if you think it is you need support for a particular process name and hit submit request. You also want to throw in your customer, customer name up here to make sure they know who they're looking at.51:21So there is some other details on here if you go to a fingerprint that has multiple detections, let's try this one. So you'll see here we have several different process names under this one, and that's because there's the prevalence.51:40That can be under that fingerprint as well as the, these items can affect which one of those we detect on. So for instance, this one has this .99. So depending on what server name is in here, it may have selected HP one agent, but in this case we went with.51:58Microsoft networking. So certainly submit if you think the detection is not quite correct, we certainly wanna know how we can improve this tool through, through those means. So I mentioned the exception list. So we have a process name here.52:18I'm gonna copy the name of that process.52:38And I'm gonna jump over to that object menu we pulled up. We can add exception rules here. In this case, we could put in this process name and we could add that as an exception. There's also the ability to do use source and destination network as part of an exception, as well as dynamic attributes.52:41If you were using the dynamic attributes collector or using an API created dynamic object. So a few different ways to do exceptions, process name is usually gonna be a part of that and then you can add additional details to that as you go.53:01Great, so that is what I had for encrypted visibility engine. Hand it back over to you Anya. Thank you. Great demo, Joseph. So as we saw it is all about calculating risk.53:20And we have discussed how we operate with high risk connections, but we have taken its capabilities one step further with intelligent decryption bypass, a major enhancement available from version seven seven of Cisco secure firewall. Remember that if depending on the grid score, it would automatically block a packet.53:38That use case falls in our high risk category. However, if, if provides a very low threat score, we take advantage of Talos insights to automate further and decide if traffic is low risk enough to bypass decryption altogether.53:58So let's look at an example. If we have malwares on a system, if it's going to already identify this connection as high risk and it will be blocked. House serve rep server reputation is being factored in, but it doesn't outweigh the risk.54:15Now let's, let's say that we have a Firefox running and it's connecting to beam.com. It's still going to be decrypt decrypted because the connection doesn't.54:37It's their threshold to be bypassed. Talos is still indicating this website has a favorable sorry, has a favorable favorable reputation but the risk is still too high. Now with this example.54:49We are in the same situation where we are running Firefox but it is now connected to a site marked as untrusted by Talos. Talos threat intelligence will block that. The risk can be more accurately accessed because of that additional.55:09Tells data available to us. Finally, we have Cisco secure endpoint, which has a very low thread score connecting to Cisco.com which has a trusted reputation. If if.55:26It says that the client process is a very low high, very low risk, and the server that it's being connected to is across the server, the likelihood that anything bad will happen in this connection is very low. Another capability that combines the powers of.55:42ID if until it's quick decryption is shadow traffic detection. Shadow traffic is network traffic that is designed to avoid network monitoring and traffic analysis by advanced firewalls. Hotel traffic detection leverage both machine learning and traditional signature based engines.56:02If extends the visibility into encrypted traffic, app ID providing application detection and TLS quick decryption or domain fronting comparing TLS endpoint with the real HTTP request.56:22The shadow traffic dashboard, which is new in version ten.o, provides information about network traffic that bypasses the intended visibility of access or access control measures of threat defense devices. Various techniques can be used to create shadow traffic.56:40And this dashboard will show the number of connection and other details for the following techniques, evasive VPN, most to have proxies, encrypted DNS, domain fronting and also fake TLS.56:58Firewall also detects on flex connection showing the sounds abation in a new column that is graphic type. So just to.57:15Just to finish the session, we would like to share some resources. We have the secure Firewall YouTube channel, and there's a QR code that we invite you to scan. This YouTube channel has the latest demos and tutorials.57:31About new features troubleshooting tips, how to guides along with numerous videos with deep dive and best practices. We invited you to visit this channel. It's a great resource.57:48And also we have the simplified one pager. We also invite you to scan the QR code. The link is also is secure.cisco.com. This site have step by step guidance, best practices.58:03Use cases deployment guys, so it's a great resource to have bookmarked, so we highly recommend you to check this resource. And with that, this is the end of our session. Thank you for your time today.58:20Now, pass it over to Harry. Thanks. Very quickly, thank you, we ran right up against the edge Jack. We we answer as many questions as we could, but if there's any more, please reach out to us directly. Thank you again for spending time with us on this topic and the great questions, we do appreciate the interactivity, complete our survey and be on the lookout for the Q and A email and again enjoy.58:37Have your rest of your day.58:57