<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Cisco Blog &#187; Mike Schiffman</title>
	<atom:link href="http://blogs.cisco.com/author/MikeSchiffman/feed/" rel="self" type="application/rss+xml" />
	<link>http://blogs.cisco.com</link>
	<description></description>
	<lastBuildDate>Sat, 18 May 2013 01:52:55 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	
		<item>
		<title>Coordinated Attacks Against the U.S. Government and Banking Infrastructure</title>
		<link>http://blogs.cisco.com/security/coordinated-attacks-against-the-u-s-government-and-banking-infrastructure/</link>
		<comments>http://blogs.cisco.com/security/coordinated-attacks-against-the-u-s-government-and-banking-infrastructure/#comments</comments>
		<pubDate>Wed, 01 May 2013 19:11:28 +0000</pubDate>
		<dc:creator>Mike Schiffman</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[advisories]]></category>
		<category><![CDATA[ASA]]></category>
		<category><![CDATA[botnet]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[Cisco Security]]></category>
		<category><![CDATA[Cloud Computing]]></category>
		<category><![CDATA[cloud security]]></category>
		<category><![CDATA[data center security]]></category>
		<category><![CDATA[DDoS]]></category>
		<category><![CDATA[exploits]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[incident response]]></category>
		<category><![CDATA[IPS]]></category>
		<category><![CDATA[IPS signatures]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[mitigations]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[targeted attacks]]></category>
		<category><![CDATA[TRAC]]></category>
		<category><![CDATA[vulnerability]]></category>

		<guid isPermaLink="false">http://blogs.cisco.com/?p=111984</guid>
		<description><![CDATA[Prologue On April 10, 2013, a collective of politically motivated  <a href="http://en.wikipedia.org/wiki/Hacktivism">hacktivists</a>  announced a round of planned attacks called  <a href="http://pastebin.com/0HH61ev4">#OPUSA</a> . These attacks, [...]]]></description>
		<wfw:commentRss>http://blogs.cisco.com/security/coordinated-attacks-against-the-u-s-government-and-banking-infrastructure/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Tools of the Trade: The Compressed Pcap Packet Indexing Program</title>
		<link>http://blogs.cisco.com/security/tools-of-the-trade-the-compressed-pcap-packet-indexing-program/</link>
		<comments>http://blogs.cisco.com/security/tools-of-the-trade-the-compressed-pcap-packet-indexing-program/#comments</comments>
		<pubDate>Tue, 30 Apr 2013 17:23:07 +0000</pubDate>
		<dc:creator>Mike Schiffman</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[open source]]></category>
		<category><![CDATA[packet capture]]></category>
		<category><![CDATA[pcap]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blogs.cisco.com/?p=111746</guid>
		<description><![CDATA[The Compressed Pcap Packet Indexing Program (cppip) is a tool to enable extremely fast extraction of packets from a compressed pcap file. This tool is intended for security and network folk who work with large pcap files. This article provides a complete discussion of the tool and is split into two parts.]]></description>
		<wfw:commentRss>http://blogs.cisco.com/security/tools-of-the-trade-the-compressed-pcap-packet-indexing-program/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>CVRF: A Penny For Your Thoughts</title>
		<link>http://blogs.cisco.com/security/cvrf-a-penny-for-your-thoughts/</link>
		<comments>http://blogs.cisco.com/security/cvrf-a-penny-for-your-thoughts/#comments</comments>
		<pubDate>Mon, 22 Apr 2013 14:27:23 +0000</pubDate>
		<dc:creator>Mike Schiffman</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[advisories]]></category>
		<category><![CDATA[Cisco Security]]></category>
		<category><![CDATA[cvrf]]></category>
		<category><![CDATA[cybersecurity]]></category>
		<category><![CDATA[exploits]]></category>
		<category><![CDATA[psirt]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[vulnerability]]></category>

		<guid isPermaLink="false">http://blogs.cisco.com/?p=110766</guid>
		<description><![CDATA[The Common Vulnerability Reporting Framework (CVRF) is a security automation standard intended to make your life easier by offering a [...]]]></description>
		<wfw:commentRss>http://blogs.cisco.com/security/cvrf-a-penny-for-your-thoughts/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Tools of the Trade: cvrfparse</title>
		<link>http://blogs.cisco.com/security/tools-of-the-trade-cvrfparse/</link>
		<comments>http://blogs.cisco.com/security/tools-of-the-trade-cvrfparse/#comments</comments>
		<pubDate>Mon, 18 Mar 2013 15:24:45 +0000</pubDate>
		<dc:creator>Mike Schiffman</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[advisories]]></category>
		<category><![CDATA[cvrf]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blogs.cisco.com/?p=106148</guid>
		<description><![CDATA[In this article, you will be provided a thorough treatise on an in-house developed tool for parsing and validating CVRF documents aptly named "cvrfparse". The article is split into two parts. The first part, intended for CVRF document producers and consumers, is a hands-on manual detailing how to use cvrfparse. The second part, intended for burgeoning Python programmers, explores some of the inner workings of the tool.]]></description>
		<wfw:commentRss>http://blogs.cisco.com/security/tools-of-the-trade-cvrfparse/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Real World DNS Abuse: Finding Common Ground</title>
		<link>http://blogs.cisco.com/security/real-world-dns-abuse-finding-common-ground/</link>
		<comments>http://blogs.cisco.com/security/real-world-dns-abuse-finding-common-ground/#comments</comments>
		<pubDate>Tue, 27 Nov 2012 16:12:34 +0000</pubDate>
		<dc:creator>Mike Schiffman</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[dns]]></category>
		<category><![CDATA[dns attack]]></category>
		<category><![CDATA[dns attack analysis]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blogs.cisco.com/?p=93122</guid>
		<description><![CDATA[The Domain Name System (DNS) is the protocol leveraged within the Internet´s distributed name and address database architecture. Originally implemented to make access to Internet-based resources human-friendly, DNS quickly became critical infrastructure in the intricate behind-the-scenes mechanics of the Internet, second only to routing in its importance. When DNS becomes inaccessible, the functionality of many common Internet-based applications such as e-mail, Web browsing, and e-commerce can be adversely affected—sometimes on a wide scale. This short blog will explore some real-world examples of DNS abuse. I'd like to welcome and thank Andrae Middleton for joining me as a co-author and presenting his expertise on this article.

There are a few different types of DNS attacks: cache poisoning, hijacking attacks, and denial of service (DoS) attacks (which primarily include reflection and amplification). In the news as of late are widespread and focused DoS attacks. Cisco Security Intelligence Operations (SIO), with its distributed sensors, is able observe and measure various aspects of the global DNS infrastructure. What follows are two vignettes detailing recent Internet DNS DoS attacks against the Internet's DNS infrastructure. We will see that, though the attacks are different, the results are similar and the countermeasures and mitigations are the same.]]></description>
		<wfw:commentRss>http://blogs.cisco.com/security/real-world-dns-abuse-finding-common-ground/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>SPAN Packet Duplication: Problem and Solution</title>
		<link>http://blogs.cisco.com/security/span-packet-duplication-problem-and-solution/</link>
		<comments>http://blogs.cisco.com/security/span-packet-duplication-problem-and-solution/#comments</comments>
		<pubDate>Thu, 04 Oct 2012 18:41:58 +0000</pubDate>
		<dc:creator>Mike Schiffman</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[cyber-security-month-2012]]></category>
		<category><![CDATA[data telemetry]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blogs.cisco.com/?p=85863</guid>
		<description><![CDATA[This short blog article will talk about how packet duplication happens, how we prevented it from reoccurring, and a unique solution that was employed to remove the duplicate packets from all of the affected pcap files.]]></description>
		<wfw:commentRss>http://blogs.cisco.com/security/span-packet-duplication-problem-and-solution/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>The Missing Manual: CVRF 1.1 Part 2 of 2</title>
		<link>http://blogs.cisco.com/security/the-missing-manual-cvrf-1-1-part-2-of-2/</link>
		<comments>http://blogs.cisco.com/security/the-missing-manual-cvrf-1-1-part-2-of-2/#comments</comments>
		<pubDate>Fri, 18 May 2012 13:26:39 +0000</pubDate>
		<dc:creator>Mike Schiffman</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[automation]]></category>
		<category><![CDATA[cvrf]]></category>
		<category><![CDATA[intelligent automation]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[security advisories]]></category>

		<guid isPermaLink="false">http://blogs.cisco.com/?p=69585</guid>
		<description><![CDATA[Now it's time for some XML! Let's take what you've learned and manually convert the <a href="http://www.cisco.com/en/US/products/csa/cisco-sa-20110525-rvs4000.html">Cisco RVS4000 and WRVS4400N Web Management Interface Vulnerabilities security advisory</a> into a CVRF document. Please note that this process is meant to be instructive and somewhat of a stream-of-consciousness-narrative of how to manually build your first CVRF document. It is expected that, by and large, this process would itself be automated and CVRF document producers would have in-house code to parse their own documents and emit CVRF.]]></description>
		<wfw:commentRss>http://blogs.cisco.com/security/the-missing-manual-cvrf-1-1-part-2-of-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The Missing Manual: CVRF 1.1 Part 1 of 2</title>
		<link>http://blogs.cisco.com/security/the-missing-manual-cvrf-1-1-part-1-of-2/</link>
		<comments>http://blogs.cisco.com/security/the-missing-manual-cvrf-1-1-part-1-of-2/#comments</comments>
		<pubDate>Wed, 16 May 2012 18:56:43 +0000</pubDate>
		<dc:creator>Mike Schiffman</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[cvrf]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[security automation]]></category>

		<guid isPermaLink="false">http://blogs.cisco.com/?p=69412</guid>
		<description><![CDATA[In this post you will learn about some of the design decisions behind the 1.1 release of the Common Vulnerability Reporting Framework (CVRF). Particular attention is paid to explaining some of the required elements and the Product Tree. After those tasty tidbits, we will convert a recent Cisco security advisory into a well-formed and valid CVRF document. To close, you are treated to some of the items on the docket for future versions of CVRF.]]></description>
		<wfw:commentRss>http://blogs.cisco.com/security/the-missing-manual-cvrf-1-1-part-1-of-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Correlating NetFlow Data for Proactive Security: Network Notoriety</title>
		<link>http://blogs.cisco.com/security/correlating-netflow-data-for-proactive-security-network-notoriety/</link>
		<comments>http://blogs.cisco.com/security/correlating-netflow-data-for-proactive-security-network-notoriety/#comments</comments>
		<pubDate>Wed, 18 Jan 2012 23:49:36 +0000</pubDate>
		<dc:creator>Mike Schiffman</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[netflow]]></category>
		<category><![CDATA[reputation]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blogs.cisco.com/?p=57763</guid>
		<description><![CDATA[Prelude In this short article the reader will first learn what NetFlow is and how it works. Next the reader [...]]]></description>
		<wfw:commentRss>http://blogs.cisco.com/security/correlating-netflow-data-for-proactive-security-network-notoriety/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Network-Based File Carving</title>
		<link>http://blogs.cisco.com/security/network-based-file-carving/</link>
		<comments>http://blogs.cisco.com/security/network-based-file-carving/#comments</comments>
		<pubDate>Tue, 16 Nov 2010 22:05:45 +0000</pubDate>
		<dc:creator>Mike Schiffman</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blogs.cisco.com/?p=13416</guid>
		<description><![CDATA[In this blog post you will first learn what file carving is and, with a simplified example, why it's useful. Next you will learn how this powerful technique has been applied to the network and how its utility has been expanded beyond just forensics. We will talk about several tools in this article, but specific attention will be paid to the NFEX network file carving tool.]]></description>
		<wfw:commentRss>http://blogs.cisco.com/security/network-based-file-carving/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>
