As cyberthreats become more sophisticated, the cost to identify, detect and block these threats as well.  However attackers often reuse infrastructure in multiple attacks leaving their cyber fingerprints for the world to see. What if you could use those fingerprints to uncover attacks before they launch?  Cisco Talos use these fingerprints to spot malware signatures and behaviour and block them instantly.

In the rapidly evolving world of malware, threats are becoming harder and harder to detect. The most advanced 1% of these threats, those that will eventually enter and wreak havoc in your network, could potentially go undetected. However, Secure Endpoint provides comprehensive protection against that 1%.

Cisco Secure Endpoint prevents breaches, blocks malware at the point of entry, and continuously monitors and analyses file and process activity to rapidly detect, contain, and remediate threats that can evade front-line defences.

Stopping threats at the earliest point in time ensures minimal damage to endpoints and less downtime after a breach. Secure Endpoint employs a robust set of preventative technologies to stop malware, in real-time, protecting endpoints against today’s most common attacks.

File reputation: Secure Endpoint contains a comprehensive database of every file that has ever been seen and a corresponding good or bad disposition. As a result, known malware is quickly and easily quarantined at the point of entry without any processor-intensive scanning.

Antivirus: Secure Endpoint includes constantly updated, definition-based antivirus engines for both Windows and Mac or Linux endpoints. All endpoints benefit from custom signature-based detection, allowing administrators to deliver robust control capabilities and enforce blacklists. The antivirus signature database resides locally on each endpoint, meaning it does not rely on cloud connectivity to operate. This ensures that your endpoints are protected both on- and offline.

Polymorphic malware detection: Malware actors will often write different variations of the same malware to avoid common detection techniques. Secure Endpoint can detect these variants, or polymorphic malware through loose fingerprinting. Loose fingerprinting will look for similarities between the suspicious file’s content and the content of known malware families, and convict if there is a substantial match.

Machine learning analysis: Secure Endpoint is trained by algorithms to “learn” to identify malicious files and activity based on the attributes of known malware. Machine learning capabilities in Secure Endpoint are fed by the comprehensive data set of Cisco Talos^™ to ensure a better, more accurate model. Together, the machine learning in Secure Endpoint can help detect never-before-seen malware at the point of entry.

Exploit prevention: Memory attacks can penetrate endpoints, and malware evades security defences by exploiting vulnerabilities in applications and operating system processes. The exploit prevention feature will defend endpoints from exploit-based, memory injection attacks.

Script protection: Secure Endpoint provides enhanced visibility in Device Trajectory into scripts executing on your endpoints and helps protect against script-based attacks commonly used by malware. Script control provides additional protection by allowing the Exploit Prevention engine to prevent certain DLLs from being loaded by some commonly exploited desktop applications and their child processes.

Behavioural protection: Secure Endpoint’s enhanced behavioural analysis continually monitors all user and endpoint activity to protect against malicious behaviour in real-time by matching a stream of activity records against a set of attack activity patterns which are dynamically updated as threats evolve. For example, this enables granular control and protection from the malicious use of living-off-the-land tools.

As the number and variety of advanced threats designed to slip past preventative measures increase, the possibility of a breach should be treated as an eventuality. With that mindset, a powerful toolset should be deployed to help easily identify infected endpoints and understand the scope of an attack. In addition to multiple prevention and detection capabilities, Secure Endpoint offers granular endpoint visibility and response tools to handle security breaches quickly and efficiently.

Dashboards and inbox: Reports are not limited to event enumeration and aggregation. The actionable dashboards built into Secure Endpoint enable streamlined management and faster response. Events and endpoints are categorised by priority and tied into workflows to track progress during investigation.

Endpoint forensics: Powerful tools like file trajectory and device trajectory use Secure Endpoint’s continuous analysis capabilities to show you the full scope of a threat. Secure Endpoint identifies all affected applications, processes, and systems to pinpoint patient zero, as well as the method and point of entry. These capabilities help you quickly understand the scope of the problem by identifying malware gateways and the path that attackers are using to gain a foothold into other systems.

Dynamic analysis: Secure Endpoint includes a built-in, highly secure sandboxing environment, powered by Cisco Threat Grid, to analyse the behaviour of suspect files. File analysis produces detailed information on files, including the severity of behaviours, the original file name, screenshots of the malware executing, and sample packet captures. Armed with this information, you’ll have a better understanding of what is necessary to contain the outbreak and block future attacks.

Retrospective security: Secure Endpoint employs patented technology that automatically uncovers advanced threats that have entered your environment. Powered by continuous monitoring, Secure Endpoint correlates new threat information with your past history and automatically quarantines files the moment they start to exhibit malicious behaviour. This automated response to the latest threats provides a faster time to detection and greatly reduces the proliferation of the malware.

Endpoint isolation: It is critical to isolate endpoints that have been compromised to stop threats from spreading and prevent them from communicating with their C&C while at the same time allowing information exchange with trusted resources such as the Secure Endpoint cloud. Endpoint Isolation allows one-click isolation of an infected endpoint along with the ability to whitelist trusted network resources. The endpoint can be de-isolated by a single click by the admin or through an unlock code by the user.

Cisco Secure Endpoint is aimed specifically at devices or more specifically endpoints (any PCs, Macs, Linux, and mobile devices that are connected to your network).

Most organisations will have anti-virus protection in place, but Cisco Secure Endpoint goes beyond the more traditional ‘point-in-time’ detection to provide an increased level of visibility and control needed to combat more advanced threats.

Files on your device are initially inspected by the agent software, but that is not the end of the story. The agent continues to monitor, analyse, and record all file activity and behaviour, even if the file doesn’t initially seem to contain any threat.

If a file that is previously deemed “unknown” or “good” file exhibits malicious behaviour after the initial scan, Cisco Secure Endpoint then automatically sends an alert and shows you the history of that file’s activity and behaviour so that you can investigate and quickly remediate.

It also gives you the ability to look back and find evidence of what the file has been doing on all devices where the file was detected, addressing fundamental questions such as:

• Where did the malware come from?
• What systems were affected?
• What is the threat doing / What did the threat do?
• How do we stop it?
• How do we recover from the attack?
• How do we prevent it from happening again?

Deployment is relatively simple, we deploy the cloud instance of Cisco Secure Endpoint portal and configure on your behalf. Once complete we  provide you with the necessary software to install the agent on your user devices.  This can be manual or using software deployment technology such as a corporate MDM.