Cisco Sales Expert (CSE) - Security
1 Introduction to Cisco Security Solutions
1-1 Overview of Cisco Security Portfolio
1-2 Understanding the Security Market Landscape
1-3 Cisco Security Solutions Value Proposition
2 Cisco Secure Network Solutions
2-1 Cisco Secure Firewall
2-1 1 Firewall Technologies and Deployment Models
2-1 2 Advanced Threat Protection Features
2-1 3 Integration with Cisco SecureX
2-2 Cisco Secure Network Access
2-2 1 Cisco Identity Services Engine (ISE)
2-2 2 Cisco AnyConnect Secure Mobility Client
2-2 3 Cisco DNA Center for Network Management
2-3 Cisco Secure Internet Gateway (SIG)
2-3 1 Cloud-Delivered Security Services
2-3 2 Integration with Cisco Umbrella
2-3 3 Secure Internet Access for Remote Users
3 Cisco Secure Endpoint Solutions
3-1 Cisco Secure Endpoint (AMP for Endpoints)
3-1 1 Endpoint Detection and Response (EDR)
3-1 2 Advanced Malware Protection (AMP)
3-1 3 Integration with Cisco Threat Response
3-2 Cisco Secure Endpoint Management
3-2 1 Managing Endpoints with Cisco Secure Endpoint
3-2 2 Policy Management and Enforcement
3-2 3 Reporting and Analytics
4 Cisco Secure Cloud and SaaS Solutions
4-1 Cisco Secure Cloud Security Solutions
4-1 1 Cisco Cloud Security Architecture
4-1 2 Cisco Secure Cloud Analytics (Stealthwatch Cloud)
4-1 3 Cisco Secure Cloud Email (Cisco Email Security)
4-2 Cisco Secure SaaS Solutions
4-2 1 Cisco Secure SaaS Applications
4-2 2 Cisco Secure SaaS Integration with Cisco SecureX
4-2 3 Managing SaaS Security with Cisco Secure SaaS
5 Cisco Secure Collaboration Solutions
5-1 Cisco Secure Collaboration Architecture
5-1 1 Cisco Webex Security Features
5-1 2 Cisco Secure Collaboration with Cisco Defense Orchestrator
5-1 3 Secure Collaboration in Hybrid Work Environments
5-2 Cisco Secure Voice and Video Solutions
5-2 1 Cisco Secure Voice Solutions
5-2 2 Cisco Secure Video Conferencing
5-2 3 Integration with Cisco SecureX
6 Cisco Secure Identity and Access Management
6-1 Cisco Secure Identity Solutions
6-1 1 Cisco Identity Services Engine (ISE)
6-1 2 Cisco Duo Security
6-1 3 Cisco Secure Access Solutions
6-2 Cisco Secure Access Management
6-2 1 Access Policy Management
6-2 2 Multi-Factor Authentication (MFA)
6-2 3 Identity and Access Management in Hybrid Environments
7 Cisco Secure Threat Defense and Response
7-1 Cisco Secure Threat Defense Solutions
7-1 1 Cisco Secure Threat Defense Architecture
7-1 2 Cisco Secure Threat Intelligence
7-1 3 Cisco Secure Threat Defense with Cisco SecureX
7-2 Cisco Secure Threat Response
7-2 1 Incident Response and Management
7-2 2 Threat Hunting and Investigation
7-2 3 Integration with Cisco SecureX
8 Cisco SecureX Platform
8-1 Overview of Cisco SecureX
8-1 1 SecureX Architecture and Components
8-1 2 SecureX Orchestration and Automation
8-1 3 SecureX Integration with Cisco Security Solutions
8-2 Using Cisco SecureX
8-2 1 SecureX Dashboard and Reporting
8-2 2 SecureX Workflow Creation and Management
8-2 3 SecureX Threat Response and Investigation
9 Sales and Business Development for Cisco Security Solutions
9-1 Sales Strategies for Cisco Security Solutions
9-1 1 Positioning Cisco Security Solutions
9-1 2 Addressing Customer Security Challenges
9-1 3 Building Security Solution Proposals
9-2 Business Development for Cisco Security
9-2 1 Partnering with Cisco Security Ecosystem
9-2 2 Developing Security Solution Roadmaps
9-2 3 Driving Security Sales Growth
10 Certification Exam Preparation
10-1 Understanding the Exam Structure
10-1 1 Exam Domains and Objectives
10-1 2 Sample Exam Questions and Practice
10-1 3 Preparing for the Exam
7-2-2 Threat Hunting and Investigation Explained

7-2-2 Threat Hunting and Investigation Explained

Key Concepts

Threat Hunting

Threat Hunting is the proactive process of searching for potential security threats within an organization's network that may not be detected by traditional security measures. This involves using advanced analytics, machine learning, and human expertise to identify and neutralize threats before they can cause significant damage.

For example, a security team might use threat hunting techniques to search for signs of unauthorized access or data exfiltration within the network, even if there are no immediate alerts or indicators of compromise.

Incident Investigation

Incident Investigation is the process of analyzing a security incident to understand its nature, scope, and impact. This involves gathering evidence, identifying the root cause, and determining the appropriate response. Cisco Secure solutions provide tools and workflows to streamline incident investigation, ensuring that security teams can quickly and effectively respond to incidents.

Consider a scenario where a phishing attack is detected. The incident investigation process would involve analyzing the phishing email, identifying the affected users, and determining the extent of the breach to take appropriate action.

Forensic Analysis

Forensic Analysis is the detailed examination of digital evidence to reconstruct the sequence of events and identify the actions taken by attackers. This process involves collecting and analyzing data from various sources, such as network logs, system files, and user activity, to uncover the full scope of a security incident. Cisco Secure solutions offer forensic tools to support detailed analysis and evidence preservation.

For instance, if a ransomware attack is detected, forensic analysis can help trace the attack back to its origin, identify the methods used by the attackers, and determine the extent of the damage to the network.

Threat Intelligence Integration

Threat Intelligence Integration involves leveraging external threat intelligence feeds to enhance threat hunting and investigation capabilities. By integrating data from global threat intelligence sources, organizations can gain insights into emerging threats, attack patterns, and indicators of compromise. Cisco Secure solutions provide seamless integration with threat intelligence feeds to improve detection and response.

For example, if a new malware variant is detected in the wild, threat intelligence integration can provide real-time updates and indicators to help identify and mitigate the threat within the organization's network.

Automated Threat Hunting

Automated Threat Hunting uses machine learning and AI to continuously monitor and analyze network traffic for signs of malicious activity. This automated approach allows organizations to proactively detect and respond to threats without relying solely on manual processes. Cisco Secure solutions offer automated threat hunting capabilities to enhance security and reduce the burden on security teams.

Imagine a company that uses automated threat hunting to continuously monitor network traffic for unusual patterns. If the system detects a potential data breach, it can automatically trigger alerts and initiate response actions, such as isolating affected devices, to minimize the impact of the breach.

Examples and Analogies

Threat Hunting: Think of threat hunting as a detective searching for clues in a crime scene before the crime is reported. Similarly, threat hunting proactively searches for potential security threats within the network.

Incident Investigation: Consider incident investigation as a detective analyzing a crime scene to understand what happened, who did it, and how to respond. Similarly, incident investigation analyzes security incidents to determine the root cause and appropriate response.

Forensic Analysis: Imagine forensic analysis as a forensic scientist reconstructing a crime scene to understand the sequence of events. Similarly, forensic analysis reconstructs the actions of attackers to uncover the full scope of a security incident.

Threat Intelligence Integration: Think of threat intelligence integration as a detective using information from other cases to solve a current crime. Similarly, threat intelligence integration leverages external data to enhance threat detection and response.

Automated Threat Hunting: Consider automated threat hunting as a security system that continuously monitors a building for unusual activities and automatically takes action if a threat is detected. Similarly, automated threat hunting continuously monitors network traffic and responds to potential threats.

By understanding these key concepts, you can appreciate how Cisco Secure Threat Hunting and Investigation solutions provide comprehensive tools and techniques to proactively detect, analyze, and respond to security threats, ensuring a secure and resilient network environment.