Cisco Blogs


Cisco Blog > Security

NSTIC Strategy Released

Last June, I blogged about a draft of the National Strategy for Trusted Identities in Cyberspace (NSTIC) that had been released for public comment. This past April 15, the finalized NSTIC strategy document was released at an event at the US Chamber of Commerce.

For those of you that aren’t already familiar with the NSTIC, it is a US government-facilitated initiative that seeks to simplify and strengthen user authentication and to provide trustable assertions about principals in online transactions through the creation of an ecosystem that includes identity and attribute providers. More information is available at the NIST NSTIC website, particularly the animation video. NSTIC seeks to improve trust in use in the Internet and to enable new uses that depend on trusted attributes and higher assurance transactions.

Read More »

Tags: , , ,

Incomplete Reporting of Law Enforcement Electronic Surveillance May Skew Risk Assessments

Risk assessments are the underpinning of all effective security programs. It’s quite difficult to best prioritize defensive efforts without a proper valuation of assets to be protected, consideration of threats against those assets, and some means to establish a probable rate at which those threats will result in a particular impact. Because risk assessments describe the priorities of the organization through the perspective of minimizing impact from security events, they must be regularly reviewed to ensure not only that the assets and activities of the organization are current, but also that the current threats are properly accounted for.

Recent research by Christopher Soghoian, a graduate student at Indiana University, Bloomington’s Center for Applied Cybersecurity Research, suggests that underreporting of US law enforcement surveillance could be creating a blind spot in organizational risk assessments. That is, the current legislative reporting requirements exclude certain information and agencies. In the absence of such requirements, it appears that state and local agencies, for example, are responsible for the vast majority of Electronic Communications Privacy Act (ECPA) requests. Unfortunately, the kinds of information excluded from stringent reporting requirements coincides with the current trends in mobile computing and informal electronic communication, namely stored communication (text messages, social networking posts, etc.). At this intersection lies the opportunity for an organization to miss a very real threat to its sensitive communications, as we mentioned in our recent Cyber Risk Report.

Read More »

Tags: ,

Score One for the Good Guys

With each passing day, security reports – including Cisco’s – describe accounts of computers that are used in botnet attacks. Each computer, unwittingly, is infected with malware and controlled by remote unseen hands, foreign or domestic, and with little to no care for the computer’s owner. Simply put, the computer is no longer exclusively under the owner’s control; nor is the data or the privacy of the owner. Unchecked, botnets grow in variety, frequency, complexity, and capability.

Traditionally, dynamic teams, composed of private citizens and law enforcement, devise ways to contain the effects of a botnet and, if possible, shut it down in some way, such as:

  • Releasing signatures to anti-virus vendors in the hopes that AV will clean some of the infected machines
  • Disrupting the Command and Control channel, so that the infected computers are no longer receiving instructions
  • Just attempting to stay one step ahead of the malware through DNS, detection, or blocking access lists

In nearly each circumstance, new approaches are developed to keep the botnet variants from succeeding.

Add another creative approach to the mix based in the rule of law.

Read More »

Tags: ,

Defending Against SQL Injection Attacks Using Cisco ASA, IPS, and IOS Firewall – Cisco TAC Security Podcast

An American with the aid of two Russian conspirators stole 130 million credit card numbers in 2007. In 2009, 32 million usernames and passwords were obtained from a social network game developer. More recently, Lizamoon gained quite a bit of media attention. The same technique that made these attacks successful has even been attempted by printing messages on a car bumper driving down a highway. These attacks all employed a technique called SQL injection. By sending carefully crafted SQL commands into a HTTP web form (or some other database interface), the attacker is hoping that the HTTP form parser isn’t watching for raw SQL commands in the input. The intended effect is that the database will either send back more information than the administrator intended, or drop tables with data altogether.

Read More »

Cisco Investigation for TCP Split-Handshake Issue Reported by NSS

Updated May 9th: After a thorough investigation of the TCP Split Handshake issue raised by NSS Labs, Cisco has confirmed that the Cisco ASA firewall is not susceptible to this issue. In all test cases examined, the ASA operates as expected, providing protection in its default configuration against the Split-Handshake as defined in the original TCP Split Handshake paper. As a result, the Cisco PSIRT closed this investigation on May 4th.

Cisco appreciates the extended engagement and data provided by NSS Labs as we’ve worked through these scenarios. During two recent visits to NSS Labs, Cisco was presented with a number of scenarios, including new test cases that deviated from the original Split-Handshake scenario. The Cisco PSIRT collected traces and provided feedback to NSS Labs on all scenarios. In each case, Cisco demonstrated successful network protection through the default ASA configuration or the implementation of firewall policies that are fully supported, documented and used pervasively in enterprise deployments.

As always vulnerability reports should continue to be reported to the PSIRT organization (psirt@cisco.com). Cisco customers are encouraged to contact their account manager with any questions.


Recently there’s been some activity in the press regarding an NSS Labs report on potential vulnerabilities in Next-Generation Firewalls (NGFW). The Cisco Adaptive Security Appliance (ASA) was one of the products mentioned as vulnerable to these attacks. Based on the investigation of this issue to date, the data indicates that Cisco customers are not exposed to this issue. As always, should the vulnerability be confirmed the Cisco Product Security Incident Response Team (PSIRT) will investigate, drive remediation and disclose per our normal communication channels. (PSIRT Vulnerability Policy)

On April 12th, NSS Labs published a report regarding vulnerabilities on a number of firewalls, including Cisco’s ASA product line. The full report has a hefty $3500 price tag, but NSS does provide a free (with registration) “Remediation Guide,” for users of these firewalls.

The NSS Labs Remediation Guide incorrectly lists the Cisco ASA as vulnerable to the TCP Split Handshake attack, and also mentions that there are no steps available to customers to mitigate or remediate this attack.

Following an investigation over the course of several months, involving well over a dozen Cisco engineers from various teams and working in conjunction with NSS Labs, no vulnerability of this nature has been observed on Cisco products. The following products have been investigated:

  • Cisco ASA
  • Cisco IOS Firewall
  • Cisco Intrusion Protection (IPS) Appliances

It’s important to note that the NSS Labs report focuses only on one attack called the TCP Split Handshake, which is a third means to initiate TCP sessions that combines features of both the three-way handshake and the simultaneous-open connection.

However, the goal of this post isn’t to discuss the technical details of TCP handshakes, but rather to present what Cisco has done and is doing to investigate the impact to our products and protect our customers.

Read More »

Tags: , ,