Black holes, from a network security perspective, are placed in the network where traffic is forwarded and dropped. When an attack has been detected, black-holing can be used to drop all attack traffic at the edge of an Internet service provider (ISP) network, based on either destination or source IP addresses. Remotely triggered black hole (RTBH) filtering is a technique that uses routing protocol updates to manipulate route tables at the network edge or anywhere else in the network to specifically drop undesirable traffic before it enters the service provider network.
One of the most enjoyable parts of my job as a product manager is launching a new product. Typically this is a shiny new widget or a great piece of software. But for a cloud-based service like Cisco’s ScanSafe Web Security solution, the infrastructure is a big part of the product.
For those not familiar with the product, ScanSafe offers web security solutions to organizations ranging from global enterprises to small businesses. The service provides multiple layers of malware protection and acceptable use controls to block users from specific websites and categories. It does this by redirecting end-user web traffic directly to the cloud where every web request is analyzed using artificial intelligence-based “scanlets” to determine the associated security risk. With such heavy processing and computation, the nature of the cloud is as important as the service in the cloud.
That is why today, I am pleased to welcome Canada to ScanSafe’s cloud with the addition of two datacenters—the first in Vancouver and the second in Toronto. Canada has been an early adopter of SaaS-based technologies, and our newest datacenters will help us serve our customers in the region. In addition, companies with branch offices in these locations will now benefit from a local internet breakout.
Either someone is doing some serious academic work in researching password strengths, or someone is building a really great hashed password dictionary. The Steam community forum compromise, in which attackers gained access to a database containing usernames, encrypted passwords, and e-mail addresses, is just the latest in a series of compromises targeting a subset of the online community: gamers.
It’s difficult to say whether these attacks are increasing in frequency or whether media reporting and voluntary disclosure has created the illusion of a growing trend. In either case, our activities are continually moving online, often protected only by a username and password, instead of staying safe and warm in hard disks on our home desktop computers. The attack surface is increasing as more web services require more usernames and passwords and the opportunity for password reuse increases.
Read More »
Nearly all of us depend on public key infrastructure (PKI) when we engage in secure transactions on the Internet. Digital certificates, most commonly based on ITU standard X.509, are used to prove that one is communicating with an intended website or Internet host. They are also used to establish the ownership of specific email addresses when S/MIME signing and encryption are used. Having a secure way to determine who you’re communicating with is important because an impostor or “man in the middle” site could decrypt the data sent to it, effectively defeating the security of the transaction.
Certificates issued by Certificate Authorities (CAs) digitally sign a public key presented by the subject (website/host or user) after some diligence (usually for a fee) is done to determine that the entity requesting the signature is in fact the legitimate owner of that host or address. The public keys of the Certificate Authorities are, in turn, configured into Web browsers, email clients, and other software that makes sure connections. If the host being communicated with proves ownership of a certificate that is signed by a recognized CA, the certificate is recognized as valid.
Security and process problems at several X.509 CAs, most notably DigiNotar and Comodo, have received considerable coverage in the past year. This has led to doubts about the long-term viability of the X.509 ecosystem, and alternatives have been proposed. I’d like to step back from that a little bit and look at the properties we would like to have in an idealized replacement system and then how that might be accomplished.
Read More »
What a week! From October 31-November 3, Cisco hosted its annual internal security event—SecCon 2011. Co-hosted by Greg Akers, SVP of Cisco’s Global Government Solutions Group and Ed Paradise, Vice President of Engineering, this marked the fourth year in which we shared the latest in product security practices, policies, processes, and thought leadership with employees who participated in live and virtual sessions around the world.