Cisco Blogs


Cisco Blog > Security

NSS Labs Report on Cyber Resilience Highlights the Need for a New Approach to Security

A few years ago, a point-product security vendor proudly declared their technology was the silver bullet that stopped ALL security threats from penetrating the corporate network. Many of us in the industry raised our collective eyebrows in surprise at such a bold claim.

While the naive or inexperienced might have believed such an outrageous claim, we all knew there is no such thing as a silver bullet in security and that no matter how cutting edge or sophisticated your security is, attacks will get through and it is onlya matter of time before any organisation is compromised. Read More »

Tags: , , , ,

Cisco 2014 Midyear Security Report: Security Services and Risk Management

More organizations are starting to view cybersecurity as a strategic risk. They have to—it’s becoming unavoidable. Technology and the business are so intertwined. Regulators are issuing more compliance measures that include information security directives. And all the while, adversaries are relentless in their campaigns to compromise defenses to steal information, money, or otherwise create disruption.

Read More »

Tags: , , , ,

Cisco 2014 Midyear Security Report: Focusing on Common Vulnerabilities is Smart Security Strategy

August 14, 2014 at 6:00 am PST

Enterprise security professionals have their hands full these days—monitoring networks for security breaches, managing the implications of “bring your own device” policies, and patching systems to combat “weak links,” or vulnerabilities that could allow online criminals to grant entry.

Regarding this last task, security practitioners may be able to take an approach to addressing vulnerabilities that allows them to more effectively allocate resources toward resolving these challenges. As detailed in the Cisco 2014 Midyear Security Report, urgent critical vulnerabilities—those that merit the time and attention of security executives—make up a very small number of reported vulnerabilities. While all reported vulnerabilities should be patched, it’s wise to focus on those that pose the most danger.

Cisco publishes thousands of multivendor alerts every year, and zero-day vulnerabilities (for which patches are not yet available) tend to win the lion’s share of attention from security practitioners and the media because of their perceived urgency. However, only about two percent of the thousands of reported vulnerabilities were being activity exploited soon after published reports.

Read More »

Tags: , , ,

Putting a Damper on ‘Lateral Movement’ due to Cyber-Intrusion

Analysis of high-profile cyber breaches often reveals how intruders gain their initial footprint in the targeted organizations and bypass perimeter defenses to establish a backdoor for persistent activities. Such stealthy activities may continue until intruders complete their ultimate mission—claiming the “crown jewels” of the victim organization.

“Lateral movement” is a term increasingly used to describe penetration activities by intruders (more information on lateral movement is available in Verizon’s 2014 Data Breach Investigations Report[1]). These activities begin with network reconnaissance, typically leading to compromises, hijacking of user accounts and ultimately privilege escalation to access sensitive data. Organizations may go to great lengths to detecting and stopping the initial breach and final data exfiltration as well as establishing more intelligence at their ingress/egress perimeters. But how can you minimize the damage caused by an intruder’s lateral movement once your network is already compromised?

Read More »

Tags: , , ,

Cisco 2014 Midyear Security Report: Exploit Kit Creators Vying for ‘Market Leader’ Role

Even in the world of cybercrime, when a top “vendor” drops out of the market, competitors will scurry to fill the void with their own products. As reported in the Cisco 2014 Midyear Security Report, when Paunch—the alleged creator and distributor of the Blackhole exploit kit—was arrested in Russia in late 2013, other malware creators wanted to fill the gap.

“Blackhole” and its more expensive brother “Cool” were the most widely used and well-maintained exploit kits. After Paunch’s takedown, we observed that many other exploit kits, including Fiesta and Neutrino, became more active in the market. However, a clear leader has yet to emerge.

While there’s more competition in the exploit kit market, it’s not translating to a greater number of deployed kits, as Cisco research shows. In fact, the total number of active exploit kits has dropped dramatically—by 87 percent—since Paunch’s arrest.

Read More »

Tags: , , ,