Cisco Threat Scan Proof of Value
Programme
A step-by-step guide
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Do you know what’s happening in your network?
You can’t protect what you can’t see. Gain visibility and deeper intelligence with the ASA Next Generation Firewall and FirePOWER
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
The Guide covers:
1.
The ASA Family
2.
Why take part in a Cisco Threat Scan Proof of Value installation?
3.
How the programme works
4.
Cisco Threat Scan Attack Risk Report Guide
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
1.
The ASA Family
Threat defence solutions are often complex, costly and can be hard to manage. Cisco’s ASA family with FirePOWER software offers more. The industry’s first adaptive, threat-focused
next-generation firewall that’s intelligent, simple, intuitive, cost-effective and incredibly secure.
The winning factors of the ASA family








Experience the revolutionary next-generation firewall
Gain visibility and deeper intelligence with the ASA 5506
Increase security (compared with traditional solutions)
Take advantage of a 2 week FREE trial
We will install and configure the system at your site
Comprehensive threat attack report provided after 2-weeks
No obligation to purchase
If purchased we can provide technical support and additional services
A class-leading, intelligent, threat-centric solution that’s simple, intuitive,
cost-effective and incredibly secure.
‘Since May 2015, Cisco has reduced the median time to detection
(TTD) of known threats in our networks to about 17 hours —less
than one day. This far outpaces the current industry estimate for
TTD, which is 100 to 200 days.’
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Lower cost and complexity
As well as delivering the highest levels of threat defence, Cisco’s ASA products offer businesses unrivalled cost and control benefits. By
consolidating multiple security features in a single platform, the ASA with FirePOWER Services will help your business to;
 Reduce the requirement for multiple security solutions from different vendors
 Eliminate the complexity and drain on resources associated with managing
disconnected solutions
 Streamline operations by correlating threats to better detect and prioritise threats based on their risk
 Automate security processes to help speed remediation against changing threat conditions
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Want to know more about the ASA 5506?
Watch these short videos
Introducing Cisco ASA with
FirePOWER Services:
Defend Against Today’s Attacks:
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
2. Why take part in a Threat Scan Proof of Value installation?
The short answer: it’s because truly effective threat defence is more in demand than ever. What’s more, figures* show that, today, businesses of
all sizes are seeking powerful but flexible tools for securing networks that do not place a high burden on their staff numbers or budgets.
This is precisely what Cisco’s ASA products offer. Its unique combination of benefits are significant. And our Threat Scan Proof of Value
programme gives you the perfect opportunity to see these benefits for yourself.
As you’ll see, the Threat Scan Proof of Value programme is simple and completely free and after the monitoring period (typically 2 weeks) we
believe you will want to purchase the product.
Why? Because you’ll see the unrivalled network intelligence the ASA with FirePOWER provides.
The result? Unbeatable threat defence and a significant boost in the security your business.
* Cisco ASR 2015, p40
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
3. How the Threat Scan programme works
We will supply you with the Cisco ASA with FirePOWER software.
The ASA will be installed by us in monitor-only mode, and will not be active on the network. The report, profiling network traffic over 14 days,
will be generated by Cisco FireSIGHT.



All you need to do is request a Threat Scan Proof of Value installation from us
We will install a Cisco ASA for free to monitor your network for a 2 week period
After this the equipment is collected and a report generated which will include the following:
•
•
•
•

Executive summary
Assessment results
Business risk of attacks
Recommendations
If you decide to purchase the Cisco ASA, we provide you with a quote for the appropriate ASA with FirePOWER and a Service Contract
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
CiscoThreat Scan Attack Risk Report Guide
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Attack Risk Report Overview, 14 days later . . .
The report provides a complete security analysis for the period during which the network was monitored. It will identify
key observations including critical attacks using impact analysis, allowing customers make better informed decisions
regarding the security of their network.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Total attacks
Total attacks refers to the total number of attacks that were conducted
during the assessment period.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Relevant attacks
This refers to the number of attacks that will have an effect on their
systems or network.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Hosts targeted
This is the total number of hosts that were targeted for attack during the
assessment period.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Irrelevant attacks
Irrelevant attacks show the percentage of threats that will not have any
significant effect on their systems or network.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Events requiring attention
This refers to the percentage of events that occurred during the
assessment period, which may require further investigation and
protection.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Hosts connected to CnC Servers
This shows the number of computer hosts connected to ‘command and
control’ servers, designed to infect their systems and report back on the
network status.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Relevant attacks carry the following risks
This table shows the type of threats that their system was vulnerable to
over the assessment period and the number of times each threat occurred.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Impact Analysis
This graph displays the proportion of high and low impact threats on
targeted machines within their network. This is then measured against the
cost of qualifying these attacks, which Cisco’s FirePower software
automatically identifies. The results of this are then extrapolated to
estimate the cost savings of using and ASA with FirePower over 3 years.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
High impact attacks
This table details the machines in their network that have been identified
as vulnerable to threats and provides them with their IP information.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Hosts at high risk
This chart displays the percentage of their hosts which have been
targeted with high impact attacks.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Hosts already compromised
The report generates a list of compromised devices and details how many
hosts are connected to dangerous CnC servers.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Automating the tuning effort
This table describes the type of changes and the number of times those
changes occurred on their network during the assessment period.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Applications associated with attacks
The applications identified in this table are associated with both high and
low impact events during the assessment period and the number of
occasions these events occurred.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Top attackers and targets
This table details the IP addresses of attackers and information of the
machines on their network that were targeted. This is shown for both high
and low impact events.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
IPv6 attacks and traffic
Network avenue IPv6 is often an unmonitored route for attackers. This
table compares the number of hosts monitoring IPv6 with the number of
attacks seen over IPv6.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Business risk of intrusion attempts
The most common attack types are listed in this table alongside the
associated risks that this presents to their business and network.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
Recommendations
The report provides recommendations for protecting the network and systems
from further threats.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
The image part with relationship ID rId2 was not found in the file.
© 2016 Cisco and/or its affiliate. All rights reserved.
35