Cisco ThreatGrid: Malware Analysis and Threat Intelligence

12

TAGS:

Transcript of Cisco ThreatGrid: Malware Analysis and Threat Intelligence

Page 1: Cisco ThreatGrid: Malware Analysis and Threat Intelligence
Page 2: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

2 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Page 3: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

3 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

§  Explain AMP ThreatGRID as an architecture §  Demo AMP ThreatGRID

Agenda

Page 4: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

4 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Malware Analysis and Threat Intelligence Solution

Page 5: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

5 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

ThreatGRID Advantage Unified Malware Analysis and Threat Intelligence – Key Features

•  Proprietary analysis delivers unparalleled insight into malicious activity •  High-speed, automated analysis and adjustable runtimes •  Does not expose any tags or indicators that malware can use to detect that it is being observed

•  100,000s of samples analyzed daily (6-10 million per month) •  SaaS delivery (no hardware) or Appliance (as needed)

•  Search and correlate all data elements of a single sample against billons of sample artifacts collected and analyzed over years (global and historic context)

•  Enable the analyst to better understand the relevancy of sample in question to one’s environment

•  Clearly presented information for all levels of the IT Security team: Tier 1-3 SOC Analysts, Incident Responders & Forensic Investigators, and Threat Intel Analysts

•  Web portal, Glovebox (User Interaction), Video Replay, Threat Score, Behavioral Indicators and more

•  Architected from the ground up with an API to integrate with existing IT security solutions (Automatically receive submissions from other solutions and pull the results into your environment)

•  Create custom threat intelligence feeds with context or leverage automated batch feeds

Data Fidelity & Performance

Scalability & Flexibility

Context & Data Enrichment

Usability

Integration & Architecture

Page 6: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

6 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

ThreatGRID Connectivity: Cloud SaaS Model

Can Be Access via a Web Browser

Security tools can access and integrate using the ThreatGRID API

Files can be submitted for analysis All of the results can be easily retrieved Samples can be compared and searched for

The analyst can also interact with the sample and change the runtime from 5 to 30 minutes

Malware analysis, threat intelligence correlation and feeds retrieval can be automated and integrated with existing security solutions

Threat intelligence can be enriched

Page 7: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

7 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

ThreatGRID Connectivity: Appliance Model

Can Be Access via a Web Browser

Security tools can access and integrate using the ThreatGRID API

Files can be submitted for analysis All of the results can be easily retrieved Samples can be compared and searched for

The analyst can also interact with the sample and change the runtime from 5 to 30 minutes

Malware analysis, threat intelligence correlation and feeds retrieval can be automated and integrated with existing security solutions

Threat intelligence can be enriched But no data is sent to cloud from appliance

Page 8: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

8 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Advanced Malware Protection Everywhere

AMP Threat Grid Malware Analysis and Intelligence

Dedicated FirePOWER Appliance

Web & Email Security Appliances

Private Cloud

Cloud Based Web Security & Hosted Email

Mac OS X

Virtual Mobile PC

FirePOWER Services on ASA

Enterprise Capabilities

Continuous & Zero-Day Detection

Advanced Analytics And Correlation

Page 9: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

9 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Demo

Page 10: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

10 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Page 11: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

11 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Page 12: Cisco ThreatGrid: Malware Analysis and Threat Intelligence

Thank you.


ATM Malware: Understanding the threat

ATM Malware: Understanding the threat

Malware and the Modern Threat Landscape

Malware and the Modern Threat Landscape

Advanced Persistent Threat · APT - Overview ySummary / Synopsis –Advanced Persistent Threat yAnatomy yTimeline –Threat Vector Evolution yTools –Malware, Bots yTechniques –OSINT,

Advanced Persistent Threat · APT - Overview ySummary / Synopsis –Advanced Persistent Threat yAnatomy yTimeline –Threat Vector Evolution yTools –Malware, Bots yTechniques –OSINT,

Metadata-driven Threat Classification of Network Endpoints Appearing in Malware

Metadata-driven Threat Classification of Network Endpoints Appearing in Malware

BillGates Botnet Malware Used in Large DDoS Attacks | Threat ...

BillGates Botnet Malware Used in Large DDoS Attacks | Threat ...

G DATA Mobile Malware Threat Report Q1/2015

G DATA Mobile Malware Threat Report Q1/2015

Threat Analysis of BlackEnergy Malware for Synchrophasor based ...

Threat Analysis of BlackEnergy Malware for Synchrophasor based ...

MALOnt: An Ontology for Malware Threat Intelligence

MALOnt: An Ontology for Malware Threat Intelligence

THREAT INTELLIGENCE REPORT Slave Malware Analysis ... · F5 LABS THREAT INTELLIGENCE REPORT | SLAVE MALWARE ANALYSIS: EVOLVING FROM IBAN SWAPS TO PERSISTENT WEBINJECTS COMMAND AND

THREAT INTELLIGENCE REPORT Slave Malware Analysis ... · F5 LABS THREAT INTELLIGENCE REPORT | SLAVE MALWARE ANALYSIS: EVOLVING FROM IBAN SWAPS TO PERSISTENT WEBINJECTS COMMAND AND

The Ongoing Malware Threat: How Malware Infects Websites and ...

The Ongoing Malware Threat: How Malware Infects Websites and ...

Fidelis Threat Advisory #1020 Dissecting the Malware ...

Fidelis Threat Advisory #1020 Dissecting the Malware ...

Protecting Your Network from Malware - Akamai...Protecting Your Network from Malware The threat landscape is becoming increasingly hostile. Malware and ransomware campaigns, phishing

Protecting Your Network from Malware - Akamai...Protecting Your Network from Malware The threat landscape is becoming increasingly hostile. Malware and ransomware campaigns, phishing

Sourcefire and ThreatGrid - · PDF fileSourcefire and ThreatGrid ... - World’s largest threat response ... - Threat Score & Behavioral Indicators - Search and correlate all data

Sourcefire and ThreatGrid - · PDF fileSourcefire and ThreatGrid ... - World’s largest threat response ... - Threat Score & Behavioral Indicators - Search and correlate all data

Quarterly Threat Report - Quick Healdlupdate.quickheal.com/documents/others/quick_heal...Threat Report: 3rd Quarter, 2014 Summary Windows Top 10 Windows Malware Windows Malware Collection

Quarterly Threat Report - Quick Healdlupdate.quickheal.com/documents/others/quick_heal...Threat Report: 3rd Quarter, 2014 Summary Windows Top 10 Windows Malware Windows Malware Collection

XOR DDoS Malware Cloud Security Threat Advisory Slideshow

XOR DDoS Malware Cloud Security Threat Advisory Slideshow

Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

PHISHING THREAT MALWARE REVIEW - Cofense · PHISHING THREAT AND MALWARE REVIEW: 2019 Figure 1: As identified by the Cofense Phishing Defense Center. PHISHING THREATS BY TYPE October

PHISHING THREAT MALWARE REVIEW - Cofense · PHISHING THREAT AND MALWARE REVIEW: 2019 Figure 1: As identified by the Cofense Phishing Defense Center. PHISHING THREATS BY TYPE October

Threat Modeling of Banking Malware-Based Attacks - … · PART III-Using PASTA™ for threat modeling of banking-malware attacks . OWASP ... Perform a risk assessment of online banking

Threat Modeling of Banking Malware-Based Attacks - … · PART III-Using PASTA™ for threat modeling of banking-malware attacks . OWASP ... Perform a risk assessment of online banking

Cyber Security Warning! #1 Threat Keylogging Malware

Cyber Security Warning! #1 Threat Keylogging Malware

Advanced Targeted Malware or Advanced Persistent Threat

Advanced Targeted Malware or Advanced Persistent Threat