Cisco Advanced Malware Protection
Breach Prevention, Detection, Response, and Remediation for the Real World

Overview:

AMP is an intelligence-powered, integrated enterprise-class advanced malware analysis and protection solution. You get comprehensive protection for your organization across the attack continuum: before, during, and after an attack.

• Before an attack, AMP uses global threat intelligence from Cisco's Talos Security Intelligence and Research Group and Threat Grid's threat intelligence feeds to strengthen defenses and protect against known and emerging threats.
• During an attack, AMP uses that intelligence coupled with known file signatures and Cisco Threat Grid's dynamic malware analysis technology to identify and block policy-violating file types and exploit attempts and malicious files trying to infiltrate the network.
• After an attack, or after a file is initially inspected, the solution goes beyond point-in-time detection capabilities and continuously monitors and analyzes all file activity and traffic, regardless of disposition, searching for any indications of malicious behavior. If a file with an unknown or previously deemed "good" disposition starts behaving badly, AMP will detect it and instantly alert security teams with an indication of compromise. It then provides visibility into where the malware originated, what systems were affected, and what the malware is doing. It also provides the controls to rapidly respond to the intrusion and remediate it with a few clicks. This gives security teams the level of deep visibility and control they need to quickly detect attacks, scope a compromise, and contain malware before it causes damage.

Global Threat Intelligence and Dynamic Malware Analysis

AMP is built on exceptional security intelligence and dynamic malware analytics. The Cisco Talos Security Intelligence and Research Group, and Threat Grid threat intelligence feeds, represent the industry's leading collection of real-time threat intelligence and big data analytics. This data is pushed from the cloud to the AMP client so that you have the latest threat intelligence to proactively defend against threats. You benefit from:

• 1.5 million incoming malware samples per day
• 1.6 million global sensors
• 100 TB of data per day
• 13 billion web requests
• A global team of engineers, technicians, and researchers
• 24-hour operations

AMP correlates files, behavior, telemetry data, and activity against this robust, context-rich knowledge base to quickly detect malware. Security teams benefit from AMP's automated analysis by saving time searching for breach activity and having the latest threat intelligence at all times to quickly understand, prioritize, and block sophisticated attacks.

The integration of our Threat Grid technology into AMP also provides:

• Highly accurate and context-rich intelligence feeds delivered in standard formats to integrate smoothly with existing security technologies
• Analysis of millions of samples every month, against more than 700 behavioral indicators, resulting in billions of artifacts
• An easy-to-understand threat score to help security teams prioritize threats

AMP uses all of this intelligence and analysis to either inform your security decision making or automatically take action on your behalf. For instance, with constantly updated intelligence, the system can block known malware and policy-violating file types, dynamically blacklist connections that are known to be malicious, and block attempts to download files from websites and domains categorized as malicious.

Continuous Analysis and Retrospective Security

Most network and endpoint-based antimalware systems inspect files only at the point in time when they traverse a control point into your extended network. That's where the analysis stops. But malware is sophisticated and very good at evading initial detection. Sleep techniques, polymorphism, encryption, and the use of unknown protocols are just some of the ways that malware can hide from view. You can't defend against something you can't see, and that is how most major security breaches occur. Security teams don't see the threat at the point of entry and are oblivious to its presence after the fact. They don't have the visibility to quickly detect it or contain it, and before long, the malware has achieved its objectives, and the damage has been done.

Cisco AMP is different. Recognizing that point-in-time, preemptive detection and blocking methods are not 100 percent effective, the AMP system continuously analyzes files and traffic even after initial inspection. AMP monitors, analyzes, and records all file activity and communications on endpoints, mobile devices, and in the network in order to quickly uncover stealthy threats that exhibit suspicious or malicious behavior. At the first sign of trouble, AMP will alert security teams and provide detailed information on the behavior of the threat, so you can answer crucial security questions, such as:

• Where did the malware come from?
• What was the method and point of entry?
• Where has it been and what systems were affected?
• What did the threat do and what is it doing now?
• How do we stop the threat and eliminate the root cause?

Using this information, security teams can quickly understand what happened and use AMP's containment and remediation functionality to take action. With a few clicks from AMP's easy-to-use browser-based management console, administrators can contain the malware by blocking the file from ever running on another endpoint again. And since AMP knows everywhere the file has been, it can pull the file out of memory and quarantine it for all other users. In the event of a malware intrusion, security teams no longer need to reimage complete systems to eliminate malware. That takes time, costs money and resources, and disrupts critical business functions. With AMP, malware remediation is surgical, with no associated collateral damage to IT systems or the business.

This is the power of continuous analysis, continuous detection, and retrospective security: the ability to record the activity of every file in the system and, if a supposedly "good" file turns "bad," the ability to detect it and rewind the recorded history to see the origin of the threat and the behavior it exhibited. AMP then provides you with built-in response and remediation capabilities to eliminate the threat. AMP also remembers what it sees, from the threat's signature to the behavior of the file, and logs the data in AMP's threat intelligence database to further strengthen front-line defenses so this file and files like it will not be able to evade initial detection again.

With AMP, security teams have the level of deep visibility and control necessary to quickly and efficiently detect attacks and discover stealthy malware; understand and scope a compromise; quickly contain and remediate malware (even zero-day attacks) before any damage can be done; and prevent similar attacks from happening.