book

Cisco Next-Generation Security Solutions: All-in-one Cisco ASA Firepower Services, NGIPS, and AMP

Name: Cisco Next-Generation Security Solutions: All-in-one Cisco ASA Firepower Services, NGIPS, and AMP
ISBN: 9780134213071

by Omar Santos, Panos Kampanakis, Aaron Woland

June 2016

Intermediate to advanced

368 pages

9h 37m

English

Cisco Press

Read now

Unlock full access

About This E-Book
Title Page
Copyright Page
About the Authors
About the Technical Reviewers
Dedications
Acknowledgments
Contents at a Glance
Contents
Introduction
Who Should Read This Book?How This Book Is OrganizedCommand Syntax Conventions

Chapter 1. Fundamentals of Cisco Next-Generation Security
The New Threat Landscape and Attack ContinuumThe Attack ContinuumCisco ASA 5500-X Series Next-Generation Firewalls and the Cisco ASA with FirePOWER ServicesCisco Firepower Threat Defense (FTD)Cisco Firepower 4100 SeriesCisco Firepower 9300 SeriesCisco FTD for Cisco Integrated Services Routers (ISRs)Next-Generation Intrusion Prevention Systems (NGIPS)Firepower Management CenterAMP for EndpointsAMP for NetworksAMP Threat GridEmail Security OverviewEmail Security ApplianceCloud Email SecurityCisco Hybrid Email SecurityWeb Security OverviewWeb Security ApplianceCisco Security Management ApplianceCisco Cloud Web Security (CWS)Cisco Identity Services Engine (ISE)Cisco Meraki Cloud-Managed MDMCisco Meraki Cloud-Managed Security AppliancesCisco VPN SolutionsSummary
Chapter 2. Introduction to and Design of Cisco ASA with FirePOWER Services
Introduction to Cisco ASA FirePOWER ServicesInline versus Promiscuous ModeInline ModePromiscuous Monitor-Only ModeCisco ASA FirePOWER Management OptionsAccessing the Cisco ASA FirePOWER Module Management Interface in Cisco ASA 5585-X AppliancesAccessing the Cisco ASA FirePOWER Module Management Interface in Cisco ASA 5500-X AppliancesCisco ASA FirePOWER Services SizingCisco ASA FirePOWER Services LicensingThe Protection LicenseThe Control LicenseThe URL Filtering LicenseThe Malware LicenseViewing the Installed Cisco ASA FirePOWER Module LicensesAdding a License to the Cisco ASA FirePOWER ModuleCisco ASA FirePOWER Compatibility with Other Cisco ASA FeaturesCisco ASA FirePOWER Packet Processing Order of OperationsCisco ASA FirePOWER Services and FailoverWhat Happens When the Cisco ASA FirePOWER Module Fails?Cisco ASA FirePOWER Services and ClusteringCluster Member ElectionHow Connections Are Established and Tracked in a ClusterDeploying the Cisco ASA FirePOWER Services in the Internet EdgeDeploying the Cisco ASA FirePOWER Services in VPN ScenariosDeploying Cisco ASA FirePOWER Services in the Data CenterFirepower Threat Defense (FTD)Summary
Chapter 3. Configuring Cisco ASA with FirePOWER Services
Setting Up the Cisco ASA FirePOWER Module in Cisco ASA 5585-X AppliancesInstalling the Boot Image and Firepower System Software in the Cisco ASA 5585-X SSPSetting Up the Cisco ASA FirePOWER Module in Cisco ASA 5500-X AppliancesInstalling the Boot Image and Firepower System Software in the SSD of Cisco ASA 5500-X AppliancesConfiguring of Cisco ASA 5506-X, 5508-X, and 5516-X AppliancesUploading ASDMSetting Up the Cisco ASA to Allow ASDM AccessAccessing the ASDMSetting Up a Device Name and PasswordsConfiguring an InterfaceConfiguring the Cisco ASA to Redirect Traffic to the Cisco ASA FirePOWER ModuleConfiguring the Cisco ASA FirePOWER Module for the FMCConfiguring the Cisco ASA FirePOWER Module Using the ASDMConfiguring Access Control PoliciesConfiguring Intrusion PoliciesConfiguring File PoliciesReusable Object ManagementKeeping the Cisco FirePOWER Module Up-to-DateFirepower Threat DefenseInstalling FTD Boot Image and SoftwareFTD Firewall ModeFTD Interface TypesFTD Security ZonesStatic and Dynamic Routing in FTDSummary
Chapter 4. Troubleshooting Cisco ASA with FirePOWER Services and Firepower Threat Defense (FTD)
Useful show CommandsDisplaying the Access Control Policy DetailsDisplaying the Network ConfigurationMonitoring Storage UsageAnalyzing Running ProcessesUsing the System Log (Syslog)Monitoring and Troubleshooting System TasksGenerating Advanced Troubleshooting LogsUseful ASA Debugging CommandsSummary
Chapter 5. Introduction to and Architecture of Cisco AMP
Introduction to Advanced Malware Protection (AMP)Role of the AMP CloudDoing Security DifferentlyThe Prevention FrameworkThe Retrospective FrameworkThe CloudPrivate CloudCloud Proxy ModeAir Gap ModeInstalling the Cisco AMP Private CloudSummary
Chapter 6. Cisco AMP for Networks
Introduction to Advanced Malware Protection (AMP) for NetworksWhat Is That Manager Called, Anyway?Form FactorsWhat Does AMP for Networks Do?Where Are the AMP Policies?Summary
Chapter 7. Cisco AMP for Content Security
Introduction to AMP for Content SecurityContent Security ConnectorsConfiguring Cisco AMP for Content SecurityConfiguring the Web Security Appliance (WSA) for AMPConfiguring the Email Security Appliance (ESA) for AMPAMP ReportsSummary
Chapter 8. Cisco AMP for Endpoints
Introduction to AMP for EndpointsWhat Is AMP for Endpoints?Connections to the AMP CloudFirewalls, Destinations, and Ports, Oh My!Outbreak ControlCustom DetectionsApplication ControlExclusion SetsThe Many Faces of AMP for EndpointsAMP for WindowsWindows PoliciesKnown Incompatible SoftwareAMP for MacMAC PoliciesAMP for LinuxLinux PoliciesAMP for AndroidInstalling AMP for EndpointsGroups, Groups, and More GroupsDownload ConnectorDistributing via Cisco AnyConnectInstalling AMP for WindowsInstalling AMP for MacInstalling AMP for LinuxInstalling AMP for AndroidProxy ComplicationsProxy Server AutodetectionIncompatible Proxy Security ConfigurationsUsing the Cloud ConsoleSummary
Chapter 9. AMP Threat Grid: Malware Analysis and Threat Intelligence
Cisco AMP Threat GridCisco AMP Threat Grid Cloud SolutionCisco AMP Threat Grid On-Premises ApplianceDefault UsersNetwork Segment ConfigurationSummary
Chapter 10. Introduction to and Deployment of Cisco Next-Generation IPS
NGIPS BasicsLegacy IPS Versus NGIPSCisco NGIPS CapabilitiesNGIPS ModesNGIPS Deployment Locations and ScenariosNGIPS Deployment Design ConsiderationsThreat Management and System CapabilitiesFlow HandlingScale and AvailabilityManagement Platform IntegrationLicensing and CostNGIPS Deployment LifecyclePolicy DefinitionProduct Selection and PlanningImplementation and OperationEvaluation and ControlSummary
Chapter 11. Configuring Cisco Next-Generation IPS
PolicyPolicy LayersVariablesConfiguring a Cisco Firepower Intrusion PolicyCommitting a PolicySnort RulesRule AnatomyWriting a RuleManaging Snort Rules in FMCCisco NGIPS PreprocessorsFirepower RecommendationsPerformance SettingsStack/ClusterSummary
Chapter 12. Reporting and Troubleshooting with Cisco Next-Generation IPS
AnalysisIntrusion EventsReportsIncidentsAlertsCorrelation PoliciesTroubleshootingAuditHealth MonitoringSyslogsSummary
Index
Code Snippets

Overview

Network threats are emerging and changing faster than ever before. Cisco Next-Generation Network Security technologies give you all the visibility and control you need to anticipate and meet tomorrow’s threats, wherever they appear. Now, three Cisco network security experts introduce these products and solutions, and offer expert guidance for planning, deploying, and operating them.

The authors present authoritative coverage of Cisco ASA with FirePOWER Services; Cisco Firepower Threat Defense (FTD); Cisco Next-Generation IPS appliances; the Cisco Web Security Appliance (WSA) with integrated Advanced Malware Protection (AMP); Cisco Email Security Appliance (ESA) with integrated Advanced Malware Protection (AMP); Cisco AMP ThreatGrid Malware Analysis and Threat Intelligence, and the
Cisco Firepower Management Center (FMC).

You’ll find everything you need to succeed: easy-to-follow configurations, application case studies, practical triage and troubleshooting methodologies, and much more.

Effectively respond to changing threat landscapes and attack continuums
Design Cisco ASA with FirePOWER Services and Cisco Firepower Threat Defense (FTD) solutions
Set up, configure, and troubleshoot the Cisco ASA FirePOWER Services module and Cisco Firepower Threat Defense
Walk through installing AMP Private Clouds
Deploy Cisco AMP for Networks, and configure malware and file policies
Implement AMP for Content Security, and configure File Reputation and File Analysis Services
Master Cisco AMP for Endpoints, including custom detection, application control, and policy management
Make the most of the AMP ThreatGrid dynamic malware analysis engine
Manage Next-Generation Security Devices with the Firepower Management Center (FMC)
Plan, implement, and configure Cisco Next-Generation IPS—including performance and redundancy
Create Cisco Next-Generation IPS custom reports and analyses
Quickly identify the root causes of security problems

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Cisco ASA: All-in-One Next-Generation Firewall, IPS, and VPN Services, Third Edition

Publisher Resources

ISBN: 9780134213071Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills