Integrated Security Technologies and Solutions - Volume I

Aaron Woland, CCIE No. 20113, is a principal engineer in Cisco’s Advanced Threat Security group and works with Cisco’s largest customers all over the world. His primary job responsibilities include security design, solution enhancements, standards development, advanced threat solution design, endpoint security, and futures.Aaron joined Cisco in 2005 and is currently a member of numerous security advisory boards and standards body working groups. Prior to joining Cisco, Aaron spent 12 years as a consultant and technical trainer.Aaron is the author of both editions of Cisco ISE for BYOD and Secure Unified Access, Cisco Next-Generation Security Solutions: All-in-one Cisco ASA FirePOWER Services, NGIPS, and AMP; CCNP Security SISAS 300-208 Official Cert Guide, CCNA Security 210-260 Complete Video Course, and many published white papers and design guides.Aaron is one of only five inaugural members of the Hall of Fame Elite for Distinguished Speakers at Cisco Live, and he is a security columnist for Network World, where he blogs on all things related to security. His many other certifications include GHIC, GCFE, GSEC, CEH, MCSE, VCP, CCSP, CCNP, and CCDP.You can follow Aaron on Twitter: @aaronwoland.Vivek Santuka, CCIE No. 17621 is a consulting systems engineer at Cisco and is a security consultant to some of Cisco’s largest customers. He has over 13 years of experience in security, focusing on identity management and access control. Vivek is a member of multiple technical advisory groups.Vivek holds two CCIE certifications: Security and Routing and Switching. In addition, he holds RHCE and CISSP certifications.Vivek is author of the Cisco Press book AAA Identity Management Security.You can follow Vivek on Twitter: @vsantuka.Mason Harris, CCIE No. 5916, is a solutions architect for Cisco, focusing on cloud architectures with Cisco’s largest global customers. He has more than 24 years of experience in information technology and is one the few individuals in the world who has attained five CCIE certifications. Prior to joining Cisco, he was the chief architect at cloud security startup vArmour Networks. Outside work, Mason can be found backpacking on long trails or at home with his family. A lifelong UNC Tarheels fan, he holds an undergraduate degree from UNC–Chapel Hill and a master’s degree from NC State University, with a minor in Arabic.Jamie Sanbower, CCIE No. 13637 (Routing and Switching, Security, and Wireless), is a technical solutions architect focusing on security for the Global Security Architecture Team.Jamie has been with Cisco since 2010 and is currently a technical leader and member of numerous technical advisory groups. With over 15 years of technical experience in networking and security, Jamie has developed, designed, implemented, and operated enterprise network and security solutions for a wide variety of large clients.Prior to joining Cisco, Jamie was the director of the cybersecurity practice at Force 3. His other certifications include CISSP, CEH, and MCSE.

• Introduction xxvPart I Hi There! This Is Network Security 1Chapter 1 Let’s Talk About Network Security 3Know Thy Enemy 4Know Thy Self 6Security Standards and Frameworks 9Regulatory Compliance 15Payment Card Industry Data Security Standard (PCI DSS) 16Security Models 18Integrating Security Solutions 23Summary 25References 25Chapter 2 Infrastructure Security and Segmentation 27The Three Planes 27Securing the Management Plane 28Securing the Control Plane 38Securing the Data Plane 49Visibility with NetFlow 76Summary 77References 78Chapter 3 Wireless Security 79What Is Wireless? 79Wireless Security Overview 90Securing the WLAN 94Configuring Wireless Protection Policies 98Management and Control Plane Protection 114Integrating a WLC with Other Security Solutions 120Summary 122References 122Part II Deny IP any any 123Chapter 4 Firewalling with the ASA 125ASA Fundamentals 125Traffic with the ASA 151ASA Advanced Features 167Advanced Firewall Tuning 172Troubleshooting the ASA 176Summary 180References 181Chapter 5 Next-Gen Firewalls 183Firepower Deployment Options 184Configuring Firepower Threat Defense 186Access Control Policies 206Analysis and Reporting 229Summary 237References 238Chapter 6 Next-Gen Intrusion Detection and Prevention 239NGIPS Overview 239Cisco NGIPS Appliances 248Snort 256Configuring a NGIPS 267Operationalizing a NGIPS 283Summary 296References 297Chapter 7 IOS Firewall and Security Features 299Network Address Translation (NAT) 299Zone-Based Firewall (ZBF) 309IOS Advanced Security Features 319Summary 331References 331Part III EHLO. You have threat in content 333Chapter 8 Content Security and Advanced Threat Protection 335Content Security Overview 335Web Security Appliance 336Email Security Appliance 370Security Management Appliance 390Summary 391References 391Chapter 9 Umbrella and the Secure Internet Gateway 393Umbrella Fundamentals 393Umbrella Overview Dashboard 399Deploying Umbrella 401Cisco Investigate 423Summary 425References 425Chapter 10 Protecting Against Advanced Malware 427Introduction to Advanced Malware Protection (AMP) 427Role of the AMP Cloud 429Doing Security Differently 430The Cloud 437Cloud Proxy Mode 438Air Gap Mode 440Threat Grid 442The Clean Interface 446The Administrative Interface 446The Dirty Interface 446Comparing Public and Private Deployments 446AMP for Networks 447AMP for Endpoints 457Custom Detections 462AMP for Windows 474Mac Policies 490Linux Policies 495AMP for Android 497Groups, Groups, and More Groups 498The Download Connector Screen 499Distributing via Cisco AnyConnect 500Installing AMP for Windows 501Installing AMP for Mac 503Installing AMP for Linux 504Proxy Complications 511AMP for Content Security 513Content Security Connectors 513Configuring AMP for Content Security Appliances 514Configuring the Web Security Appliance (WSA) Devices 515Configuring the Email Security Appliance (ESA) Devices 519AMP Reports 522Summary 5249781587147067, TOC, 4/16/2018