- [Narrator] There have been tons of different,
either personal firewalls,
host intrusion prevention systems,
antivirals,
you know, the solutions are there,
that you can install in your desktops,
your laptops, your servers,
and so on.
However today,
there are a lot more sophisticated software,
that make basic antivirus,
or personal firewalls,
or host intrusion prevention systems,
all that plethora of systems completely obsolete.
For example,
Cisco's Advanced Malware Protection for Endpoint,
so Cisco AMP for endpoints,
what you're seeing in the screen,
is basically an ecosystem,
'cause it's not only one agent,
it's an ecosystem that basically,
take advantage of telemetry from big data analytics,
you know being provided from you know,
many, many, many different agents to continuous analysis,
advanced analytics provided by Cisco threat intelligence,
to be able to detect, analyze,
and stop advanced malware,
across different types of endpoints,
right,
it provides these advanced malware protections,
for many operating systems including windows,
Mac O SX, Android, and Linux.
Now attacks are getting really, really sophisticated,
and very complicated,
they can evade the traditional systems,
and endpoint protection.
Today's you know,
attackers have the resources,
the knowledge,
and the persistence to be actually,
be able to beat point in time detection,
so, what we're trying to do with Cisco AMP for endpoint,
is actually provide mitigation capabilities,
that go beyond the point in time detection,
it actually uses threat intelligence,
from the Cisco Talos organization,
to perform retrospective analysis,
and protection,
basically also provides device,
and file trajectory capabilities,
to be able to,
you know, to show,
to administrator,
or to an analyst in a security operations center,
what's actually happening,
across the full ex spectrum of an attack.
Now it also allows you to perform,
a lot of different threat hunting scenarios,
and as a matter of fact,
what I'm showing in here,
is the secure X threat hunting,
you know, different incidents,
part of the same ecosystem of the AMP four Endpoints.
So for example,
if I click on one of them in here,
you see different tactics,
and techniques that were actually,
you know, use like Defense Evasion,
Execution, Initial Access,
and Persistence,
and all these are being mapped,
to the Mitre Attack Framework,
right,
so if you actually click on that,
you will pull the specific tactic,
and technique that you know,
was used for this specific,
in this case you know,
of course the demo,
using a file called Certutil.exe,
that was actually executed,
by another file,
or by another process,
is the scheduled task,
a process within a windows environment,
right,
it actually tells you in here,
you know, basically that the whole details about a case,
so it goes beyond just detecting that,
hey there's might be a signature based detection,
like most antivirus,
that's what they use,
they use a signature based detection,
and in this case it's actually using threat intelligence,
it's using behavioral analytics,
it's using big data,
it's using a lot of different things,
that those traditional solutions never provided.