Cisco Blogs


Cisco Blog > Security

Big Data: Observing a Phishing Attack Over Years

google_drive_attack

Overview

Phishing attacks use social engineering in an attempt to lure victims to fake websites. The websites could allow the attacker to retrieve sensitive or private information such as usernames, passwords, and credit card details. Attacks of this kind have been around since 1995, evolving in sophistication in order to increase their success rate. Up until now, phishing attacks were generally viewed as isolated events that were dealt with on a case-by-case basis. The dawn of big data analysis in computer security allows us to store data indefinitely and watch the changes and growth of attacks over long periods of time. In 2012, we began tracking a sophisticated phishing campaign that is still going strong.

 

The Target

Google, one of the largest players in the cloud business, offers dozens of free cloud services: Google Email, Google Drive, Google Docs, Google Analytics, YouTube, etc. To enable easy access across all of these properties, Google built what they call, “One account. All of Google.”   Read More »

Tags: , , , , , , , , ,

Securing Employee Device Freedom

As a business or technical leader, you know you need to protect your company in a rapidly evolving mobile ecosystem.

However, threats are not always obvious. As malware and attacks become more sophisticated over time, business decision makers must work with technical decision makers to navigate security threats in a mobile world.

I’m excited to introduce a new blog series, authored by Kathy Trahan, which will explore the topic of enterprise mobility security from a situational level and provide insight into what leaders can do now to mitigate risk.

This first post will discuss the security concerns presented by the rapid-fire growth of BYOD (Bring Your Own Device) and how implementing specific policies can help organizations reap the benefits of true mobility now and in the future.

Kathy Trahan Senior Security Solutions Marketing Manager Global Marketing Corporate Communications

Kathy Trahan
Senior Security Solutions Marketing Manager

With the increasing amount of tablets, wearables, and other connected “things” in the workplace, it’s no wonder that the BYOD trend is causing a dynamic shift in security policies and protocol.

This heightened focus on security only increases when the security threat evolution shows that attackers seem to stay one step ahead of the security measures in place to stop them. And while the BYOD movement does present special challenges to ensuring data security, it also affords BDMs and TDMs an opportunity to collaborate and come up with security solutions that balance the need to secure company assets while still allowing employees to conduct business on devices that are familiar and comfortable to them.

As enterprises look for ways to improve productivity, efficiency, and flexibility for their workforces, mobility has become a key factor. A Gartner survey predicts that by 2017, half of employers will require their employees to provide their own devices for work purposes. And as use of and reliance on mobility increase, so does the need for security policies that allow employees to function in a work world that extends beyond their cubicle and office walls.

Read More »

Tags: , , , , , ,

A New Model to Protect the Endpoint, Part 3: Automated Advanced Analytics

In my final post in this series, I wanted to focus on another powerful innovation made possible by combining a big data architecture and a continuous approach for more effective protection: automated, advanced analytics.

Today’s advanced malware compromises environments from an array of attack vectors, takes endless form factors, launches attacks over time, and can obfuscate the exfiltration of data. To detect advanced attacks as they move laterally through the network and across endpoints, defenders need technologies that automatically look for Indicators of Compromise (IoCs) left behind by malware and exploits, as well as more advanced behaviors of compromise that happen over time. Read More »

Tags: , , ,

Threat Spotlight: “A String of Paerls”, Part 2, Deep Dive

July 8, 2014 at 7:28 am PST

This post has been coauthored by Joel EslerCraig WilliamsRichard HarmanJaeson Schultz, and Douglas Goddard 

In part one of our two part blog series on the “String of Paerls” threat, we showed an attack involving a spearphish message containing an attached malicious Word doc. We also described our methodology in grouping similar samples based on Indicators of Compromise: static and dynamic analysis indicators. In this second part of the blog series we will cover the malicious documents and malicious executables. For the technical deep dive see the write up on the VRT blog here.

 

Tags: , , , , ,

The Expanding Burden of Security

July 8, 2014 at 6:00 am PST

[ed. Note: This post was updated 7/9/2014 to include new information not available to the author at the time of original publishing]

I just returned from the Gartner Security Summit at the Gaylord Resort in National Harbor Maryland. Each morning I took my run along the Potomac River and passed this sculpture of a man buried in the sand.

KT_sandman

In speaking with many IT executives they expressed specific concerns around their IT security, and this sculpture of the “man in the sand” took on new meaning for me. I could see how they might similarly feel overwhelmed and buried given their limited resources and the abundance of threats to their environments. Yes, I’ve been in this industry too long! Anyway, throughout all of my conversations it was abundantly clear that people were looking for a new way to approach securing their networks and applications. Customers are recognizing that unsecured access to the network is a critical threat vector; however, when leveraged properly, the network itself also provides a significant platform that offers comprehensive protection to close those gaps. So, what do I mean by that?

The network uniformly sees and participates in everything across the threat continuum, whether before, during or after an attack. If we can leverage the insights and inherent control the network provides, IT organizations can truly augment their overall end-to-end security across this continuum. If done correctly, this augmentation can happen without investing a large amount of time, energy, and resources in filling all the gaps to secure their environments -- regardless of legacy network, endpoint, mobile, virtual, or cloud usage models

Cisco strongly believes that the network must work intimately with various security technologies in a continuous fashion to offer protection for networks, endpoints, virtual, data centers and mobile.

The New Security Model

Given Cisco’s breadth and depth of security, we did not have room to exhibit our networking devices. However, within much of our networking (and even security) offerings, we have embedded security capabilities that provide more comprehensive protection across the entire threat continuum.

An example of this is Cisco TrustSec embedded network access enforcement, which provides network segmentation based on highly differentiated access policies. Cisco TrustSec works with Cisco ISE to provide consistent secure access that is mapped to IT business goals. Cisco ISE and TrustSec are part of the Cisco Unified Access solution and leverage a superior level of context and simplified policy management across the entire infrastructure in order to ensure that the right users and devices gain the right access to the right resources at any given time.

Cisco’s integrated approach to security reduces complexity, while providing unmatched visibility, continuous control and advanced threat protection, which, in turn, allows customers to prioritize more efficiently and act more quickly - before, during, and after an attack. Through Cisco’s New Security Model, we help you achieve a more pleasant experience and get you dug out of the sand. To learn more and go beyond just a shovel and pail, go to Cisco’s Security Page.

Tags: , , , , , , , ,