Seminar on Phishing Protection

1. Welcome to Phish and Steak
A Seminar on Phishing Protection

2. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
And less of this…
Challenge:Time
“Give my team time back. And help us work
together faster.”
Challenge: Expertise
“My team can’t be experts on every phishing
threat out there. Give us answers at our
fingertips.”
Challenge: Evidence
“We can’t dig for answers. Give us one
place to find answers across all our tools.”

3. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Early detection
Low impact
Industry average
detection time for
a breach
Industry average
time to contain
a breach
Average
cost of a
data breach
Time is a critical factor
Risk of a major breach
in the next 24 months
Time
Source: Ponemon 2018 Cost of a Data Breach Study
Late detection
High impact

4. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Email Scams Continue to Plague Businesses

5. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
 Continued use as reconnaissance step
in blended attacks eg., APT or crypto mining
 Targeting of Webmail/SaaS brands
surpasses payment services (1st time)
 58% of phishing sites use SSL certificates,
(increase from 46% previous quarter)
*Anti Phishing Work Group, Q1 CY2019 Report
SaaS/Webmail
37%
Payment
28%
Financial Institution
17%
Other
15%
Retail
3%
TARGETED CATEGORIES, 2019
Phishing Evolution

6. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Follow PhishandSteak on Twitter:
@PhishandS

7. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
© 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public#CLUS
Punycode
Would you click this ?
• http://umɓrella.com/food.html
• http://umbɾella.com/food.html
• http://umbɾelła.com/food.html
• http://umbrella.com/food.html
7
Punycode: Representation of
encoding standard with many
legitimate uses
Converts words that cannot be written
in ASCII into viable encodings for
domain names
A very popular phishing technique

8. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
The big three
Internet
#1 source of attacks
Email
#1 attack vector
Endpoint
#1 target for attacks

9. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
How are these working together to help you?
Web / Internet
protection
Endpoint
protection
Email
protection

10. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Imagine coordinated security
solutions like air traffic control

11. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Cisco’s integrated security
architecture

12. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Blocks phishing at malware level
Blocks phishing at message level
Blocks phishing at IP and domain
level
AMP for Endpoint
Email Security
Umbrella Internet
Cisco
Talos
Endpoint
Cisco
Threat
Response
Endpoint
Breach Defense: Against Phishing Attacks
Blocks phishing at message level
Blocks phishing at malware level

13. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Cisco Talos: Unmatched visibility
Vulnerability discovery
Email
Cloud
Endpoint
WebNetwork
Data sharing
Threat traps
To stop more, you have to see more
• The most diverse data set
• Community partnerships
• Proactively finding problems

14. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Malware
C2 Callbacks
Phishing
SIG
Safe access anywhere
users go, even off VPN
First line of defense
and inspection
Secure onramp
to the internet
Cisco Umbrella
First line

15. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Umbrella: See once, block everywhere
Flagged as a
newly seen domain in
Umbrella
Umbrella proxies
subsequent
requests for
deeper URL/file
inspection
URL determined
to be malicious
and all sources
updated instantly
Block URL/domain
across email
and endpoints
“
”
The whole integrated Cisco ecosystem serves as something
of a force multiplier; information is automatically shared…so a
threat in one area is protected against everywhere.
Click on a phishing
link for a domain
never seen before
- Global Manager, Cyber Security,
Professional Services Company

16. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Email Security: See once, block everywhere
Check email
attachment with
AMP cloud
Unknown file
analyzed by
Threat Grid
Convicted
as malicious.
Mailboxes cleaned,
sources updated.
Umbrella and AMP
instantly block
associated domains,
URLs, IPs, and filesPhishing Email with
malicious attachment
sent to employee
“
”
Cisco Email Security is an invaluable asset for safeguarding
our users, customers, and data.
- Ben Brandt, Cyber Security Engineer,
American National Bank

17. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
AMP: See once, block everywhere
File checked
by AMP
File acts
suspiciously
File quarantined on
endpoint and all
sources updated
View retrospective
alerts across
endpoints, email,
and web/internet
“
”
AMP for Endpoints has increased endpoint
visibility by 100%, detected 50% more threats,
and reduced incident response time by 5 days.
File
downloaded
- Yaroslav Turbin, IT Architect, Vector-Best

18. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
AMP
ContinuousAnalysis
Retrospective alert on changing file disposition
Machine Learning Engines
Zero day insight into new threats by
identifying behavioral anomalies
Dynamic analysis
Video recording of malware actions for
high fidelity threat intelligence
Phishing Protection
Prevent: Block Known Malware
Detect: Continuously Monitor
Respond: Rapidly contain the
attack
EPP + EDR

19. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
AMP for Endpoints: Phishing defense
“Replaces antivirus
to automatically
block advanced
exploit-based and
in-memory attacks
before they are
launched against
us”
“Continuously
analyzes our 30-day
history of endpoint
behavior to expose
and block any
attempts to
compromise our
devices”
“Gives us
environment-wide
answers and action
at our fingertips to
reduce our response
time from hours to
seconds”
Your last line of protection on laptops, desktops, servers, and mobile

20. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Key Findings from Cisco’s Q2-2019
Email Fraud & Identity Deception Trends Report
• Nearly 30% of BEC attacks now originate from compromised accounts
• Employee-reported phishing attacks reaching SOCs surge 25%
• DMARC adoption rises, but 90% of the Fortune 500 are still unprotected
• Over 90% of current presidential candidates remain unprotected against
email threats

21. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential21
Advanced
Phishing
Protection

22. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Advanced phishing attacks use identity
impersonation
Sources: CSOonline.com, Cybersecurity ventures, Nucleus Research, FBI I3C
2000s 2015
Spam
Email
Malware
Spear
Phishing
Social
Eng Attacks
Business Email
Compromise
2019
Content Deception Identity Impersonation
Zero Day
Attacks
30% open malicious emails
13% click on malicious
attachments
3:45 until first user is
compromised
Volume of Threats
$

23. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Classic Example of Identity Impersonation.
CFO tweets
from UK
Attacker finds email
address
Creates fake
email account
Request for money
transfer to UK
Company-wide
Inboxes

24. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Advanced Phishing Protection advanced identity
intelligence

25. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Insider Threat & Internal ATO Protection

26. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Email Security
Content Disarm and Reconstruction
Suspect attachments rendered as jpegs
and embedded in pdf files with Safeprint
Advanced Phishing Protection
Trust Modeling to identify phishing attacks
with no URL or attachment. It looks at
relationships and behaviors.
Mailbox Auto Remediation
Automatic deletion of messages with
changing threat verdicts on O365 and other
platforms
Phishing Protection

27. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential27
Domain
Protection

28. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
SPF
SMTP
DKIM
DMARC
Cisco Domain Protection
BLOCKED
FROM
PHISHING
Protecting your Domain from Spoofing

29. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Understanding Your Email Sending Ecosystem
Raw DMARC Data
Cisco Domain Protection

30. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Customer Success – An Extension of Your Team
TAKE CONTROL OF YOUR EMAIL CHANNEL
Identify Email
Domains
Publish
DMARC
Monitor
Policies
Identify
Unauthorized
Use of Email
Domains
Identify 3rd
Party Senders
Remediate
Authentication
Anomalies
Implement
DMARC Reject
Policy
Monitor for
New Threats
and New
Senders

31. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
31
Brand Indicators for Message
Identification (BIMI)
An industry-wide standards effort that
will use brand logos as indicators to
help people avoid fraudulent email,
while giving marketers a huge new
opportunity to put their brands in front of
consumers for free.
Agari is leading the BIMI pilot with major
ISPs before general availability.
Pilot initially limited to
domains/organizations at p=quarantine
or p=reject only.
https://www.brandindicators.org
Brand Indicators for Message Identification

32. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Cisco Threat Response

33. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Cisco Threat Response
The unifying force powering Cisco’s integrated security architecture
Simple
Detect, investigate, and remediate
across multiple integrated security
technologies
Fast
Reduce time spent on security
operations functions up to 85%*
Effective
Aggregate threat intelligence
into immediate action

34. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Without Threat Response
1. IOC / Alert
With Threat Response
1. IOC / Alert / Browser Plugin
2. Investigate and remediate incidents from multiple security tools in a single
console
Your SecOps with and without Threat Response
32 minutes
5 minutes
2. Investigate incidents in multiple
consoles
Product
dashboard 1
Product
dashboard 2
Product
dashboard 3
Product
dashboard 4
3. Action/Remediate
Product
dashboard 1
Product
dashboard 2
Product
dashboard 3
Product
dashboard 4

35. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Phishing Defense
Multiple Consoles = Multiple Opinions

36. Scenario: Friday afternoon 3 pm
From
To
Bill the
IT guy
Ryuk malware
Hi Bill,
In the last week three hospitals in Ontario were hit with the Ryuk virus resulting in a
ransomware attack. Do you know if we are affected? Please let me know as soon as
possible as this virus can be dormant for months before showing its ugly face.
Joe the CIO
Joe the CIO

37. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential
Cisco’s integrated security architecture
Talos
Threat
Response
Defend better
Respond faster
Umbrella
AMP for Endpoint
Email

38. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Please Compete This Survey
https://www.surveymonkey.com/r/phishandfood

39. Thank You