Cisco Systems, Inc. (CSCO) Earnings Call Transcript & Summary

Let's hear it, Jon.

This is what ESG believes, that -- and I'll read it. XDR is an integrated suite of security products spanning hybrid IT architectures, kind of on-prem and cloud, designed to inter-operate and coordinate on threat prevention, detection and response. XDR unifies control points, security telemetry, analytics and operations into 1 enterprise system. Now we've been talking about SOAPA since 2016. SOAPA stands for security, operations and analytics platform architecture. XDR, to me, is SOAPA. Now what I'm learning is -- and I've learned this at this year's RSA is -- you can't be dogmatic about this definition. Sources of telemetry need to be heterogeneous, as we've talked about. But it's really gathering the right data and putting together the right analytics and then automating the responses. Different organizations will do that differently, but Cisco has got a unique approach because of its footprint, Briana. So tell us about that.

Absolutely, Jon. I think, first off, salute on the definition and on your statement of the industry needing to kind of solidify on a common version of this definition. Different companies and different firms may have slightly different versions of how they would spell this out or different interpretations. But the fact that the response can no longer be a very light version of this lingering R and XDR when detection is really only what's happening, that is not sufficient in 2023 and beyond. The fact that detection is no longer just bringing a bunch of events together in an aggregated way and presenting them to the analysts for the analysts to figure it out, that is insufficient. That is not correlation and detection across multiple heterogeneous sources. So to your point, when Cisco looks at this, we are a network provider at heart at the beginning of time. And we know the network better than anybody else. So we really started to look at this by saying, well, endpoint telemetry is foundational. Network in all of those variations that I mentioned previously, e-mail, DNS, proxy, cloud-based, et cetera, is very, very important, especially when you about the hybrid IT architecture here, that's when we start to get, especially into those cloud-based or we can bring up other acronyms in the industry, but like Zero Trust and cloud edges where people need to understand how communication to their resources in a time we're stealing data or encrypting data for malicious purposes is king. We need to bring that together. So the way that Cisco is really thinking about this, Jon, is that network telemetry is key. It's really, really important to have that network traffic analysis.

Yes. And I'll support you on that because -- 2 things. One is, when I asked, when we did some research and said, "Okay, how do you know if something's wrong in your environment? How do you know you're under attack?" Between 50% and 60% said, "We look at what the network is telling us." So it's some anomalous connection. It's anomalous connection to an external website. It's lateral movement across the network. So that's point 1. Point 2 is, we've been doing this forever. So if you think about it, what did we use before we talked about XDR and SIM? We used ethereal. We used wire shark. We did full packet capture. So there's history and culture here. And so I tend to agree that while EDR does capture some network traffic, let's look at the network itself. So I totally agree with you. And -- and so it looks like our definitions are pretty consistent with each other.

Very much so.

So Briana, we talked about network telemetry as an important source. And I totally agree with you. But can you give us an example of an attack that you may not be able to detect through other sources of telemetry where the network is really tantamount?

Yes, absolutely, Jon. Actually, what we're showing right now is an example of a DNS tunneling attack. And with DNS tunneling attacks, what you'll see is that there's an exfiltration of data that happens over UDP as a protocol and Port 53. And those are very standard. If you were to shut those down in your environment, your environment would probably come to a halt because you couldn't process DNS traffic. So as you can see here, I might start out with something like a singular connection where I'm using that path to exfiltrate data. But over time, what we would start to see is either multiple connections or large packets on -- abnormally large packets that are an anomaly for DNS traffic coming across that protocol or port or a combination of both. And these are the types of things that you wouldn't be monitoring for per se on an endpoint-specific area. You might see things like maybe an extra DNS traffic, but you wouldn't see things like the volume of the traffic coming across that. But in a network layer, you would be analyzing that. So things like a firewall or an IDS solution or even an MDR solution would be able to provide that visibility. And that would be really critical, because you would have active data exfiltration happening in your environment. So your ability to catch this either over time or quickly if it were happening in bulk is very, very critical. And actually, it's 1 of the reasons why we are supporting not only having network telemetry into our solution, but for Cisco XDR, we've built in some network detection capabilities by default.

So we asked people, okay, given -- and we gave them this definition of XDR, and we'd say -- well, we asked them, "What would you like to see? So what would the most important outcome be in terms of security efficacy." And this is what we got. So 36% said extending and enhancing our threat detection and response capabilities across the growing attack surface. So to me, that's really looking at cloud. It's saying, "What's going on in the cloud that I can relate to a kill chain?" And sometimes that will be the start of an attack, sometimes that will be the end of an attack. But we need to understand not just on-premise resources but cloud-based resources. 1/3 of those respondents said improving the fidelity and prioritization of security alerts to make it easier to triage and respond to events. And that's the risk-based aspect. So I'm getting all of these alerts. I'm hopefully rolling them up into incidents, so I know the attack pattern. But then when I go to respond, I want to respond to attacks or to threats that really target my critical assets or assets that are particularly vulnerable, that have a direct path to my critical assets. And that's the risk-based XDR component that we talked about upfront, Briana.

That's right, Jon. In order to really classify what's happening in the environment, the information that you're receiving from the event -- and to your point, from the endpoint, when those more seasoned analysts would say, I looked at the network, I looked at firewall logs or other sources, IDS logs to understand what was happening, there were times where they didn't have details from EDR the way that they do today. And so that traffic was very, very valuable for them. So when we look at the correlation of that information, that's going to provide me a level of data that's very, very valuable if I can take a network telemetry event and an endpoint event or multiple network telemetry events and put them together to say, "Hey, what's happening in this segment of my environment and this segment of my environment is the same, and it's happening on Jon's machine and Briana's machine." That's the first key piece. But then there's contextual analysis of, what does Jon do for us? And what information does he have access to? What does Briana do for us? And what information does she have access to? And in that context, I as a user am an asset to the organization. This is a thing that we're working on. Whether those are corporate environments or home systems that now introduce a whole new extra layer of potential vulnerabilities that could be in play with exploits that could be associated with them, access to those systems that I as a corporate environment may not be able to control, that is additional context that allows us to say if 1 or more users is being attacked, if 1 or more devices is being attacked, if 1 or more networks is being attacked. And those assets have this level of priority in our environment and categorization in our environment of being a super user. And they have access to certain information and they have administrative access to gain to it. That is a really important key aspect into putting an incident in a certain priority with that contextual awareness for an analyst to say, "I need to work on this first. The tool put this up at top for me. And they told me that 1 of the reasons I need to work on it first is because Jon and Briana, our analyst environment and our product development environment, are under attack right now." And there's even an additional context we can take in from that -- from those countermeasures because a lot of these telemetry sources are also responsive countermeasures. Has any action been taken? Was there a quarantine put in place, were any files deleted, were any processes stopped, were any blocks occurred, were any blocks that occurred at a network layer. All of that would contribute to the contextual awareness of what is actually happening in that incident, including the fact that it's a larger incident, and a single telemetry source would be able to tell us in the first place. And that context allows us to calculate risk and that risk allows us to prioritize appropriately for the analysts.

Yes. Well said. And that -- I understand that risk and the granular nature that you talked about is so important for an analyst. And if you can't do that through an integrated solution, then that adds time, that adds effort on to an investigation. I would be remiss if I didn't also say that 29% said creating a centralized management hub for security operations, that's kind of what XDR is meant to do, isn't it?

It's absolutely what it's meant to do. And when we look at this from a Cisco perspective, it's actually a really interesting point that you bring up. We have been very specific to say that with our solution, we will be presenting XDR incidents. And when folks like you asked us, "What do you mean by that, Briana?" I will say things like, "I'm not simply going to pull singular EDR events in when your EDR solution has handled it." You've purchased that solution for the value that it provides. So you're trusting it to be the countermeasure that it is doing what it needs to do. So you're going to let that happen. So now let's shift the model of how you think about things. is every single individual EDR event an incident? In a dashboard, the way that it came into your SIM today where an L1 analyst simply needs to go, "This was handled. This wasn't handled. This was handled. This wasn't handled," and pump it up to an L2. Or should that L1 analyst be able to say, "I didn't even get anything from EDR because it was handled. The stuff that I got from EDR was analyzed against the rest of my entire environment, and now this is an incident for us." So that centralized security hub from our perspective is not truly centralized unless it's across your entire environment because what are you centralizing if you're not looking at your entire environment in 1 place and analyzing against that entire environment in 1 place where then responsive action can also be taken?

Yes, that's the centralized hub, and that is reducing the number of alerts that we talked about right up front. So this is an important 1 to close on. So I've heard this a lot. XDR is going to replace SIM. XDR is going to replace e-mail security. The question was, which 1 of these statements most closely aligns with the impact you think XDR will have on your organization's security operations environment? And half of the people -- just over half said XDR will supplement current security operations technologies. And then 44% -- well, XDR will help to consolidate current security operations technologies. This is an important point because we've invested lots of money, time, resources into technologies for security operations to simply throw the baby out with the bath water. In other words, what we can't do -- and as a vendor, I'm sure you know you can't do and say to people, "Just replace this, this, this, and this." [indiscernible] great. That's a really difficult project. You're crossing organizational lines in some cases. People like what they have, in some cases, but it may not coalesce into a greater solution. So what do you see here, Briana?

I think that depending on the organization, most likely either consolidating current security operations technologies or supplementing current security operations technologies will fall into play. And here's what I mean by that. I really feel that the 52% is the more accurate representation of what's going to happen. If you go back to what I just said about bringing in information from multiple security solutions in order to conduct actually extended detection and response, you didn't hear me say once that Cisco's XDR solution is your EDR. And it's your e-mail security, and it's your proxy and SASE Edge. It is not those things. It is an XDR solution. And is going to bring information in to conduct that correlated analysis not just in a historical fashion in -- not just -- excuse me, in a historical fashion or a just-in-time fashion, but consistently analyzing across the data that you provide. And then there was a piece that actually we didn't get a chance to talk too much about, Jon, yet. But when people are discussing improving that meantime, to responding and resolution, there's a piece of that, that comes with the detection being better, faster, automated and presenting a clear understanding of what's happening in your environment so that the analyst doesn't have to go through all of those other steps they work today. But the second piece of that is that R that I mentioned has been really lightly hit upon by a lot of the XDR solutions in the market prior. We should guide people through responses. Today, customers have processes. They have playbooks potentially that they put together to allow an organization and an analyst to know how to respond either in all or in very specific situations. The solution should take that responsive action more seriously. And by taking that responsive action more seriously, it should have a clear definition of the steps that an analyst needs to take. It should potentially take some of those automatically, especially with the approval of the organization to do so. And that response capability should be built in to not only guide the analyst through what's happening, but go ahead and take that action. And take that action in a way that the analyst doesn't need to know more about the environment than they do. So for example, if I have 2 different EDR solutions in my environment because it happens, the analyst shouldn't have to spend time figuring out which EDR solution to quarantine a device on. That would slow down the time to respond and remediate, right? We want that to be quick. So I bring that up because you are going to potentially not need certain solutions. If an XDR solution is properly building in capabilities for you that you have in the past. If you are using a SOAR solution today to deliver security outcomes, and now your XDR solution has that capability built in, maybe you are able to replace something like a SOAR solution. If you have a SIEM solution that you're leveraging solely for security operations today, and it's already a great process that you have that all of your teams contributing to those investigations are in 1 place in your security operations and they're all contributing to the SIEM, then maybe it is something that you could look at. But an XDR solution is not going to do things like the low retention and storage for regulatory compliance. That's not its goal, that's not its focus. It should deliver security outcomes as you need for detecting faster responding sooner and consistently doing so across all of your environment. So I think it's most likely going to supplement current technologies. It will not replace those countermeasures we have in place. We need those to do their job. They are the response of control that we will kick off an action to from the XDR solution. It will not replace certain regulatory compliance requirements and other reasons why customers use other solution tools. But depending on the maturity of a security operations team and how much of that work they do themselves and how expensive their tool set is, it could potentially consolidate some of those operations and those tools for an organization.

I think that will happen over time. I think some of the replacement maybe happen over time, but that's a gradual, evolutionary kind of situation. It's not something that you want upfront.

Yes, agreed. And that's exactly why it's so important for XDR solutions to be built in a heterogeneous model. Because, as you said, we certainly would not expect somebody to rip and replace the solution, especially on their endpoints, there's a lot of disruption to that, a lot of effort that they would -- they have put into their environment today. It is possible that in the same way, they might gradually replace solutions in time, but that could move to a more homogenous model for them with a specific vendor that they've chosen for something like XDR. But overall, we need to be flexible and meet customers where they are, and the solution will be providing additional advantage to the environment, which is why it might be something that organizations will have to add to their budget for that spend that we talked about earlier. But ideally, it's starting to solve those problems we see today, that an organization is saying, "I can't just keep adding to my tool set to do this. I need a solution that's going to bring my tool sets together in a way that's meaningful, contextual, risk-oriented for me and allows me to action and respond sooner."

Boy, that was a good summary there. And as I think about this presentation, I think we talked about some of the challenges people have. Those are not new, but I'd say the scale of them is increasing, which is why I think we're at a tipping point. The solution area is confusing. A lot of CISOs I talked to say, "Jon, I know I need to do something. I just don't know where to start." And so a flexible XDR architecture can give you that ability to start small and grow. But as we discussed, it really does have to do things that can help you improve security efficacy, operational efficiency and enable the business, which we really didn't talk about. But at the end of the day, that's what's most important. And Briana, you talked about how Cisco is approaching this. How would you summarize what we just talked about?

I would agree with everything that you said, Jon. And as organizations are trying to figure out how they bring XDR into their environment, we feel that they should be making certain demands, honestly. They should be expecting consistent detection and response across whatever telemetry sources they were providing into place. They should be expecting correlation that is happening in an analytical level that does not require building rules in order to do so with guided responsive capabilities that are suggested and provided based off of the event at hand. And with infused threat intelligence. We didn't talk about that much, but as a cybersecurity solutions provider, you cannot deliver quality solutions without a well put together threat analyst team, which Cisco has in Talos. That team helps inform our understanding of the threat landscape. And with the understanding of the threat landscape, we can infuse that intelligence into the correlation that we conduct that allows for that additional risk-based prioritization, which is including that contextual asset awareness and environmental analysis. So we think that organizations should not accept an XDR solution that is below those certain standards, but also that allows them to do what's right for their environment in being able to bring in what they have already invested in and allow them quick onboarding and adoption with value.

That's great. And I'm glad you brought up threat intelligence. I'm a big fan of threat form defense. And so I'm going to ask you 1 more question before we finish, and that is we didn't talk about minor attack support. MITRE ATT&CK has become sort of the lingua franca of security operations. I'm a big fan, so how do you support MITRE ATT&CK?

Absolutely. As part of our prioritization analysis, we actually take an understanding of the tactic and technique, or more specifically, the TTP, the consolidated version of that into account. And we have an understanding from our data science team coming from some of the vulnerability solution sets that we have in place in our portfolio, of how CISOs actually, Jon, are looking at vulnerability and exploitation analysis. So when they tend to look at a vulnerability and where they need to take action or where mitigation can be the stop gap to make sure that they're comfortable until they can patch their entire environment against the 1,000 vulnerabilities that come out in a day, a lot of the way that CISOs and CFOs and Boards are looking at it is, what's the impact financially potentially to my environment if we are breached by an exploit of this vulnerability? So our solution set takes into account the likelihood that, that TTP being in use, whether it's to exploit a vulnerability or just being able to be used as a tactic and technique in your environment, what is the likelihood of impact and particularly potentially financial loss around that? We use that when we see the tactics and techniques involved to understand the potential risk alongside the asset context for evaluating a prioritization score. And that's just how we've chosen to do it within our specific solution set. But in general, to your point, the MITRE tactics and techniques are a common language. I would say that they're a more common language across security operations teams, most likely than our industry standards because other industry standards may be widely adopted by certain verticals and not others where you may have a certain security maturity level that is more advanced to understand some of those other standards. MITRE and the ATT&CK enterprise framework or the ATT&CK mobile framework, they're very commonly used. They're built into solution sets today, and analysts are able to understand them. So those mappings should be very clearly outlined. They can help an analyst understand how bad the incident is just by seeing how far down the tactic span the attack has happened. And then by using those TTPs to understand the actual potential impact and the risks associated with that, that can be infused alongside the threat intelligence of a certain campaign or threat actor being known to use that technique into prioritizing an incident.

Great. Well, Briana, thank you. This was great. I learned a lot. And hopefully, our audience did too. And how can people learn more from Cisco?

Absolutely, Jon. Thanks so much for that opportunity. People can go to our Cisco website or you can Google Cisco XDR, as Jon mentioned, for RSA, it was exciting for us. We had a big launch event there. So there's plenty of information on our website and ways to outreach to someone. If you don't have an aligned account team to get more information, we'd love to speak to you more about your needs, the outcomes that you are expecting and how we could potentially provide those for you. And Jon, thanks so much for the conversation today.

My pleasure Briana, thank you.

I'd like to thank you all for attending the event. We hope you found it informative. And as a reminder, please take a moment to complete the confidential survey that has been posted in the chat panel. It will also pop up in your browser as you exit. Thank you for joining, and have a great day.