CISCO AMP for endpoints prevents attacks and blocks malware at the point of entry.
CISCO AMP for endpoints, prevents attacks and blocks Malware at the point of entry
AMP for Endpoints offers comprehensive protection against the most advanced attacks. Not only does it prevent breaches and block malware at the point of entry, but it also detects, stops and quickly remediates threats if they bypass frontline defenses and manage to sneak through.
If something does eventually get through, AMP provides continuous threat monitoring and detection to quickly detect malicious behavior and response capabilities to quickly contain and eliminate threats before damage is done.
To prevent attacks, Talos global threat intelligence strengthens your defenses. File signatures, partial fingerprint matching and other detection systems are used to block malware at the point of entry.
We know that not all attacks can always be prevented and that some advanced malware may find its way in. In this case, AMP continuously logs and analyzes all file, process and communication activity on your endpoints to quickly detect threats. This continuous logging and analysis provides security teams with a holistic view of activity across all your endpoints including Windows, Mac, Linux and mobile devices.
AMP shows you the entire history of events recorded in the system.
This enables what we call retrospective security. It’s about going back in time to see everything that happened during the attack, which provides a deep level of visibility, context and control to detect attacks quickly, measure the threat and remediate the malware before it causes significant damage.
When it comes to malware, timing is everything.
The average detection time in the industry is 100 days. AMP can detect malware in hours or even minutes.
From AMP’s in-browser management console, you can protect your organization. Threat indications help you identify attacks before they fully materialize. AMP automatically correlates file events with malicious behavior to discover and prioritize coordinated attacks.
Traceability
Traceability shows you the entire history of a threat on a device. The origin of the threat, what applications are affected, main processes, connections to remote hosts and unknown files downloaded by malware. Traceability allows you to toggle between viewing one endpoint and all endpoints to see which machines are affected by the threat. File analysis pulls information from the integrated sandbox with Threat Grid technology to show even more details such as threat scores, behavioral indicators, screenshots of malware execution and sample packet captures. Outbreak control allows you to stop malware progress automatically with a few mouse clicks.
For example, if you see malware on one endpoint and want to stop it from running on all endpoints in the network, simply right-click and add it to a block list to quarantine the file and stop it from running on all endpoints. Low prevalence shows files on all endpoints that have gone unnoticed and have been executed by only a few users. This allows you to further analyze these files to find out if they are malicious.
Vulnerable software function
Displays all software on your endpoints that is currently vulnerable to malware so you can quickly fix it.
AMP continuously cross-checks files analyzed in the past with the latest threat intelligence and quarantines files that were previously considered safe or unknown, but are now known to be a threat.
AMP for Endpoints is part of the integrated security ecosystem that CISCO has designed to protect you.
Finally, AMP for endpoints is not a product for specific moments and lacks synchronization. It includes an API to synchronize it with other security or SEM tools.
Threat information is shared and correlated between endpoint AMPs in the network IPS, firewall, web proxies, mail gateways… That way, if a threat is detected in one place, all others are protected.
Some of these capabilities allow:
- to make better security decisions,
- accelerate investigations,
- simplify the management of terminal security and
- greatly reduce the time to detect, contain and remediate malware.
It may seem that this involves a lot of scanning on the endpoints, however, all these scans are performed in the cloud. Resource consumption that affects users and renders equipment unusable is a thing of the past. The cloud and endpoints communicate via AMP’s lightweight connector. It has no visible effects for users.
