TechValidate Research on Cisco Advanced Malware Protection

Introduction

This case study of Abu Dhabi Gas Development Company Limited is based on a March 2017 survey of Cisco Advanced Malware Protection customers by TechValidate, a 3rd-party research service.

Challenges

The business challenges that led the profiled company to evaluate and ultimately select Cisco Advanced Malware Protection:

• Chose AMP for Endpoints for the following reasons:
  • Endpoint visibility into file activity and threats
  • Retrospective alerting to uncover stealthy attacks
  • Ability to quickly understand the threat and what it’s trying to do
  • Simple, easy to use management interface

Use Case

The key features and functionalities of Cisco Advanced Malware Protection that the surveyed company uses:

• Deployed the following in addition to AMP for Endpoints:
  • AMP for Networks (AMP on Cisco Firepower NGIPS)
  • AMP for Firewall (AMP on a Cisco ASA or NGFW Firewall)
  • AMP for Email (AMP on Cisco ESA)
  • Cisco Threat Grid

Results

The surveyed company achieved the following results with Cisco Advanced Malware Protection:

• Was able to do the following with AMP for Endpoints:
  • Improve security effectiveness
  • Prevent breaches
  • Detect threats faster
  • Increase visibility into potential threats
  • Remediate advanced malware
  • Accelerate incident response
• Evaluated the following company prior to signing up with AMP for Endpoints:
  • Palo Alto
• Prevented/Detected/Defeated the following with AMP for Endpoints:
  • Advanced malware or advanced persistent threats (APTs)
  • Ransomware
  • Malicious email attachments
• Experienced improvements in the following areas after deploying AMP for Endpoints:
  • Breach probability and business risk
  • Executive confidence in the security of the organization
  • Investigation speed and/or quality
  • Visibility into endpoints, vulnerabilities, and threats
  • Time to remediation

Introduction

This case study of NHS Management is based on a January 2020 survey of Cisco AMP for Endpoints customers by TechValidate, a 3rd-party research service.

Challenges

The business challenges that led the profiled company to evaluate and ultimately select Cisco AMP for Endpoints:

• Invested in Cisco AMP for Endpoints because they:
  • Needed to protect against advanced threats
  • Needed to improve security operations efficiency
  • Wanted to increase threat detection and remediation speed and accuracy
  • Needed to be able to respond to incidents faster
  • Needed tools to enhance their threat hunting capabilities
• Considered the following vendors before selecting Cisco AMP for Endpoints:
  • Carbon Black
  • Sophos
  • TrendMicro
  • Palo Alto Networks

Use Case

The key features and functionalities of Cisco AMP for Endpoints that the surveyed company uses:

• Other Cisco Security products used in addition to Cisco AMP for Endpoints:
  • Threat Response
  • Umbrella
  • Email Security
  • Threat Grid
  • Stealthwatch
  • NGFW (Next-Generation Firewall)
  • AnyConnect
  • ISE (Identity Services Engine)
• Rates Cisco AMP for Endpoints on the following features:
  • Antivirus feature: blocking known malware: very satisfied
  • Exploit prevention feature: protecting against file-less malware: extremely satisfied
  • Threat detection and response feature: continuous file monitoring (file and device trajectory): extremely satisfied
  • Threat intelligence: ability to understand unknown threats to their environment: extremely satisfied
  • Multi-platform/OS support: satisfied

Results

The surveyed company achieved the following results with Cisco AMP for Endpoints:

• Most prominent benefits realized from their investment in Cisco AMP for Endpoints:
  • Realized better overall protection/prevention against file-less malware, ransomware, and other advanced threats
  • Improved security operations efficiency
  • Experienced faster and more accurate threat detection and remediation
  • Experienced faster, more effective incident response
  • Enhanced threat hunting capabilities
• Experienced the following after implementing Cisco AMP for Endpoints:
  • Reduced security risks: greater than 75%
  • Improved security operations efficiency: greater than 75%
  • Improved threat detection and remediation speed and quality: greater than 75%
  • Improved incident response speed and effectiveness: greater than 75%
  • Reduced costs and increased staff productivity by simplifying complex endpoint security management tasks: less than 10%
• Cisco AMP for Endpoints helped their security team to better protect their environment from:
  • Zero-day threats
  • Ransomware
  • Cryptomining
  • File-less malware
  • Drive-by-attacks
• Their confidence in protecting their endpoints against malware and other threats has very significantly improved now that they have Cisco AMP for Endpoints as part of their security strategy.
• Reduced their time to detection of threats by up to 12 hours after implementing Cisco AMP for Endpoints.