Today’s threat landscape is completely different than last year; and next years will be, not surprisingly, even worse. The Industrialization of Hacking has spawned a new era of professional, entrepreneurial, and resourceful cyber criminals. In recent year’s dynamic malware analysis (aka sandboxing) has become the shiny new technology that we all want, no, need to have. At one time anti-virus held this position as well, and the same will eventually be said of sandbox technology used to fight advanced malware.
You may have purchased a sandbox a few years ago but it’s likely that your malware analysis needs have gone beyond the traditional sandboxing technologies that simply extract suspicious samples, analyze in a local virtual machine, and quarantine. You need a more robust malware analysis tool that fits into your infrastructure and can continuously detect even the most advanced threats that are environmentally aware and can evade detection.
Tripwire recently partnered with Cisco and integrated the AMP Threat Grid dynamic malware analysis solutions into Tripwire Enterprise. But why choose this dynamic malware analysis tool? After careful evaluation there were a few key reasons to integrate this tool versus others:
It’s not just dynamic malware analysis
AMP Threat Grid provides both static and dynamic malware analysis, and a full subscription provides an API that is used to seamlessly deliver context rich threat intelligence into existing security technologies.
Not everyone out there is a security expert
Heck, very few are. AMP Threat Grid was designed to empower junior security analysts by providing a Threat Score so they can easily determine how malicious a sample is. The behavioral indicators are written in plain English so they can understand what the file is doing, and why its behavior is malicious, suspicious, or benign.
Lack of instrumentation
AMP Threat Grid was designed without any instrumentation inside the virtual machine. Most experts agree that around 40% of today’s malware is environment aware, checking to see if it is running in a sandbox or the age of the operating system before detonating.
There are 3 ways that most people deploy a malware analysis tool:
- A stand-alone solution designed to feed itself samples for analysis without dependency on other security products. This has the most flexibility in deployment but adds significant hardware costs and complexity to management and analysis, especially for distributed enterprises.
- A distributed feeding sensor approach, such as firewalls, IPS, or UTMs with built-in sandboxing capabilities. These solutions are usually cost effective and easy to deploy but are less effective in detecting a broad range of suspicious files including web files. They can also introduce bandwidth limitations that can hamper network performance and privacy concerns when a cloud-based solution is the only option.
- Built into secure content gateways, such as web or email gateways. This approach is also cost effective but focuses on web and email channels only and also introduces performance limitations and privacy concerns.
Since Tripwire is already monitoring and collecting the data on your mission critical systems, these approaches don’t seem to work. But there’s a fourth way that actually takes the best of what these approaches offer and raises the bar to help you fight well-funded attackers that get better at what they do every day: Cisco AMP Threat Grid. Through AMP Threat Grid, Cisco offers advanced malware analysis and intelligence that delivers integration directly with Tripwire Enterprise providing you with a better ROI and more visibility into what is happening in your environment. Tripwire has integrated AMP Threat Grid into their Tripwire Enterprise, providing both static and dynamic analysis so you can better understand the malware targeting your organization, as well as the ability to automate the consumption of threat intelligence into your existing security infrastructure.
How does the Integration actually work?
AMP Threat Grid’s content driven security analytics dynamically and statically analyzes all submitted files, executing the sample in a safe environment, examining the behavior of the samples, and correlating the results with hundreds of millions of other analyzed malware artifacts. In less than 10 minutes AMP Threat Grid reports back and Tripwire Enterprise tags the file with the result. This enables Tripwire Enterprise customers to prioritize actions for changes on systems with threats identified by AMP Threat Grid and initiate workflow actions for quick remediation.
Not only does AMP Threat Grid analyze a broad range of objects, but those interested in an AMP Threat Grid subscription will also be provided with deep analytics capabilities wrapped with robust context. With over 350 behavioral indicators and a malware knowledge base sourced from around the globe, AMP Threat Grid provides more accurate, context rich analytics into malware than ever before. Tripwire customers can register for their free demo here.
Tags: AMP, Sandboxing, security, ThreatGRID
Earlier this Year, Cisco introduced the Cisco ASA 5506-X with FirePOWER Services. This Model should replace the successful and smallest Security Solution, the ASA 5505. Designed for the Small Business and a new era of threat and advanced malware protection Cisco ASA with FirePOWER Services delivers an integrated threat defense for the entire attack continuum. BEFORE, DURING and AFTER.
As Desktop version, the Cisco ASA 5506-X builds an easy entry for a:
- Superior Multilayered Protection
- Site-to-site and remote access VPN
- Granular Application Visibility and Control (AVC)
- Highly effective threat prevention and full contextual awareness
- Reputation- and category-based URL filtering
- AMP provides industry-leading breach detection effectiveness
- Unprecedented Network Visbility
- Reduced Costs and Complexity security Solution
Read More »
Tags: AMP, ASA, AVC, Cisco FirePOWER, cisco ips, cloud, FireSIGHT, lab, NGIPS, PBR, policy based control, Snort, Sourcefire
The rise of malware created specifically for endpoints like mobile devices is forcing IT Security teams to focus increasingly on endpoint security solutions. According to a survey by the Ponemon Institute published in January, 75 percent of respondents (an increase from 68 percent in last year’s study) believe their mobile endpoints have been the target of malware over the past 12 months. Read More »
Tags: AMP, anyconnect, CLUS15, security
As IT organizations look to the cloud to become more efficient and achieve the agility their business demands, one of the biggest security challenges they typically face is right at the heart of any enterprise – the data center. In cloud environments, where applications have to be location-independent and mobile, it can be overwhelming to manage traffic that needs to go to specific security services when you have applications that are mobile, but physical security that’s not. To secure these virtual and mobile applications, a new security framework must be deployed – one that works equally well within the physical and virtualization layer of the data center, and addresses additional requirements of scalable, multitenant environments. Read More »
Tags: ACI, AMP, CLUS15, security
It makes us cringe to say it, but it’s the obvious truth. A week doesn’t go by that we don’t hear about the latest breach in the news. All of us in the IT security industry would love to say, “our technology can prevent all breaches.” But it’s a pipedream. Being able to prevent 100 percent of breaches or detect all threats trying to infiltrate the network is simply not reality.
Of course, we prevent what we can. And we can get pretty close. In fact, Cisco Advanced Malware Protection (AMP) was shown to block 99 percent of incoming malware in a comparative test on Breach Detection Systems done by NSS Labs. Ninety-nine percent is pretty darn good, and in fact, Cisco AMP emerged a leader in that test. But still, it only takes one percent to cause a breach.
When malware gets through your front-line defenses, you need continuous threat protection in place that can quickly detect it, contain it, and remediate it before damage can be done. Cisco AMP provides the visibility and control to do exactly that. Even after files are initially inspected, AMP’s continuous analysis engines constantly monitor activity on endpoints, mobile devices, and in the network to spot any signs of malicious behavior, and provide continuous detection of threats in your environment. As a result, you have protection before, during, and after an attack.
Today I am excited to announce that Cisco AMP just got even better. We are announcing new features and new innovations that enhance Cisco AMP’s protection capabilities and continuous threat protection in the following areas:
Continuous Detection and Retrospective Security
- AMP still provides continuous analysis of files after an attack so that you can see the complete ancestry of an attack, scope a compromise, and continuously detect and uncover evasive threats. You get deep visibility to see threats in your environment and the control to quickly stop them.
- Endpoint Indications of Compromise (IoCs) in AMP for Endpoints lets users now submit their own IoCs using the open IoC standard to catch targeted attacks.
- The Low Prevalence feature in AMP for Endpoints uncovers stealthy, targeted threats that were only seen by a small number of users and automatically sends them for sandbox analysis.
Threat Intelligence and Dynamic Malware Analysis
- The recent integration of Threat Grid capabilities into AMP gives you context-rich threat intelligence feeds, over 350 unique behavioral indicators that analyze the actions of a file, easy to understand threat scores and analytics, and billions of malware artifacts at your disposal to improve your ability to detect and prevent future attacks. These capabilities and more are also available as a standalone threat intelligence and dynamic malware analysis solution via AMP Threat Grid.
- The new Vulnerabilities feature in AMP for Endpoints identifies vulnerable software being targeted by malware, and the potential exploit, providing you with a prioritized list of hosts to patch.
Deployment Flexibility and Choice
- Deploy the solution how and where you want it: on the endpoint, mobile devices, in the network on a Cisco FirePOWER Next-Generation IPS security appliance, on a Cisco ASA firewall, and on web and email gateways. You can also deploy AMP Threat Grid as a standalone threat intelligence and dynamic malware analysis solution.
- No need to manage multiple security platforms or deploy multiple appliances. Cisco AMP is fully integrated with Cisco security products for ease-of-deployment, ease-of-use, and ease-of operation.
To learn more about these innovations, visit our Cisco Security Launch page to watch videos, product demos, customer testimonials, and more.
Tags: AMP, breach detection, RSA 2015, security