Cisco Blogs


Cisco Blog > Security

Securing that Holiday Shopping List with Cloud Web Security

With holiday shopping in full swing many of us are scrambling to buy that must-have toy, hot new gadget, or latest fashion trend. But shoppers aren’t the only ones striving to deliver just the right thing. There’s an entire supply chain working in lock-step to make sure the shelves are stocked with what you want, when you want it. A critical component of that supply chain is transportation management.

Transportation management company leader Transplace understands the challenges and is focused on putting systems in place that their customers can rely on to keep their goods safe and secure as they get to where they need to be when expected. Transplace also provides more than transportation management to its clients, offering intermodal, brokerage, international logistics services and software-as-a-service (SaaS) solutions. With all these great offerings, Transplace wants its customers to have complete peace of mind when it comes to their goods and the security of the goods and the systems they rely on.

Read More »

Tags: , , ,

Microsoft Patch Tuesday – December 2015

Today, Microsoft has released their monthly set of security bulletins designed to address security vulnerabilities within their products. This month’s release sees a total of 12 bulletins released which address 71 vulnerabilities. Eight bulletins are rated “Critical” this month and address vulnerabilities in Graphics Component, Edge, Internet Explorer, Office, Silverlight, Uniscribe, and VBScript. The other four bulletins are rated “Important” and address vulnerabilities in Kernel Mode Drivers, Media Center, Windows, and Windows PGM.

Bulletins Rated Critical

MS15-124, MS15-125, MS15-126, MS15-127, MS15-128, MS15-129, MS15-130, and MS15-131 are rated as Critical.

MS15-124 and MS15-125 are this month’s Edge and Internet Explorer security bulletin respectively. In total, 34 vulnerabilities were addressed this month between the two browsers with 11 vulnerabilities affecting both Edge and IE. The vast majority of the vulnerabilities addressed this month are memory corruption vulnerabilities along with a couple ASLR and XSS filter bypasses. One special note with this bulletin is that CVE-2015-6135 and CVE-2015-6136 are VBScript engine flaws that affect all supported versions of Internet Explorer. However, this bulletin only addresses these vulnerabilities for IE 8 through 11. Users and organizations who use IE 7, or that do not have IE installed will need to install MS15-126 to address these two vulnerabilities.

Read More >>

Tags: , , ,

For Value Chain Security Collaboration, Use a Carrot With Your Stick

The Digital Economy is transforming the way that organizations operate. Deploying a secure, trustworthy infrastructure is no longer enough. Security must be designed into all facets of an enterprise’s network and its third party ecosystem. At the same time, enterprises of all sizes must shrink the attack surface. And, foster an open, security-aware culture, internally and throughout their value chain.

Given Cisco’s commitment to being trustworthy, transparent and accountable, I have been thinking quite a bit lately about the importance of collaboration.

Partnering for improved security

Ensuring that your value chain embraces security wholeheartedly requires a commitment to collaboration. Embracing that commitment can enhance and accelerate security innovation. A true partnership that focuses on security can also create opportunities for previously unexplored operational excellence. Read More »

Tags: , ,

Holiday Shopping Threat Avoidance

The holidays are upon us and the shopping season is kicking into high gear. This year, an estimated 270 million consumers will shop online and, for the first time, more than half of them will use mobile devices to check off their holiday shopping lists.

With consumers searching for holiday discounts through display ads, social media and email, Cisco Talos Security Intelligence and Research Group predict that both malvertising and email spam will be significant vectors for cyber crime this season — especially for mobile shoppers. This is worrisome for the simple reason that most mobile devices do not posses the ability to block many of these threats, leading to increased vulnerabilities as attackers seek profit gain during the busiest time for online commerce.

Through their research, Talos found that Android users are particularly vulnerable. Of the all Apple and Android OS blocks observed on the Cisco’s Cloud Web Security (CWS) platform, the Talos team found that nearly 95% were Android-related. At the heart of the problem, many users are running significantly older versions of the Android OS, which lack the security updates for today’s most persistent threats. This holiday season, we advise that our mobile shoppers exercise additional caution.

Keep reading for more on our findings and recommendations.

How OpenDNS Predicts Attacks When Hacker Infrastructure Is Cheap and Plenty

On Thursday OpenDNS announced two new data science models that detect clues to an attack, and then find the attacker’s entire infrastructure. The first model titled Spike Rank (SPRank) detects spikes in network traffic using mathematical concepts that are often found in sound wave analysis, the same methods music services like Shazam and Pandora use for analyzing song patterns. The spikes SPRank finds, which indicate an attack or use of an exploit kit, then serve as fingerprints or clues for further detective work, often starting by finding a single IP address or domain currently exhibiting suspicious behavior.

odns1

A visual example of network traffic spikes or “sound waves” that SPRank can detect.

Read More »