Endpoint Protection and Detection · Topic 3 of 5
Cisco Secure Client and Cisco Secure Malware Analytics
Describe Cisco Secure Client modules for VPN, access, posture and visibility, and how Secure Malware Analytics runs files in a sandbox and scores them.
- 5 min
- Secure Client is one agent with VPN, Network Access Manager, posture, visibility and other modules.
- Network Access Manager is the 802.1X supplicant.
- The Network Visibility Module sends endpoint flow and process data.
What it is
Cisco Secure Client is one agent with many security modules, and Cisco Secure Malware Analytics is the sandbox that examines suspicious files.
Secure Client replaced the older AnyConnect client. It connects, checks and monitors the endpoint. Malware Analytics, previously called Threat Grid, runs unknown files in a controlled environment, and reports what they do.
How it works
Learn the client modules first, then the sandbox, and how they connect.
Secure Client modules
The core of the client is the VPN capability. Other modules are added as needed, and a single deployment can include several.
| Module | Purpose |
|---|---|
| VPN | Remote access to the network, using TLS, DTLS or IPsec IKEv2 |
| Network Access Manager | A supplicant for wired and wireless 802.1X |
| ISE Posture | Checks device health for ISE |
| Network Visibility Module | Sends flow records about endpoint traffic and the processes behind it |
| Cloud security module | Connects the device to Cisco cloud security services for DNS and web protection |
| Secure Endpoint module | Deploys the Secure Endpoint connector |
| ZTNA module | Gives zero trust access to private applications |
| Diagnostic and Reporting Tool (DART) | Collects logs for troubleshooting |
The names of some modules have changed between releases, so match the purpose when you read a question.
Why modules matter for security
Each module closes a different gap.
- Network Access Manager: proves the device identity to the network.
- ISE Posture: tells the network if the device is healthy.
- Network Visibility Module: shows which application on the laptop made a connection, which a firewall cannot see.
Together they give identity, health and visibility from one agent, and so reduce the number of separate agents on the device.
Deploying the client
There are two main methods.
- Pre-deployment: you install the package with your own software distribution tools.
- Web deployment: the client downloads and installs from the VPN headend when the user connects.
A profile file for each module holds its settings, and you distribute these with the client.
Cisco Secure Malware Analytics
Malware Analytics is a sandbox. A suspect file or URL is submitted, and it is run inside an instrumented virtual machine. The system watches everything the sample does, and then produces a report.
It combines two kinds of analysis.
- Static analysis: examines the file without running it, such as its structure, strings and hashes.
- Dynamic analysis: runs the sample and records the behaviour, such as processes created, files and registry changes, and network connections.
Reading a report
The report gives a threat score, a list of behavioural indicators and supporting artefacts.
| Report item | What it tells you |
|---|---|
| Threat score | An overall value for how malicious the sample appears, where higher means worse |
| Behavioural indicators | Specific suspicious actions that the sample took, each with a severity |
| Process activity | The tree of processes that the sample started |
| Network activity | Domains and addresses it contacted, which become indicators of compromise |
| Artefacts | Files it dropped, with hashes you can search for |
The behavioural indicators are the most useful part. They explain the score, for example an attempt to disable a security tool or to contact a known malicious host. The network details give you addresses and domains to block.
Integration with other products
Malware Analytics is not used alone. Secure Endpoint can send files for analysis, email and web security products submit unknown attachments, and Secure Firewall can send files from its file policy. A verdict that comes back updates the reputation, and can trigger retrospective alerts on every device that received the file.
An API allows teams to submit samples and to retrieve reports from scripts and from other tools.
Limits
Some malware checks whether it runs inside a sandbox and then stays quiet. Sandboxes try to hide their presence, but this is an arms race. A clean report does not prove that a file is harmless, and results should be combined with other evidence.
What to remember for the exam
Six facts cover most questions on this topic.
- Secure Client is one agent with VPN, Network Access Manager, posture, visibility and other modules.
- Network Access Manager is the 802.1X supplicant.
- The Network Visibility Module sends endpoint flow and process data.
- Malware Analytics runs unknown files in a sandbox using static and dynamic analysis.
- A report has a threat score, behavioural indicators and network and file artefacts.
- A sandbox verdict feeds back to endpoints and security tools, and a clean report is not proof of safety.
If a question asks which module supplies 802.1X on the endpoint, the answer is Network Access Manager.
Common mistakes
These four mistakes appear often.
Confusing Secure Client with Secure Endpoint. Secure Client is the connectivity and visibility agent, and Secure Endpoint is the malware protection product that the client can deploy.
Reading only the score. The behavioural indicators explain why the score is what it is.
Treating a sandbox result as final. Evasive malware can pass a sandbox.
Forgetting module profiles. A module without its profile uses defaults and not your settings.
Submitting files to any cloud sandbox shares them with an external service. Check your data handling policy before you submit sensitive documents.
Check yourself
Work through these three questions.
Which Secure Client module acts as the 802.1X supplicant?
The Network Access Manager module.
What two kinds of analysis does Malware Analytics use?
Static analysis of the file without running it, and dynamic analysis that records behaviour while the sample runs.
Why read the behavioural indicators and not only the threat score?
The indicators explain the score and give specific actions, domains and files that you can search for or block.
Topic 3 of 5 in Endpoint Protection and Detection
Test yourself on Endpoint Protection and Detection
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.