DTLSv1

DTLS is used for delay sensitive applications (voice and video)
as its UDP based while TLS is TCP based.Therefore DTLS offers strongest throughput
performance. The throughput of DTLS at the time of AnyConnect connection can be
expected to have processing performance close to VPN throughput.

CoA

Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/1-
3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_010101.html

Threat Intelligence Director

It encodes the payload with random characters that are broken into short strings and the DNS server rebuilds the exfiltrated data.

Domain name system (DNS) is the protocol that translates
human-friendly URLs, such as securitytut.com, into IP addresses, such as 183.33.24.13.
Because DNS messages are only used as the beginning of each communication and they
are not intended for data transfer, many organizations do not monitor their DNS traffic for
malicious activity. As a result, DNS-based attacks can be effective if launched against their
networks. DNS tunneling is one such attack.An example of DNS Tunneling is shown below:

The attacker incorporates one of many open-source DNS tunneling kits into an
authoritative DNSnameserver (NS) and malicious payload.2. An IP address (e.g.
1.2.3.4) is allocated from the attacker’s infrastructure and a domain name (e.g.
attackerdomain.com) is registered or reused. The registrar informs the top-level
domain (.com) nameservers to refer requests for attackerdomain.com to
ns.attackerdomain.com, which has a DNS record mapped to 1.2.3.43. The
attacker compromises a system with the malicious payload. Once the desired data
is obtained, the payload encodes the data as a series of 32 characters (0-9, A-Z)
broken into short strings (3KJ242AIE9, P028X977W,…).4. The payload initiates
thousands of unique DNS record requests to the attacker’s domain with each
string as
Reference: https://learn-umbrella.cisco.com/i/775902-dns-tunneling/0

Use MAB with profiling

Reference: https://community.cisco.com/t5/security-documents/ise-profiling-designguide/
ta-p/3739456

RAT

They quickly provision new devices

They view the overall health of the network

teardrop

A teardrop attack is a denial-of-service (DoS)
attack that involves sending fragmented packets to a targetmachine. Since the machine
receiving such packets cannot reassemble them due to a bug in TCP/IPfragmentation
reassembly, the packets overlap one another, crashing the target network device. This
generally happens on older operating systems such as Windows 3.1x, Windows 95,
Windows NT and versions of the Linux kernel prior to 2.1.63.

6

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identitybased-networkingservices/config_guide_c17-663759.html

smurf

Denial-of-service (DDoS) aims at shutting down a
network or service, causing it to be inaccessible to itsintended users.The Smurf attack is a
DDoS attack in which large numbers of Internet Control Message Protocol (ICMP)packets
with the intended victim’s spoofed source IP are broadcast to a computer network using an
IPbroadcast address.

firewalling virtual machines

In this IaaS model, cloud providers offer resources to
users/machines that include computers as virtualmachines, raw (block) storage, firewalls
, load balancers, and network devices.Note: Cloud access security broker (CASB) provides
visibility and compliance checks, protects data against misuse and exfiltration, and
provides threat protections against malware such as ransomware.

model-driven telemetry

https://developer.cisco.com/docs/ios-xe/#!streaming-telemetry-quick-start-guide