Cisco Blogs


Cisco Blog > Security

Defending the Data Center

September 12, 2012 at 5:00 am PST

It’s no secret that enterprise data centers are in a state of transformation – they always are. There’s a constant need to scale data center operations to meet the seemingly insatiable demand for connection and throughput speeds, as well as the number of concurrent sessions. In fact, experts anticipate that these performance demands will increase by as much as 30X over the next few years.  While that statistic alone is remarkable enough, that’s just part of the story.  Adding to the dramatic changes is the trend toward virtualization – with over half of all workloads expected to be virtualized by next year; and the fact that employees currently use an average of more than three mobile devices to access enterprise networks.

All of these trends are fundamentally changing data center operations today. And while the obvious impact of these changes is the need for performance scalability to meet the increasing demands, they also inherently change how data centers are secured. It’s this second impact that is often overlooked. While security is certainly important to data center administrators, it isn’t their only concern.  Oftentimes their primary focus is maintaining business-IT alignment and avoiding chokepoints that can degrade performance and jeopardize their SLAs.  As a result, security is frequently put on the backburner while the entire operation continues to upscale – opening the door to the perfect storm for a major security breach.

Unfortunately, most security products are “bolted on” as an afterthought, so they’re not capable of meeting the robust and dynamically changing needs of enterprise data centers. But Cisco handles security very differently than the rest of the industry. By leveraging the SecureX Architecture, Cisco security solutions are built into the network fabric. 70 percent of the world’s Internet traffic and 35 percent of the world’s email traffic flows through Cisco networks, putting Cisco in the best position to see and proactively protect against threats before they affect customers’ networks. Cisco gains intelligence from throughout the network to enable more informed security decisions, and has used that intelligence to integrate security throughout the network infrastructure to provide comprehensive policy enforcement.

To this end, today Cisco made a series of product announcements that help provide modern data centers with what they need to remain secure, while enabling them to meet their business needs:

  • Cisco ASA Software Release 9.0, which is a major release of the core operating system which powers the entire line of ASA security appliances, adding data center-class performance and next-generation firewall capabilities
  • The Cisco ASA 1000V Cloud Firewall, a new multi-tenant edge firewall that uses the same base ASA code that runs the physical ASA appliances, but is optimized for virtual and cloud environments
  • Cisco IPS 4500 Series Sensors, a new series of standalone enterprise-class IPS appliances that provide up to 10 Gbps of IPS throughput in a single blade –four times the performance density of the closest competitor
  • Cisco Security Manager 4.3, which delivers several important capabilities for up to an 80% improvement in operational efficiency, as well as northbound APIs that enable customers to more efficiently deploy comprehensive security solutions

With these new product announcements, in addition to the rest of the SecureX Architecture, Cisco makes security a deployment decision, just like the rest of your network, with consistent security that enables policies to work throughout hybrid environments – physical, virtual, and cloud.  Because we’re part of the network fabric, rather than a bolted-on point product vendor, we deliver security when, where, and how you need it to deliver a flexible, comprehensive security solution. As a result, Cisco can provide high levels of network security, while enabling enterprise data centers to maintain business-IT alignment and avoid chokepoints that can degrade performance and jeopardize SLAs.  And since we enable one layer of security policies to work throughout the hybrid environment, we provide a high level of security while significantly decreasing complexity.

For more information, please visit http://www.cisco.com/go/securedc.

Tags: , , , , , , ,

HIPAA and the Standard of Due Care – How Much Security is Enough?

There’s a natural struggle between those who write rules around compliance to a standard and those who must implement IT systems to ensure compliance with that standard. The former want to create guidelines rather than hard and fast requirements so there’s flexibility in how to achieve compliance. Plus, they want guidelines that allow for advances in technology. The latter want technical specificity – do X and become compliant.

With a compliance standard like PCI DSS, which specifies credit card information security requirements, there’s a great deal of technical specificity about what is required in order to become PCI DSS compliant. In fact, all but a handful of PCI DSS’s 211 sub-requirements call for specific technical actions. But even then, some PCI DSS sub-requirements are subject to interpretation by the various auditing authorities.

Most compliance mandates, especially those imposed by governments, aren’t as cut and dried as PCI DSS and they always include many specific requirements around acceptable compliant behavior in addition to non-specific requirements around technology-oriented compliant safeguards.

The privacy and security of health information in the U.S. is governed by a Federal law called the Health Insurance Portability and Accountability Act (HIPAA). As written, HIPAA is vague in many behavioral and technological areas. The law turned over “rule-writing,” whose aim is to provide more specificity, to the U.S. Department of Health and Human Services (HHS). HHS wrote a key rule – the HIPAA Security Rule – that is relevant to information security professionals.

But alas, even the HIPAA Security Rule is ambiguous! Read More »

Tags: , , , ,

Attend the PCI Community Meeting and be Heard!

The Payment Card Industry (PCI) Security Standards Council (SSC) is an open global forum for the ongoing development, enhancement, storage, dissemination, and implementation of security standards for account data protection. According to the PCI SSC, 2012 is a critical year in the standards development process that hinges on feedback from the PCI community.

Getting the latest information about the PCI Data Security Standard (DSS) is vital as products and technologies continue to change at a rapid pace. Being part of the conversations, networking with like-minded professionals, and interacting directly with payment card brands are just a few of the benefits of attending the sixth annual PCI SSC North American Community Meeting. The meeting runs September 12—14, 2012 at the Walt Disney World Swan and Dolphin Resort in Orlando, Florida.

Read More »

Tags: , , ,

Oracle Java Zero Day Vulnerabilities Risks and Mitigations Part 2

In the previous Part 1 post, I discussed the initial response, risk, and mitigations for the recently-disclosed zero day Oracle Java vulnerabilities that attackers have used in attacks against vulnerable end-user systems. Since then, Oracle has released software updates that correct the original flaw documented in IntelliShield alert 26751, as well as for additional vulnerabilities, as documented in IntelliShield alert 26831.

Attacks leveraging the Java vulnerabilities have increased, with reports indicating that tens of thousands of systems have been compromised. The malicious software toolkit BlackHole, documented in IntelliShield alert 25108, has incorporated the previously-reported Metasploit exploit and can be used to build exploits for use in attacks. Observed exploits have installed the Poison Ivy remote access trojan, and other malicious software may also be downloaded and installed using Poison Ivy, once installed on a vulnerable system.

Read More »

Tags: , , , ,

Targeted Attack, Targeted Response: Designing and Implementing an Incident Response Plan That Works

September 4, 2012 at 7:30 am PST

A few weeks ago I had the pleasure of participating, as a guest speaker, in a webinar titled “Targeted Attack, Targeted Response: Designing and Implementing an IR Plan That Works.” Joe Riggins, Senior Director of Incident Response for HBGary, moderated this Q&A format webinar. We discussed the current incident response (IR) challenges companies are facing, as well as specific steps organizations can take to design, test, and successfully implement an ongoing IR plan for their specific business environment.

The webinar recording can be accessed here.

Read More »

Tags: ,