Transcription
Cisco PublicPrivacy Data SheetCisco Cognitive IntelligenceThis Privacy Data Sheet describes the processing of personal data (or personal identifiable information) by Cisco CognitiveIntelligence1. Overview of Cisco Cognitive Intelligence CapabilitiesCognitive Intelligence is a threat detection and analytics cloud-based malware behavioral analysis solution leverages (1) webproxy logs from a Cisco web gateway solution such as Cisco Web Security Appliance (“WSA”) or Cloud Web Security (“CWS”) orthird party web proxies and (2) NetFlow from Cisco Stealthwatch Enterprise and/or Cisco Stealthwatch Cloud (which may includeEnhanced NetFlow if Customer enables Cisco Encrypted Traffic Analytics (“ETA”)). The web proxy logs and/or NetFlow helpidentify malware present within a customer‘s environment and allow a customer to research related active malicious behaviors.Cognitive Intelligence is available via (a) AMP for Endpoints, (b) AMP on WSA, and (c) Stealthwatch Enterprise and StealthwatchCloud. Finally, Cognitive intelligence's implementation of Machine Learning based Static File Analysis capability is also availableto AMP customers via an integration with Threat Grid. Please consult the Cognitive Intelligence Documentation for furtherinformation on its technical specifications, configuration requirements, features and functionalities. For more information onCognitive Intelligence, please see gnitive-threat-analytics/index.html.Cognitive Intelligence offers identity and single sign-on through Cisco Secure Sign-On. Please see the Cisco Secure Sign-OnPrivacy Data Sheet if you elect to use Cisco Secure Sign-On.2. Personal Data ProcessingThe tables below list the personal data used by Cognitive Intelligence to carry out the services and describes why we processthat data.For the purposes of this Privacy Data Sheet, the term “Files” means those types of files identified in the applicable Documentation,such as an executable, a Portable Document Format (PDF), a Microsoft Office Documents (MS Word, MS Excel, MS PowerPoint),and those files in a ZIP file (.ZIP). “SPAD Report” means the Simple Portal for Administration report created within the CognitiveIntelligence portal. The SPAD Report is a preview of customer’s reports generated by Cognitive Intelligence and available withinthe Cognitive Intelligence portal.Table 1Personal Data CategoryTypes of Personal DataPurpose of ProcessingRegistration Information NameAddressEmail AddressPhone NumberData is collected for: Creating an account. Data collected is for productenablement, product use notifications, training and support.Customer Web Log Telemetry Customer Device IP andDestination IP AddressCustomer Username*Data is collected for: Security analytics, forensics, efficacy research, general productfunctionality and usage. Cisco global threat intelligence research.If SPAD Report access allowed, data is used to improve customerexperience, advise on appropriate configuration and deployment,assist with interpretation of threat detections, general productusage and integration with other Cisco and third-party products.Data is collected for: Security analytics, forensics, efficacy research, generalproduct functionality and usage. Cisco global threat intelligence research. If SPAD Report access allowed, data collected toimprove customer experience, advise on appropriateconfiguration and deployment, assist with *Customer Username collection is an“opt in” feature that can be enabledthrough the customer’s configuration.Customer NetFlow Telemetry Customer Device IP (source IP) andDestination IP addressCustomer Device MAC addressCustomer Group ID (akaStealthwatch Host Groups, whichcan be configured to captureinternal traffic telemetry in 2020 Cisco and/or its affiliates. All rights reserved.Version 2.0 June 16, 2020
Cisco PublicPrivacy Data Sheet Firewall Event Data and Logs* *Only applies to customers usingCognitive Intelligence throughtheir Stealthwatch Cloudsubscription Customer Enhanced NetFlowTelemetry for Encrypted TrafficAnalytics (ETA)**Enhanced NetFlow telemetry isprovided in addition to theNetFlow telemetry if generatedby the underlying EnterpriseNetwork equipment.Customer Web and API Usagelog*Collected only via CognitiveIntelligence’s “Static FileAnalysis” available via thecustomer’s integration withCisco AMP and/or Threat Grid )Firewall Event Data (may includeusername and/or user ID,accessed URL’s, IP address, eventtype, and file names)Device host namePassive DNS logsinterpretation of threat detections, general productusage and integration with other Cisco and third-partyproducts. Global threat intelligence research1Initial Data Packet (“IDP”). IDP mayinclude: any data sent in the first packetof the communication. This may besensitive for unencrypted protocols.Notable examples include DNS traffic,plain text HTTP URL, cookies, username,password, IP header, TLS header, ServiceName Identifier, Cipher suitesData is collected for: Security analytics, forensics, efficacy research, generalproduct functionality and usage. Cisco global threat intelligence research. If SPAD Report access allowed, data collected toimprove customer experience, advise on appropriateconfiguration and deployment, assist withinterpretation of threat detections, general productusage and integration with other Cisco and third-partyproducts. Identity of device used to uploadtelemetry data (ex: serial numberor a name created by thecustomer)Name of end user that accessedthe logs.Data is collected for: Forensics, efficacy research, general productfunctionality, usage, and product improvementpurposes. If SPAD Report access allowed, data collected toimprove customer experience, advise on appropriateconfiguration and deployment, assist withinterpretation of threat detections, general productusage and integration with other Cisco and third-partyproducts.Any Personal Data that may becontained in a File submitted byCustomer.Data is collected for : Security analytics, forensics, efficacy research, generalproduct functionality and usage. Files*addition to external traffictelemetry)Customer TrustSec Security GroupTag ID and Name. 3. Cross-Border TransfersCognitive Intelligence currently leverages third-party data centers located in Ireland and the United Kingdom for productionpurposes. For customers who purchased the legacy version of Cognitive Intelligence (known as Cognitive Threat Analytics), priorto the second calendar quarter of 2019, the customer’s account information will be created, processed and stored in both theIreland and UK data centers. If the customer provisions Cognitive Intelligence via its AMP for Endpoints instance, then its accountinformation is pulled from AMP for Endpoints and replicated in data centers located in Ireland and the United Kingdom. EventData and Source Telemetry (as defined and discussed in Section 5 below) may be viewed by the Cisco Cognitive Intelligence officein the Czech Republic, United Kingdom, Canada and the United States for research and product integration purposes. If CognitiveIntelligence is integrated with AMP for Endpoints, Event Data from Cognitive Intelligence will be sent to the regional AMP forEndpoints cloud selected by the customer for further investigation. Please see the AMP for Endpoints Privacy Data Sheet at r/solutions-privacy-data-sheets.html more information on the regional dataclouds for AMP for Endpoints.1 A Stealthwatch Cloud customer that does not want to share this information with Cognitive Intelligence can request that the transfer of such data bedisabled by submitting a request by email to swatchc-support@cisco.com. 2020 Cisco and/or its affiliates. All rights reserved.Version 2.0 June 16, 2020
Cisco PublicPrivacy Data SheetWhere the table in Section 2 above specifies that personal data is processed for the purposes of Cisco global threat intelligenceresearch, processing is conducted by Cognitive Intelligence and by Cisco’s global threat intelligence teams, which have datacenters in the United States only as described in the table in this Section 3 below. Please note this cross-border transfer of suchpersonal data to the Cisco Talos and Threat Intelligence Platform (“TIP”) global threat intelligence research data centers locatedin the United States; the applicable Talos and TIP data centers are included in both the table in this Section 3 below and Section7.The following table shows location of the current third-party data centers for the Cognitive Intelligence and Cisco’s global threatintelligence research teams, and the locations of the Cisco offices with staging and development environments (including efficacyresearch) for Cognitive Intelligence.Third Party Data Centers, Cisco Offices & Platform LocationsEquinix--United Kingdom-Cognitive Intelligence production environment.Equinix—California, Texas, Virginia, U.S.A.Cisco Talos global threat intelligence cloud co-location facilities.Cisco Offices –Czech Republic, United Kingdom, Canada, U.S.A.-Development and efficacy research engineers are located in Cisco offices for development and efficacy researchVazata—Texas, U.S.A. Data Center-Cisco TIP global threat intelligence cloud co-location facility.AWS EU – Ireland-Cognitive Intelligence production environment.Cisco has invested in a number of transfer mechanisms to enable the lawful use of data across jurisdictions. In particular: Binding Corporate RulesEU-US Privacy Shield FrameworkSwiss-US Privacy Shield FrameworkAPEC Cross Border Privacy RulesAPEC Privacy Recognition for ProcessorsEU Standard Contractual Clauses4. Access ControlPersonal Data CategoryWho has accessPurpose of the accessRegistration InformationCustomersSecurity administration and operationsCisco Employees – Cisco SalesAdministration, Licensing Operations,Cognitive Intelligence Operations,Engineering and Efficacy ResearchCreating an account and validating license entitlements and generalproduct operationsCustomersSecurity administration and operationsCustomer Web Log Telemetry 2020 Cisco and/or its affiliates. All rights reserved.Version 2.0 June 16, 2020
Cisco PublicPrivacy Data SheetCisco Cognitive IntelligenceOperations, Engineering, and EfficacyResearch Teams, and Cisco Talos andTIP Global Threat IntelligenceResearch TeamsCustomer NetFlow Telemetry*If SPAD Report access granted:Cisco Customer Success Team,System Engineers, Customer SalesAccount ManagersCustomersCisco Cognitive IntelligenceOperations, Engineering, and EfficacyResearch Teams, and Cisco Talos andTIP Global Threat IntelligenceResearch TeamsFirewall Event Data and Logs*If SPAD Report access granted:Cisco Customer Success Team,System Engineers, Customer SalesAccount ManagersCustomersCisco Cognitive IntelligenceOperations, Engineering, and EfficacyResearch Teams, and Cisco Talos andTIP Global Threat IntelligenceResearch TeamsProviding security analytics, forensics, efficacy research, generalproduct functionality and usage, global threat intelligence research.*If SPAD Report access allowed, Cisco may improve customerexperience, advise on appropriate configuration and deployment,assist with interpretation of threat detections, general productusage and integration with other Cisco and third-party products.Security administration and operationsProviding security analytics, forensics, efficacy research, generalproduct functionality and usage, global threat intelligence research.*If SPAD Report access allowed, Cisco may improve customerexperience, advise on appropriate configuration and deployment,assist with interpretation of threat detections, general productusage and integration with other Cisco and third-party products.Security administration and operationsGlobal threat intelligence research*If SPAD Report access granted:Cisco Customer Success Team,System Engineers, Customer SalesAccount ManagersCustomer Enhanced NetflowTelemetry for Encrypted TrafficAnalytics (ETA)CustomersSecurity administration and operationsCisco Cognitive IntelligenceOperations, Engineering, and EfficacyResearch Teams, and Cisco Talos andTIP Global Threat IntelligenceResearch TeamsProviding security analytics, forensics, efficacy research, generalproduct functionality and usage, global threat intelligence research.*If SPAD Report access granted:Cisco Customer Success Team,System Engineers, Customer SalesAccount ManagersCustomer Web and API Usage LogCisco Cognitive IntelligenceOperations, Engineering and EfficacyResearch Teams*If SPAD Report access granted:Cisco Customer Success Team,System Engineers, Customer SalesAccount ManagersFilesCisco Cognitive IntelligenceOperations, Engineering and EfficacyResearch Teams*If SPAD Report access allowed, Cisco may improve customerexperience, advise on appropriate configuration and deployment,assist with interpretation of threat detections, general productusage and integration with other Cisco and third-party products.Providing security analytics, forensics, efficacy research, generalproduct functionality and usage.*If SPAD Report access allowed, Cisco may improve customerexperience, advise on appropriate configuration and deployment,assist with interpretation of threat detections, general productusage and integration with other Cisco and third-party products.Providing security analytics, forensics, efficacy research, generalproduct functionality and usage.*If customer provides express written consent to Cisco, then Cisco employees designated by the asterisk (*) above will haveaccess to the Personal Data contained in customer’s SPAD Report created within the Cognitive Intelligence portal. 2020 Cisco and/or its affiliates. All rights reserved.Version 2.0 June 16, 2020
Cisco PublicPrivacy Data Sheet5. Data Deletion & RetentionPersonal Data CategoryRetention PeriodReason for RetentionRegistration Information Indefinitely Event Data (includes Web LogTelemetry, NetFlow Telemetryand as applicable, EnhancedNetFlow Telemetry) 90 daysIndefinitelySource Telemetry (includesWeb Log Telemetry, NetFlowTelemetry and as applicable,Enhanced NetFlow Telemetry) 90 daysIndefinitelyFirewall Event Data and Logs 90 daysIndefinitelyCustomer Web and API UsageLogsFilesSPAD Reports 3 years 24 months90 daysSecurity administration and operationsGeneral product operations90 days: Security administration and operations Providing security analytics, forensics, general product functionality andusage,Indefinitely: Mining, efficacy and global threat intelligence research90 days: Security administration and operations Providing security analytics, forensics, general product functionality andusage, global threat intelligence researchIndefinitely Mining, efficacy and global threat intelligence research90 days: Security administration and operations Providing security analytics, forensics, general product functionality andusage, global threat intelligence researchIndefinitely: Mining, efficacy and global threat intelligence research Providing security analytics, forensics, efficacy research, general productfunctionality and usage Mining, efficacy and global threat intelligence research Improve customer experience, advise on appropriate configuration anddeployment, assist with interpretation of threat detections, generalproduct usage and integration with other Cisco and third-party productsRegistration InformationRegistration Information data is currently retained indefinitely in the UK data center. When a customer terminates its CognitiveIntelligence subscription, it can specifically request that its Registration Information be purged from Cisco’s data stores andbackups by opening a Cisco TAC case.Event DataA ninety (90) day time-based “First-In-First-Out” data store is used to capture and store Event Data for presentation of customerspecific threat events in the Cognitive Intelligence portal. This prescribed retention period is defined in accordance to a look-backwindow for which threat events and forensic information is available to the customer within the Cognitive Intelligence portal. Alarge portion of event data collected are behaviors, statistics and metadata extracted from the source telemetry. Event Data maybe kept for mining, efficacy research, and global threat intelligence research purposes. When a customer terminates its CognitiveIntelligence subscription, it can specifically request that its data be purged from Cisco’s data stores and backups by opening aCisco TAC case.Source TelemetrySource Telemetry will be deleted after ninety (90) days of processing. However, for any source telemetry directly associated withsuspected or confirmed infections, such Source Telemetry may be retained indefinitely for data mining, efficacy research andglobal threat intelligence purposes.Customer Web and API Usage LogsCustomer Web and API Usage Logs will be retained for three (3) years and will be deleted upon the expiration of such three (3)year period.FilesFiles may be retained for us to twenty-four (24) months for data mining, efficacy and global threat intelligence research purposes.SPAD Reports 2020 Cisco and/or its affiliates. All rights reserved.Version 2.0 June 16, 2020
Cisco PublicPrivacy Data SheetSPAD Reports are retained for ninety (90) days from the date of the generation of the applicable Report, and are used to Improvecustomer experience, advise on appropriate configuration and deployment, assist with interpretation of threat detections,general product usage and integration with other Cisco and third-party products. SPAD Reports are automatically deleted afterthe expiration of the ninety (90) day period.6. Personal Data SecurityPersonal CategoryType of EncryptionRegistration InformationCustomer Web Log TelemetryCognitive Intelligence cloud: Encrypted in transit via TLS/SSL, and at rest.Cognitive Intelligence cloud: Encrypted in transit via TLS/SSL, and at rest.Talos and TIP clouds: Encrypted in transit via TLS/SSL, but not at rest.Customer NetFlow TelemetryCognitive Intelligence cloud: Encrypted in transit via TLS/SSL, and at rest.Talos and TIP clouds: Encrypted in transit via TLS/SSL, but not at rest.Firewall Event Data and LogsCognitive Intelligence cloud: Encrypted in transit via TLS/SSL, and at rest.Talos and TIP clouds: Encrypted in transit via TLS/SSL, but not at rest.Customer Enhanced NetFlow TelemetryCognitive Intelligence cloud: Encrypted in transit via TLS/SSL, and at rest.Talos and TIP clouds: Encrypted in transit via TLS/SSL, but not at rest.Customer Web and API Usage LogFilesSPAD ReportCognitive Intelligence cloud: Encrypted in transit via TLS/SSL, and at rest.Cognitive Intelligence cloud: Encrypted in transit via TLS/SSL, and at rest.Cognitive Intelligence cloud: Encrypted in transit via TLS/SSL, and at rest.7. Third Party Service Providers (Sub-processors)Cisco partners with service providers who contract to provide the same level of data protection and information security that youcan expect from Cisco. A current list of sub-processors for the Cognitive Intelligence service is below:SubprocessorPersonal DataService TypeLocation of Data CenterEquinixNo access to data.*Cisco leverages the Equinix cloudas a co-location facility to helpprovide security assurance,service elasticity and resilienceto Cognitive Intelligence.Cognitive Intelligence Data Center operated byEquinix: London, United KingdomEquinix is also a Cisco approved3rd party colocation facility usedfor Cisco Talos global threatintelligence specs/ld5/For information regarding Equinix London facilitycertifications, please see:Talos Data Center operated by Equinix: UnitedStates (California, Texas, Virginia)--VA facility has NIST 800-53/FISMA, ISO 27001, SOC1 Type II, SOC 2 Type II, PCI DSS and HIPPA.--CA facility (Sunnyvale) has ISO 27001, SOC 1 TypeII, SOC 2 Type II.--TX facility has NIST 800-53/FISMA, ISO 27001, SOC1 Type II, SOC 2 Type II, PCI DSS and HIPPA. 2020 Cisco and/or its affiliates. All ri
Privacy Data Sheet
