Endpoint Protection and Cisco AMP

Let’s start with the basics. An endpoint is any device that connects to a network. That includes your laptop, your desktop computer, a server, a smartphone, a tablet, or even a smart thermostat. In IT security, we call these ‘endpoints’ because they sit at the end of the network connection, where people actually use them. Endpoint protection is the practice of securing each of these devices against malware, unauthorised access, and data theft.

In the old days, endpoint protection meant installing a single piece of software called antivirus (AV). Traditional AV works using signatures. A signature is like a digital fingerprint of a known piece of malware. The software has a big list of these fingerprints, and whenever you open a file, it checks the file’s fingerprint against the list. If there’s a match, the file is blocked or quarantined. This worked well for a long time, but it has a huge weakness: it can only stop malware that has already been seen and catalogued. New or custom-written malware has no signature, so it slips right through.

Cisco AMP for endpoints is a different, smarter approach. AMP stands for Advanced Malware Protection. It uses three main methods: telemetry, analysis, and retrospective security.

First, telemetry means the software collects massive amounts of information about every process running on the endpoint—not just files, but also behaviour, network connections, and system changes. This data is sent to Cisco’s cloud-based analysis engine. Second, analysis uses several techniques to decide if something is malicious. The primary technique is file reputation. Every file that executes is given a reputation score based on where it came from, its age, its digital signature, and thousands of other factors. A file downloaded from a well-known software vendor’s site gets a good reputation; a file from a suspicious IP address gets a bad one. But AMP also uses behavioural analysis. It watches what the file does once it runs. If a Word document suddenly tries to access the Windows registry and then starts sending emails, AMP recognises that as unusual behaviour, even if the Word document looks completely clean based on its signature.

Third, and most importantly, AMP uses retrospective security. This is its killer feature. Imagine AMP allows a file to run because its reputation score is acceptable and its behaviour seems normal. Later, Cisco’s threat intelligence team might discover that the file was actually malicious all along. With retrospective security, AMP goes back in time, identifies every endpoint that ever touched that file, and tells you exactly what happened: where the file came from, which endpoints it spread to, and what it did. Then you can take action, like rolling back the file to a clean state, even weeks after the infection started. Old antivirus could never do that.

Cisco AMP for endpoints runs as a lightweight software agent on each device. It communicates with the AMP cloud using an encrypted connection. The cloud stores the telemetry data, performs the analysis, and sends back verdicts—‘clean’, ‘malicious’, or ‘unknown’—to the agent. The agent then enforces the verdict by blocking, quarantining, or allowing the file.

AMP also includes orbital, a built-in advanced search tool that lets an IT professional query all their endpoints at once. For example, you could search for any endpoint that has a specific registry key or a particular version of a driver, without needing to log into each machine individually.

Why does this matter for the 350-701 exam? The exam explicitly tests your understanding of endpoint protection concepts and how AMP differs from traditional signature-based AV. You need to know what telemetry, file reputation, behavioural analysis, and retrospective security mean. You also need to understand the deployment options: AMP can be installed as a standalone product on endpoints, or it can be integrated with other Cisco security products like Cisco Umbrella (for web security) and Cisco Firepower (for network firewalls). Both Cisco AMP and Cisco Firepower use the same threat intelligence intelligence, so detection improves across the whole network.

In short, endpoint protection with AMP moves from reactive defence (waiting for a known signature) to proactive defence (analysing behaviour and using cloud intelligence to catch novel threats). For the exam, remember the key differences: signatures versus behaviour, local detection versus cloud analysis, and retrospective versus forward-only visibility.

Here are the main features that Cisco AMP for endpoints provides:

Imagine you work as an IT security analyst for a medium-sized company with 500 employees, all using laptops running Windows and macOS. One Tuesday morning, you get an alert from Cisco AMP. The alert says that a file called ‘invoice_april.pdf.exe’ was blocked on three laptops in the finance department. The file had a very low reputation score because it was downloaded from a website registered only 24 hours ago. AMP blocked it before it could execute.

Step one: you open the AMP console in your browser. The console shows a timeline of events for each affected laptop. You see that the file arrived as an email attachment. The email looked like it came from the CEO’s account, but the sender address was spoofed (forged). Because the executives in finance don’t have the required permissions to approve a new payment, they forwarded the email to someone who does. AMP blocked the file on the first machine, but the attacker had sent the same email to multiple people, so three other machines also received it.

Step two: you use the ‘orbital’ search feature to find if any other endpoint downloaded a file from the same URL or received an email with a similar subject line. Orbital returns results from 12 other machines, all from different departments. You see that nine of those machines had the file blocked, but three machines had the file allowed because their reputation databases were slightly delayed (they hadn’t yet received the updated threat feed). Those three machines are now infected.

Step three: you use AMP’s retrospective security to trace what happened on those three infected machines. The cloud shows that the malicious PDF executable ran, created a new user account with administrative privileges, and then tried to contact an external control server. AMP had already flagged that connection attempt as malicious, so even though the file was allowed to run initially, AMP blocked the outbound network connection. The attack failed to exfiltrate (steal) any data.

Step four: you take action. You use AMP to quarantine the affected files on all three machines. AMP also lists the registry keys and persistence mechanisms the malware created. You manually remove those from each system, or you use a scripting tool to automate the cleanup across all affected endpoints.

Step five: you block the sender’s email address at the email gateway and block the download URL at your firewall, which also has Cisco Firepower. Because AMP and Firepower share threat intelligence, the block is automatically applied to all future traffic.

What you did as an IT professional:

Without AMP, you would have had no visibility into the email, no way to know which machines had the file, and no way to roll back the infection on the three machines that were initially compromised. You would have had to reimage (wipe and reinstall) all 15 machines, costing hours of work and significant productivity loss.

For the exam, remember this scenario: AMP gives you visibility, retrospective detection, and automated response. You are expected to know the difference between AMP’s behaviour and traditional AV.