Cisco Blogs


Cisco Blog > Security

Cyber Threat Management from the Boardroom Risk: Lost in Translation

I was at the Gartner Security and Risk Management Summit at the Gaylord National Harbor and had the opportunity to attend the session, “Finding the Sweet Spot to Balance Cyber Risk,which Tammie Leith was facilitating.

Tammie Gartner Session

During the session, the panel had been discussing how the senior leadership teams address the problem of putting their signatures against the risk that cyber threats pose to their organizations. Tammie Leith made a point to the effect that it is just as important for our teams to tell us why we should not accept or acknowledge those risks so that we can increase investments to mitigate those risks.

What caught my attention was that the senior management teams are beginning to question the technical teams on whether or not appropriate steps have been taken to minimize the risks to the corporation. The CxO (senior leadership team that has to put their signature on the risk disclosure documents) teams are no longer comfortable with blindly assuming the increasing risks to the business from cyber threats.

To make matters worse, the CxO teams and the IT security teams generally speak different languages in that they are both using terms with meanings relevant to their specific roles in the company. In the past, this has not been a problem because both teams were performing very critical and very different functions for the business. The CxO team is focused on revenue, expenses, margins, profits, shareholder value, and other critical business metrics to drive for success. The IT security teams, on the other hand, are worried about breaches, data loss prevention, indications of compromise, denial of services attacks and more in order to keep the cyber attackers out of the corporate network. The challenge is that both teams use the common term of risk, but in different ways. Today’s threat environment has forced the risk environment to blend. Sophisticated targeted attacks and advanced polymorphic malware affect a business’s bottom line. Theft of critical information, such as credit card numbers, health insurance records, and social security numbers, result in revenue losses, bad reputation, regulatory fines, and lawsuits. Because these teams have not typically communicated very well in the past, how can we ensure that they have a converged meaning for risk when they are speaking different “languages”?

Read More »

Tags: , , ,

Cupcakes and Cyber Espionage

Espionage2This blog will suggest a change of strategy in how we address the threat of cyber espionage. One which leverages traditional tactics of counter-intelligence and uses a new approach different than the Lockheed Martin Cyber Kill Chain approach to security, which seeks to disrupt the chain of attack as quickly as possible. Rather than simply cut off an attack, a method of intelligence gathering before stopping the event is proposed, without leaking sensitive information. Often these same approaches can discover yet unknown activities.

Read More »

Tags: , , , , , ,

Cybersecurity: Where are the Biggest Threats?

Cyber Crime: Identifying the Sources of an Everyday Threat

Cyber crimes, cyber thievery, and cyber warfare have become an everyday reality. In fact, security breaches are so prevalent that, according to a new study from the National Cyber Security Alliance and a private sector firm, 26 percent of Americans have been the victims of a data breach in the past 12 months alone. Not only do breaches reduce citizens’ trust in government to protect their confidential data, they also cost government agencies a significant amount of money. For most CIOs and other government keepers of data, these statistics prompt one immediate question – “Can this happen to us?” Unfortunately, the answer to this question is: yes, it can. Read More »

Tags: , , , , , , , ,

Missing the Mark on Cloud-based Intelligence

This week, Juniper Networks announced a new cloud-based threat intelligence service focused on fingerprinting attackers’ individual devices. We’d like to officially welcome Juniper to the cloud-based security intelligence market—a space where Cisco has a proven track record of leadership through Security Intelligence Operations (SIO). Imitation is indeed the sincerest form of flattery, but in Juniper’s case, they entered the market years late and with limited visibility.

Let’s take a closer look at Juniper’s latest offering.

To start, here is what we know for certain: cyber threats take advantage of multiple attack vectors, striking quickly or lurking for days, months and even years inside your network. Not only this, but the Cisco 2013 Annual Security Report showcases how the web is an equal opportunity infector, with cyber threats crossing national, geographic and organizational boundaries as quickly and easily as users can click on a link. Security solutions must understand the attacks and infrastructure they are launched from, with tracking individual hackers doing far less for your defenses than blocking malicious activity being actively distributed over the network.

The Problem of Visibility

When a detective walks onto a crime scene, they don’t just focus on one thing. The only way to understand an event is to look at the entire scene: interview witnesses, check the neighborhood and look into the history of everyone involved; in other words, context—or the “who, what, where and how” information using every available piece of data.

Just as a skilled investigator builds a holistic picture, security solutions are only as reliable as the intelligence they receive, with Juniper’s being limited by the number of “honeypots” across their customer base. In network security, focusing on a single piece of information, a single attack vector, or one delivery mechanism misses the global visibility and context needed to stop advanced attacks. Cisco SIO powers our security solutions, receiving over 100 terabytes of network intelligence across 1.6 million deployed web, email, firewall and IPS devices. We correlate this data from physical, virtual and cloud-based solutions with a world-class threat research team, augmenting all of this with an ecosystem of third-party contributors. Fingerprinting is one small tool you should deploy in your arsenal, even though it has limited utility and perhaps even limited accuracy.

Read More »

Tags: , , , , , , , , , , ,

Perspectives on MobileCon 2012

I attended MobileCon 2012, the newly branded CTIA enterprise and application event, earlier this month. I noticed the common theme this year was MDM-BYOD-Cybersecurity. Given the recent McKinsey report that indicated 77 percent of CIOs today state that they will allow some form of consumerization in the coming few years, IT professionals are challenged to increase flexibility without compromising security

Throughout the event, I heard many BYOD case studies with a huge interest/following in data and metrics. On this theme, I thought our own Cisco BYOD case study that we have been sharing with our customers would be of interest to this community.

Note, I will provide updated numbers soon as my peers continue to seek out the latest and greatest mobile devices here in the center of Silicon Valley.

For Cybersecurity, I’d like to follow up on John Stewart’s thoughts from yesterday. October is National Cybersecurity Awareness Month, and the joint-task theme between public and private industries resonated across the show. On this note, Cisco is one of the contributors in CTIA’s recently released Cybersecurity Whitepaper.

In my next few blogs, I want to share interesting facts I’m calling, “Did U Know Data for Mobile Security.” The first fact comes from Osterman Research, Inc. for Azaleos.

“The leading factor (34%) cited for deploying an MDM solution was the potential for loss of intellectual property.”

Tags: , , , , , , , ,