Cisco Blogs

Cisco Blog > Security

Anomaly vs Vulnerability Detection Using Cisco IPS

The Cisco IPS network based intrusion prevention system (NIPS) uses signatures to detect network-based attacks. Signatures can be created in a variety of engines based on the type of network traffic being inspected. Cisco signatures have very flexible configurations. In this blog post, I will discuss the trade-offs between two basic approaches for signature configuration: anomaly detection and vulnerability detection.

With Cisco IPS, anomaly detection is a broad approach of detecting malicious network activity. Signatures written to detect broad categories of anomalous activity will catch many different attack vectors, but at a cost. The parameters of a signature designed to detect an anomaly will often put a strain on the system running Cisco IPS in the form of memory or CPU usage, limiting the number of signatures that may be enabled. They also carry a high false positive risk due to their broad approach.

Vulnerability based signatures are targeted and require less overhead. These signatures normally target one or more attack vectors associated with a specific CVE. Their engine parameters typically use less memory and impact the CPU performance less on the IPS device, permitting more signatures to be active. They also allow the user to finely tune the configuration based on the types of vulnerable systems in a user’s network. False positive risk is low if the active signature set is tuned for a user’s network environment. Read More »

Tags: , ,

Cognitive Threat Analytics – Transparency in Advanced Threat Research

Cisco Cognitive Threat Analytics is a security analytics product that discovers breaches in Cisco customer’s networks by means of advanced statistical analysis, machine learning and global correlation in Cisco security cloud. Attached to Cloud Web Security (CWS) and Web Security Appliances (WSA), it is also capable of integrating the non-Cisco data sources in order to help the broadest possible set of clients.

Our team discovers tens of thousands of ongoing malware infections (aka breaches) per day. These findings are delivered in a customer-specific report or directly into customer’s SIEM system. The customers can easily identify and re-mediate breaches, get to the root cause and apply policy changes that minimize the risk of further infections in the future. Read More »

Tags: , ,

Security Beyond the Sandbox

A few years ago sandboxing technology really came of age in the security industry. The ability to emulate an environment, detonate a file without risk of infection, and analyze its behavior became quite a handy research tool. Since then, sandboxes have become relatively popular (not nearly on the same scale as anti-virus or firewalls) and can be found in larger organizations. You may even have purchased a sandbox a few years ago, but it’s likely that your malware analysis needs have gone beyond the traditional sandboxing technologies that simply extract suspicious samples, analyze in a local virtual machine, and quarantine.

It’s time to go beyond using sandboxing as a standalone capability in order to get the most out of it. You need a more robust malware analysis tool that fits seamlessly into your infrastructure and can continuously detect even the most advanced threats that are environmentally aware and can evade detection.

There are three typical ways that organizations purchase and deploy sandbox technology.

  1. A stand-alone solution designed to feed itself samples for analysis without dependency on other security products. This has the most flexibility in deployment but adds significant hardware costs and complexity to management and analysis, especially for distributed enterprises.
  2. A distributed feeding sensor approach, such as firewalls, IPS, or UTMs with built-in sandboxing capabilities. These solutions are usually cost effective and easy to deploy but are less effective in detecting a broad range of suspicious files including web files. They can also introduce bandwidth limitations that can hamper network performance and privacy concerns when a cloud-based solution is the only option.
  3. Built into secure content gateways, such as web or email gateways. This approach is also cost effective but focuses on web and email channels only and also introduces performance limitations and privacy concerns.

But there’s a fourth way that actually takes the best of what these approaches offer and raises the bar to help you fight well-funded attackers that get better at what they do every day: Cisco AMP Threat Grid. Through AMP Threat Grid, Cisco offers advanced malware analysis and intelligence that delivers a better ROI, better integration, and more visibility into what is happening in your environment. Don’t take my word for it, though. The Center for Internet Security recently described how they are using it to analyze malware samples from more than 19,000 state, local, tribal, and territorial governments.

AMP Threat Grid is available as an on-premises standalone malware analysis solution and as a cloud-based SaaS solution that provides a REST API to automate sample submissions from a wide range of technologies you have already invested in, including:

  • Firewalls and Unified Threat Management (UTM) devices from the most popular vendors, including, of course, Cisco ASA
  • Gateways for both Email and Web traffic
  • Proxy Servers
  • Security Information and Event Management (SIEM) systems
  • Governance, Risk, and Compliance (GRC) tools
  • And numerous others

Cisco has already integrated AMP Threat Grid’s malware analysis capabilities into AMP for Endpoints. This provides advanced malware analysis as part of AMP’s powerful continuous analysis and retrospective security capabilities. AMP Threat Grid is also integrated into Cisco Email and Web security solutions, providing more eyes in more places. Watch this video to hear how ADP have integrated AMP Threat Grid into their business to become an intelligence-led security organization

Each of these solutions eliminates cost and complexity while offering the ability to analyze a broad range of suspicious objects automatically, including executables, libraries (DLLs), Java, PDF, MS Office documents, XML, Flash, and URLs. Most submissions are analyzed in an average of 7.5 minutes. Not only does AMP Threat Grid analyze a broad range of objects, but it also provides deep analytics capabilities wrapped with robust context. With over 450 behavioral indicators and a malware knowledge base sourced from around the globe, AMP Threat Grid provides more accurate, context rich analytics into malware than ever before.

All samples are given a threat score based on severity and confidence that provides a quick and easy way for junior security analysts to prioritize actions and make better decisions. The threat score is on a 0-100 range, with 100 being known malware and the rest ranging from suspicious to benign because malware is not a yes or no answer.

Perhaps even most importantly, AMP Threat Grid knows its audience; it has no instrumentation within the virtual environment ensuring that even the most sophisticated environment-aware malware is caught. It’s an essential way to rise to the challenge of advanced attackers.

To hear more about how your organization to move beyond the sandbox, watch this webinar featuring experts from Forrester Research, ADP, and Cisco.

Tags: , , ,

Vulnerability Spotlight: Microsoft Windows CDD Font Parsing Kernel Memory Corruption

Discovered by Andrea Allievi and Piotr Bania of Cisco Talos.


Talos, in conjunction with Microsoft’s security advisory issued on September 8th, is disclosing the discovery of a memory corruption vulnerability within the Microsoft Windows CDD Font Parsing Kernel Driver. This vulnerability was initially discovered by the Talos and reported in accordance with responsible disclosure policies to Microsoft. Please see Talos’s Microsoft Tuesday Blog for coverage information for this vulnerability. Read the full Talos Vulnerability Report via the portal here: TALOS-2015-0007


A specially crafted font file can cause the Microsoft Windows CDD Font Parsing Kernel driver to corrupt internal memory structures. The DrvTextOut routine acquires and locks the associated device and behaves differently based on the surface type. If the type is a bitmap and the Windows DWM is on, the driver will read and write directly to the video frame buffer and calls EngTextOut, then exits. However, the driver behaves in an unexpected manner where a new background rect is generated mixing the “OpaqueRect” rectangle located in the sixth parameter and the rectangle located in the “pStringTextObj” object.


If the ClipObject describes a NON-Trivial clip, even the “rclBounds” of the clip object is merged to the background rectangle. The Font Object is parsed, and finally the routine decides if it should clip the background rect or not.


The final decision is based on the following check:


Read More »

Tags: , , ,

Microsoft Patch Tuesday – September 2015

Today, Microsoft has released their monthly set of security bulletins designed to address security vulnerabilities within their products. This month’s release sees a total of 12 bulletins released which address 55 CVEs. Five bulletins are rated “Critical” this month and address vulnerabilities in Edge, Graphics Component, Internet Explorer, Journal, and Office. The other seven bulletins are rated “Important” and address vulnerabilities in the .NET Framework, Active Directory, Exchange, Hyper-V, Media Center, Skype for Business, and Task Management.

Read More »

Tags: , , ,