Ask the Expert Introduction - Brian McMahon

[brmcmaho]

Hello.  I'm part of a team of TMEs dedicated to Cisco's products and solutions for defense against today's advanced threats.  Our areas of coverage include today's main focus, namely AMP and Threat Grid, as well as Firepower, Cognitive Threat Analytics, and Lancope StealthWatch.

My Cisco career started in the mid-'90s in TAC, and after a few years there I worked at an IPsec VPN startup, Network Alchemy, that was acquired by Nokia.  Spent several years as a full-time community college instructor, teaching CCNA, CCNP, and Linux, as well as helping to create and implement an infosec curriculum.  After a few more gigs at other companies, including ID Engines, Palo Alto, and Blue Coat, I had the opportunity about 5 years ago to return to Cisco as a TME.

I'm looking forward to the opportunity today to engage with your AMP-related questions.

[Cesar Salazar]

Hi, can I use FireAMP without a traditional AV?

[brmcmaho]

Certainly you can use AMP for Endpoints (the Cisco branding for "FireAMP") independent of traditional AV.  Often the question is more along the lines of "can AMP for Endpoints be used to replace my traditional AV?"

In that case, the answer unfortunately has to be "it depends."  The reason is that "AV" covers a wide spectrum.  Some people use the term simply to describe classic signature-based virus defense, but others use the term to mean a comprehensive enterprise AV product suite that includes many features beyond just the signature detections.

Here is a Cisco blog post from a few months ago that discusses some of the differences in these interpretations:

Endpoint Protection Platform (EPP) vs Endpoint Detection & Response (EDR)