Intrusion prevention systems provide an additional layer of security to catch traffic that firewall
features cannot IPX devices can inspect data and check if anything in the payload matches an IP signature.
IP signatures are sets of rules that look for malicious traffic patterns if traffic matches an IP signature
it can be dropped and an alert can be sent to a monitoring system.
Now happened to into Cisco's fire power management center that I have running in the lab so that you
can see what the IPX signature list looks like to give you a better idea of what type of traffic IP
signatures are identifying So here we are on the web page for the firepower Management Center.
The Cisco fire power management center is a central management point for any fire power security device
so far and multiple security devices running on my network.
I can actually push IPX policies to all of my devices right from the central management Googie as well
as look at reports and data that's been collected from my devices.
So here under the summary dashboard intrusion the About page you can see there's widgets that show the
top attackers for intrusion events as well as what applications were used for the different IP signature
hits.
If I want to look at specific intrusion events I can go to the analysis intrusions events page gives
us a nice cist log looking list of intrusion events that have been captured by our security devices.
So here are a few IP signatures that have been matched from traffic traversing my security devices.
I'm going to go hide and Right-Click one of these events and I can actually go to rule documentation.
So this is going to give me detailed information about this signature so I can determine if this is
a false positive or if this should have actually been blocked.
So here this tells us that this event is generated when they inspect preprocessor detax a request for
a URL that is longer than a specified length.
This may indicate an attack or an attempt to evade an idea as and then it goes into more detail if you
want to really get into it.
Now I'm going to go to policies and intrusion just to show you what type of signatures can be enabled
or disabled.
So this is where I would configure all of the IP signatures for my security devices.
There's categories you can go through.
Let's check out exploit kit.
So I have signature IDs message giving a brief description of what the signature is matching.
And here's a column to configure the rule to be disabled dropped or generate events.
Once we're happy with which IPX rules are enabled or disabled then we would add this IP policy to our
Access Control Policy and then deploy it out to our security devices so that they could inspect traffic
based on these IPF signatures
next generation solutions like firepower.
Also include an anti-malware feature Cisco's Ampe solution is another layer on top of IPX scanning Ampe
scans files and checks to see if they are considered to be malicious.
By the Cisco security cloud if the cloud says the file is clean then the file is sent to the destination
home.
But if the cloud determines that the file is malicious then it can be dropped.
Now let's take a tour of a fire power amp so that you can have a better idea of what type of configuration
can be applied for preventing malware.
So here I'm back in the fire power management center.
Gooey.
First I'm going to show you the configuration options for AM.
So if I go to policies access control malware and file that will take me to the network amp configuration
area.
Ball that's floating I want to point out that there's two different types of amp with firepower.
There's a network amp and amp for endpoints also known as fire amp network Gambas when you have a hardware
or virtual device that's actually scanning files as they go in and out of your network.
While M for N points or fire up as the endpoint solution and actually runs on your computer or mobile
device and scans files locally.
So here on my FMC I have a file policy that is being applied to my security devices.
And just like an access list you're creating rules.
So I have one rule that defines what types of files I'm going to scan and then the action I'm going
to take based on if the file is malicious.
So it's go out of this so you can see what type of options you have.
Here are the different file type categories that you can select and if you want you can actually select
specific file types.
Since this is a lab environment I just have all the categories selected.
And then there's also some additional scanning that you can have applied to your security system with
dynamic analysis or Spiro and then I'm saying what's my action so I can say just the text files to just
get log information for file transfers.
I could block specific file types regardless if there were malware or not.
Maybe my company has a policy that says no executables are allowed to be transfer externally.
I could match on the executables and just say block files and then we have malware cloud look up and
block malware malware cloud look up would be if I wanted to just monitor if I had malware traversing
my network and this would check the amp cloud to see if files were malicious or not and it would just
give me a log event so that I could be aware that there was malware on my system or your best bet.
Which is what I'm doing and my policy is to block malware So this means buying a file traverses my or
your power device when it checks the cloud to see if the file is malicious or not.
If the cloud moves back and says it's malware then I'm going to block the file transfer.
If we want to monitor our malware events we can go to analysis files and malware events.
And here is a list of the malware events that have been triggered in my networking environment.
One really cool thing about amp with fire power is something called the file trajectory.
So if I go to network file trajectory it's going to show us how a file entered the network and then
hosts it was transferred between.
And if it was allowed or blocked
can there slacked recently viewed files from your file trajectory or pasting a file hash IP address
or a file name.
I'm going to paste in file name that I know was triggered as malware
and here's the file trajectory for that malware.
So here you can see how and when the malware entered the network as well as if it was transferred and
blocked.