Cisco Blogs

Cisco Blog > Security

Cross-Site Request Forgery Attacks and Mitigations

Cross-Site Request Forgery (CSRF) attacks: there are already enough articles out there that can explain what a CSRF attack is and provide potential examples. There are also plenty of security alerts that have been released by various vendors whose products are affected by CSRF-related vulnerabilities.

CSRF attacks usually target web applications and attempt to make unwanted changes on server data or extract sensitive information from a web application. Attackers do this by luring an authenticated user into making a specially crafted web request. It’s important, regardless of role, for everyone to have a basic understanding of CSRF attacks and the available options to protect against them.

For more information about basic CSRF concepts and potential mitigations, see our new Applied Mitigation Bulletin Understanding Cross-Site Request Forgery Threat Vectors. Although this document does not attempt to provide all the technical details associated with CSRF, it does aim to summarize the CSRF technique and provide methods that can be potentially used by developers, network administrators and users to protect against CSRF attacks.

For all things related to Security don’t forget to visit the Cisco Security Intelligence Operations (SIO) Portal—the primary outlet for Cisco’s security intelligence and the public home to all of our security-related content. Just go to

Tags: , , , , , ,

Consider the Best Approach for Your BYOD Mobility Environment

MDM Today and the Future

Mobile devices have quickly become a mainstay in enterprise environments and continue to be consumer driven, and yet they find their way into our day-to-day business lives. As these new devices are being brought into the work environment by employees, enterprise IT is increasingly being forced to accommodate for business use. This is not new news. We observe this pattern through our customers today and live this phenomenon within our own everyday work environment at Cisco. Here at Cisco, employees have the flexibility to choose their device and to securely connect to voice, video and data services from anywhere under an Any Device policy. Cisco manages over 64,000 mobile devices today.

Read More »

Tags: , , , , , , , , , , ,

Securing a BYOD Environment Requires Deployment Flexibility

When Cisco integrated our Identity Services Engine (ISE) platform with leading mobile device management (MDM) systems, it was clear from the start that we had struck a chord among IT administrators trying to wrestle with the onslaught of employee-owned mobile devices accessing their networks. First and foremost for IT organizations was gaining visibility to all mobile devices — rogue or authorized — that were present on the wireless network. Cisco ISE delivered that capability, providing IT staff with a detailed view of what types of mobile devices were on the network. Coupling that with ISE’s native BYOD enrollment capabilities or the active management capabilities of MDM platforms — as well as network intelligence from the Cisco Wireless Network — was key to gaining full control over this Wild West of mobile devices

Read More »

Tags: , , , , , , , , , , , , , ,

Security Geeks and Wonks Unite!

Are we heading to a day of reckoning, where the forces of cyber crime overwhelm and erase the good things that information technology delivers? If we head down our current path of incremental, individualized approaches to cyber security, the answer is “Yes.” But I’m enough of an optimist to think that if the IT and security geeks and wonks of the world can unite, share information, work hard, and not worry about who gets the credit, we stand a fighting chance. Read More »

Tags: , , , ,

Apache Darkleech Compromises

Dan Goodin, editor at Ars Technica, has been tracking and compiling info on an elusive series of website compromises that could be impacting tens of thousands of otherwise perfectly legitimate sites. While various researchers have reported various segments of the attacks, until Dan’s article, no one had connected the dots and linked them all together.

Dubbed “Darkleech,” thousands of Web servers across the globe running Apache 2.2.2 and above are infected with an SSHD backdoor that allows remote attackers to upload and configure malicious Apache modules. These modules are then used to turn hosted sites into attack sites, dynamically injecting iframes in real-time, only at the moment of visit.

Because the iframes are dynamically injected only when the pages are accessed, this makes discovery and remediation particularly difficult. Further, the attackers employ a sophisticated array of conditional criteria to avoid detection:

  • Checking IP addresses and blacklisting security researchers, site owners, and the compromised hosting providers;
  • Checking User Agents to target specific operating systems (to date, Windows systems);
  • Blacklisting search engine spiders;
  • Checking cookies to “wait list” recent visitors;
  • Checking referrer URLs to ensure visitor is coming in via valid search engine results. Read More »

Tags: , , , , , ,