Cisco Blogs


Cisco Blog > Security

Extending control and advanced threat protection for web security

Today the web is a favorite vector for threat actors to launch their attacks. According to the Cisco 2014 Midyear Security Report, More than 90 percent of customer networks observed in the first half of 2014 were identified as having traffic going to websites that host malware. More recently, Talos uncovered a massive malvertising network known as Kyle and Stan. Some 31,151 connections were observed to the network’s 6,491 domains.

In an effort to continue offering the most comprehensive protection to our customers, today we are announcing several important new features and expanded threat protection for the Cisco Web Security Appliance (WSA).

Read More »

Tags: , , , , , , , , ,

Endpoint Visibility is Key to Combatting Attacks

As an IT security practitioner, you have a lot on your plate. Malware attacks are ever present. Hackers are smarter than ever and have the resources and persistence to compromise your organization. The malware being created today is more sophisticated. And the number and types of devices being used in the workplace are expanding, which is increasing the attack surface for malware delivery. With all of these new endpoints being used in the workplace, it’s no surprise that more than 70% of respondents in the 2014 State of Endpoint Risk study by Ponemon say that endpoint security risk is more difficult than ever to manage. Without visibility into potential malicious activity on the endpoints, how are you expected to effectively defend against an attack launched from an endpoint?

Let’s face it: endpoints are everywhere now. The definition of an endpoint has expanded vastly from its first iteration as a tethered desktop computer. We have Windows and Mac laptops; tablets and smartphones; virtual environments; and now even smart watches. We rely on these devices every day. Furthermore, with the advent of the Internet of Everything (IoE), the number and variety of connected devices are set to explode. Cisco estimates that as many as 50 billion devices will be connected to the network by the end of the decade.[1]

The number of attacks targeting these devices is on the rise. In the same Ponemon study, 68% of respondents reported that their mobile endpoints have been the target of malware in the last 12 months. Examples are plentiful. A user with a personal Android phone that has been infected with malware plugs the phone into the office computer to charge it and the malware infiltrates the corporate network. An employee connects their work laptop to their home wi-fi connection and malware lying dormant seizes the opportunity to launch an attack through the back door. Someone surfing the web visits a legitimate website and clicks on an ad that is actually infected. Third-party applications downloaded from seemingly reputable sites can also introduce security risks.

Attackers understand how to exploit these gaps in protection that a proliferation of endpoints can create and work relentlessly to drive their attacks home. Their attacks are dynamic and multidimensional and require continuous scrutiny. As an IT security practitioner, you can’t protect what you can’t see. You need security solutions on the endpoint that couple continuous visibility and control so that you can not only see what’s happening on all of the endpoints on your extended network, but have the power to stop an outbreak quickly if an attack gets through.

Cisco Advanced Malware Protection (AMP) for Endpoints gives you unmatched visibility and control on endpoints, including PCs, Macs, mobile devices, and virtual environments. AMP is continuously monitoring activity on your endpoints, recording everything that it sees, which gives you the ability to roll back time on would-be attackers. When a file starts behaving badly, AMP is there to catch it, and gives you detailed information on how the malware got there in the first place, where it has gone, what other systems have been affected, and what exactly the malware is doing. With this information on root cause and point-of-entry, the complete ancestry and lifecycle of the file, and detailed analysis on the malware’s activity, you can surgically remediate malware from all of the affected areas on your endpoints and extended network. Whether you’re dealing with endpoints connected to a protected network or roaming on public or personal in-home wi-fi, AMP provides you with continuous and integrated detection, response, and remediation capabilities. Download this whitepaper to learn more about a new model to protect the endpoint.

To learn more about AMP for Endpoints, visit www.cisco.com/go/amp

[1] Cisco Internet of Things: http://www.cisco.com/web/solutions/trends/iot/indepth.html

Tags: , ,

#CiscoChampion Radio S1|Ep 33 Cisco Advanced Malware Protection (AMP)

October 3, 2014 at 9:00 am PST

cisco_champions BADGE_200x200#CiscoChampion Radio is a podcast series by Cisco Champions as technologists. Today we’re talking with Cisco Engineer Eric Howard, about Cisco Advanced Malware Protection (AMP). Lauren Friedman (@Lauren) moderates and Brad Haynes and Bill Carter are this week’s Cisco Champion guest hosts.

Listen to the Podcast.

Learn about the Cisco Champions Program HERE.
See a list of all #CiscoChampion Radio podcasts HERE.

Cisco SME
Eric Howard, @ericlhoward, Cisco Engineer

Cisco Champions
Brad Haynes, @GK_bradhaynes, Pre-Sales Engineer at Global Knowledge
Bill Carter, @ccie5022, Senior Business Communications Analyst Read More »

Tags: ,

Visualizing a String of Paerls

Researchers from the Cisco Talos Security Intelligence and Research Team recently discovered an elaborate attack dubbed the String of Paerls. The attack, a combined spearphishing and exploit attempt, was able to bypass most antivirus engines and used a targeted phishing email that included a malicious Word document attachment. Upon opening the Word attachment, a macro downloaded and launched an executable on the victim’s machine, which then called out to command and control servers.

In the graphic below you can see an illustration of each of the major steps of the attack. A common thread is that Cisco security provides protection against attacks like this one using the approach of integrated threat defense. Specifically, Advanced Malware Protection tools were used throughout the discovery and analysis process to expose the exploit.

paerls-blog-1024x714

For a complete play-by-play of this attack, read the String of Paerls blog post from Talos. For more about integrated threat defense in our products, see the new Cisco ASA with FirePOWER Services.

Tags: , , , , , ,

The Art of Escape

Craig Williams and Jaeson Schultz have contributed to this post.

We blogged in September of 2013 about variants of Havex. A month ago on June 2, 2014, I had the chance to give a presentation at AREA41.  In my presentation “The Art of Escape,” I talked about targeted attacks involving watering holes.

If we look at the timeline of the attacks we see two clear impacting factors:

  • CVE release time
  • Timeframe of new PluginDetect

This explains why we saw an increase in watering hole attacks peaking in August

timeline_havex

Read More »

Tags: , , , , ,