Attack types and protection

A simple guide to protect yourself and your organization against the threats covered in this report.

Attack types and protection: A layered approach to security is always advised. We’ve included icons at the end of each story to indicate key threat vectors used (or suspected to be used) and tools that can help protect against them in each case. Below we decode the icons and discuss advantages of deploying the various protections as part of an integrated security architecture.

Advanced malware detection and protection technology (such as Cisco Advanced Malware Protection, or AMP) can track unknown files, block known malicious files, and prevent the execution of malware on endpoints and network appliances.

Network Security such as the Cisco Next-Generation Firewall (NGFW) and Next-Generation Intrusion Prevention System (NGIPS) can detect malicious files attempting to enter a network from the Internet or move within a network. Network visibility and security analytics platforms such as Cisco Stealthwatch can detect internal network anomalies that could signify malware activating its payload. Finally, segmentation can prevent the lateral movement of threats within a network and contain the spread of an attack.

Web scanning at a Secure Web Gateway (SWG) or Secure Internet Gateway (SIG) such as Cisco Umbrella, means you can block users from connecting to malicious domains, IPs, and URLs, whether users are on or off the enterprise network. This can prevent people from inadvertently allowing malware to access the network, and can stop malware that makes it through from connecting back out to a command and control (C2) server.

Email security technology (such as Cisco Email Security), deployed on premises or in the cloud, blocks malicious emails sent by threat actors as part of their campaigns. This reduces the overall amount of spam, removes malicious spam, and scans all components of an email (such as sender, subject, attachments, and embedded URLs) to find messages that contain a threat. These capabilities are critical since email is still the number one vector used by threat actors to launch attacks.

Advanced malware detection and protection technology, such as Cisco AMP for Endpoints, can prevent the execution of malware on the endpoint. It can also help isolate, investigate, and remediate infected endpoints for the one percent of attacks that get through even the strongest defenses.