Cisco Blogs


Cisco Blog > Security

The Gap Between Policy and Implementation

Mark Twain once wrote, “Everybody complains about the weather, but nobody ever does anything about it.” Security policy is a lot like that. Creating a security policy is at the top of the list for anyone looking to really secure their network. But the devil is in the details.

Among the things a security policy needs to cover are:

  • All users
  • All physical and virtual devices
  • All access methods
  • All resource classifications and locations
  • All compliance requirements
  • All of the OSI layers, from the physical layer up the stack to the application layer
  • AND the policy needs to be applied uniformly across the entire distributed enterprise

Read More »

Tags: , , , , ,

Identity Intermediaries and the NSTIC

This is part of an ongoing series on the National Strategy for Trusted Identities in Cyberspace.  The introduction to this series can be found here.

A couple of months ago, I spoke with a security researcher at a conference about the NSTIC.  He questioned the need for an intermediary to manage users’ identity information; he asked why we don’t just do this at the user’s endpoint, eliminating the need for the user to trust an external party.  This is a good place to begin a discussion about the NSTIC architecture.

Read More »

Tags: , ,

It Crawled Out of the Sandbox

Security and functionality have lived on opposite ends of the spectrum since the dawn of time. The door with no lock has always been easier to use than something with multiple chains and dead bolts. Of course, the unlocked door has always been easier to open for those who may want to do bad things.

Read More »

Tags: ,

Introducing the Cisco IOS Software Checker

A new tool called the Cisco IOS Software Checker is now available on the Cisco Security Intelligence Operations (SIO) portal.  This tool introduces a feature that has been long-requested from our customers and will make Cisco product security information much easier to consume and digest.

Security Advisories that are published by the Cisco Product Security Incident Response Team (PSIRT) provide detailed information about security vulnerabilities in Cisco products, including mitigations, affected products and vulnerable and fixed versions of software. Security Advisories affecting Cisco IOS include a table that provides a list of affected Cisco IOS release trains and fixed versions for those trains. Our customers have long asked us for ways to simplify identification of affected software in this table, and so we have developed the Cisco IOS Software Checker for this very purpose. This tool leverages our internal databases to easily provide affected software information without requiring you to manually process the fixed software table.

Read More »

Tags: ,

iPhone Location Tracking: Important, Even if it Doesn’t Matter to You

Apple’s iOS mobile device operating system has recently come under fire in the media for tracking user location, recoverable from device backups of a file called consolidated.db. As we discussed in the Cyber Risk Report, even though Apple has disclosed location tracking via their Privacy Policy, significant commentary online suggests that users are surprised to learn how it is accomplished. The researchers whose efforts have brought this location tracking to wide attention were aware that forensics experts knew about it, but developed their tool to bring this to a wider attention. By all accounts, they have succeeded in raising awareness; what remains is to understand what should be done from here.

Update: Apple responded with a press release on April 27, 2011

Read More »

Tags: , ,