Advanced Malware Protection (AMP)

A download arrives at BR-02

A user at BR-02 (site 102, internet only) downloads a PDF from a website. The WAN Edge (cEdge/vEdge) is the only security device on the path. Antivirus on the laptop is a separate layer. AMP gives the branch its own check on files crossing the router, before a second copy of the same file reaches another user.

How a verdict is reached

1. The edge recognises a file transfer in a supported protocol. Typical examples are an HTTP download or an email transfer. The supported protocols and file types depend on your release, so check the current list.
2. It calculates a hash of the file. The hash is computed over the file content, so a changed file has a different hash.
3. It asks the cloud file-reputation service about the hash. The reply is one of three verdicts: clean, malicious or unknown.
4. For a malicious verdict, the policy blocks the file or raises an alert only, depending on the action configured.
5. For an unknown verdict, the file passes unless the policy sends it for sandbox analysis. In that case the file is uploaded to a sandbox service where it is run in a controlled environment and its behaviour is recorded. Cisco's sandbox service has been called Threat Grid. Product names change, so check the current name.
6. The sandbox verdict comes back later, which can take minutes. It is added to the cloud reputation data.

There are two lookups in this flow, a fast one by hash and a slow one by analysis. A well-known file is resolved in the first, a new or targeted one needs the second.

Retrospective detection

Reputation changes. A file that is unknown today may be recognised as malicious tomorrow, after more samples are seen. The cloud service keeps a record of the hashes it has judged. When a verdict changes from clean (or unknown) to malicious, the service tells the edge that handled the file, and an alert appears for it.

The edge cannot recall the file. It was delivered when the alert was raised, so the reaction is a manual or process-driven one: find who received it, check whether it was run, and clean the device.

What AMP needs to work

If the cloud service cannot be reached, the edge cannot get verdicts. As with URL filtering, what then happens (files pass, or are held) is a design decision. Test it.

What AMP does not cover

• Unsupported protocols and file types. If the edge does not recognise the transfer or the type, the file passes unscanned.
• Encrypted traffic without the TLS proxy. The edge sees no files.
• Encrypted or password-protected archives. The content cannot be read, so the edge cannot judge it. Decide in policy how such files are treated.
• Size limits. Very large files may be skipped. Check the limit for your release.
• Files that do not cross the edge. Removable media, local copies and traffic that stays inside the branch LAN are not seen.

Privacy and policy for uploaded files

A hash lookup reveals only a fingerprint. A sandbox upload moves the file itself out of the network, to a service hosted by a third party in some region. For personal data, confidential documents and regulated content, that can conflict with company policy or local law. Decide before enabling uploads which file types are sent, which groups of users are covered, and whether the hosting region is acceptable. Ask the privacy or legal team. This page is not legal advice.

Running AMP day to day

1. Send alerts to a place someone reads. An alert nobody sees has no value.
2. Treat a retrospective alert as an incident: identify the recipient, check the endpoint, record the outcome.
3. For a known-good file that is flagged (an internal tool, for example), add its hash to an allow list after review. Record who approved it and why.
4. Review logs regularly for lookup failures, repeated blocks from one user and unusual file types.
5. After changes to the cloud path, test with a safe test file that the vendor provides for the purpose, rather than real malware. Check the vendor documentation for the approved method.

When a file is not blocked, or a good file is

1. Is the AMP policy attached to the service VPN that carries the traffic, and did the template push complete?
2. Is the inspection service running on that router?
3. Was the transfer visible to the edge? HTTPS without the TLS proxy hides the file. Check protocol, file type and size.
4. Can the router reach the AMP cloud? Check the path, DNS resolution of the service name and firewall rules.
5. What was the verdict and the action? A malicious verdict with an alert-only action will not block.
6. Is the hash on a local list that overrides the verdict?
7. For a false positive, check the file's reputation in the cloud console and follow the dispute process rather than exempting broadly.

BR-02#show utd engine standard statistics file-reputation
File Reputation Statistics
  Files inspected     : (example)
  Clean               : (example)
  Malicious           : (example)
  Unknown             : (example)
  Cloud lookup errors : (example)

Test yourself on AMP