Cisco Blogs


Cisco Blog > Security

The Security Imperative As Mobility Evolves

Editor’s Note: This post is a response to EN Mobility Workspace. Please see that post for full context.

A colleague of mine here at Cisco, Jonathan, recently spoke well to the Evolution of Cisco Mobility Workspace Journey. Like all technologies, there is an adoption and engagement cycle based on maturity and risk level. We begin at the device-focused phase with a simple “get me on the network.” Following is the application-focused phase, “now that I am on what can I do with my ability to move around without a wire and work anytime and anywhere.” And the final is the overall experience, which is tailored to the user based on who they are, where they are, what they need or can do. And one can argue the next mobility phase for organizations is IoT (Internet of Things) as more single purpose devices (not necessarily with a user behind it) move to the wireless network.

What is critical to point out is the consistent requirement (not a nice to have) for security as the mobile user experience expands. Why is this so important? According to IDC over 47 percent of organizations see security enhancements required with their mobility initiative. The questions to consider are:

  • What are the secure mobility issues today and potentially tomorrow?
  • What are the implications?
  • What is likelihood of these threats?

The top secure mobility concerns noted by numerous surveys indicate the following:

  1. Data protection
  2. Application access
  3. Lost and stolen device
  4. Rogue devices

Read More »

Tags: , , , , , , , , , ,

Security Metrics Starting Point: Where to Begin?

Editor’s Note: This is the second part of a four-part series featuring an in-depth overview of Infosec’s (Information Security) Unified Security Metrics Program. In this second installment, we discuss where to begin measuring.

H. James Harrington, noted author of Business Process Improvement, once said “Measurement is the first step that leads to control and eventually to improvement. If you can’t measure something, you can’t understand it. If you can’t understand it, you can’t control it. If you can’t control it, you can’t improve it.” Good piece of wisdom, but where do you start? How do you mine data through the use of metrics in order to provide greater insight into your organization’s security posture, while simultaneously using it as a vehicle to protect your most critical assets?

For Infosec’s Unified Security Metrics (USM) team, there’s plenty of statistical data sources available to mine information from, particularly from IT system logs and dashboards. In fact, early research conducted by the team identified 30 different types of meaningful data to track. Comprehensive, yes, but not realistically feasible, nor sustainable to implement long-term across Cisco. The USM team’s solution centered on the primary outcomes they were trying to achieve, namely, driving security process improvement behaviors and actions within IT. Subsequently, the list was narrowed down to five key measurements:

  • Stack compliance: measures vulnerabilities found on the TCP/IP stack (i.e. network devices, operating systems, application servers, middleware, etc.)
  • Anti-malware compliance: quantifies whether malware protection software has been properly installed and is up-to-date
  • Baseline application vulnerability assessment: computes whether automatic vulnerability system scans have been performed in accordance with Cisco policy and, if post-scan, any open security weaknesses remain
  • Deep application vulnerability assessment: computes whether penetration testing has been performed on our most business-critical applications in accordance with Cisco policy and, if post-testing, any open security weaknesses remain
  • Design exceptions: measures the total number of open security exceptions, based on deviations from established security standards and best practices

Read More »

Tags: , ,

Cisco Security Response Team Opens Its Toolbox

Cisco’s network is a massively complex environment that requires extensive monitoring and remediation. In today’s world of advanced threats and attacks, the company that possesses and positions its tools to preemptively identify and mitigate threats is the one left standing when the dust settles.

Cisco leverages its Computer Security Incident Response Team (CSIRT), a global organization comprised of information security professionals, to monitor, investigate, and respond to cyber security incidents 24×7. The Cisco CSIRT team forms part of the investigative branch of Cisco’s Information Security organization, protecting Cisco from security threats and the loss of its intellectual assets.

With a variety of security tools, CSIRT is able to detect and analyze malicious traffic throughout the network, including virus propagation, targeted attacks, and commonplace exploits. Because CSIRT continually identifies new security threats, the team needs some historical look-back at what occurred on the network. They also need a solution that can dissect the finer details of security incidents while facing the ever-present restrictions with data storage. StealthWatch, a NetFlow monitoring solution from Cisco partner Lancope, contains unique storage, interactivity, and parsing capabilities, to provide a more concise set of data for analysis.

Read More »

Tags: , , ,

A Bundle is Born

Today, we released the first Cisco IOS Software Security Advisory Bundled Publication of 2014. Six years ago, Cisco committed to disclosing IOS vulnerabilities on a predictable schedule (on the fourth Wednesday of March and September each calendar year) in direct response to your feedback. We know this timeline allows your organization to plan ahead and ensure resources are available to analyze, test, and remediate vulnerabilities in your environments.

Today’s edition of the Cisco IOS Software Security Advisory Bundled Publication includes six advisories that affect the following technologies:

  • Session Initiation Protocol
  • Network Address Translation
  • Internet Key Exchange Version 2
  • IPv6
  • SSL VPN
  • Cisco 7600 RSP720 with 10GE Uplinks

Read More »

Tags: , , , ,

February 2014 Threat Metrics

Web surfers in February 2014 experienced a median malware encounter rate of 1:341 requests, compared to a January 2014 median encounter rate of 1:375. This represents a 10% increase in risk of encountering web-delivered malware during the second month of the year. February 8, 9, and 16 were the highest risk days overall, at 1:244, 1:261, and 1:269, respectively. Interestingly, though perhaps not unexpectedly, web surfers were 77% more likely to encounter Facebook scams on the weekend compared to weekdays. 18% of all web malware encounters in February 2014 were for Facebook related scams.

Feb2014Rate

Read More »

Tags: , , , ,