This post is co-authored by Andrew Tsonchev, Jaeson Schultz, Alex Chiu, Seth Hanford, Craig Williams, Steven Poulson, and Joel Esler. Special thanks to co-author Brandon Stultz for the exploit reverse engineering.
Silverlight exploits are the drive-by flavor of the month. Exploit Kit (EK) owners are adding Silverlight to their update releases, and since April 23rd we have observed substantial traffic (often from Malvertising) being driven to Angler instances partially using Silverlight exploits. In fact in this particular Angler campaign, the attack is more specifically targeted at Flash and Silverlight vulnerabilities and though Java is available and an included reference in the original attack landing pages, it’s never triggered.
HTTP requests for a specific Angler Exploit Kit campaign
Angler exploit content types delivered to victims, application/x-gzip (Java) is notably absent
As the product owner, one comment I get most of all is “Wow, I had no idea Cisco had these products“. This is the case even though we ship well over 20 million switch ports delivering hundreds of millions of dollars in revenue per year in this portfolio – to customers in all geographies, markets, verticals, and customer types.
Which products are we talking about? It’s the Cisco SMB portfolio.
Cisco was top performer in the test in Performance, Energy Efficiency, Usability, Capacity/Scale, Feature/functionality, and was the most Economical. For further dialog around this report, see the following link for more details: Competitive dialog on the Miercom test report.
“We were impressed with the comprehensive set of features, performance, overall power efficiency, and ease-of-use of the Cisco switches”
– Rob Smithers, CEO, Miercom (Miercom report: DR120119C)
Over this last year, here’s a small sampling of additional features Cisco has added to the 300 Series portfolio in addition to what has been tested in the Miercom lab (a free software download for customers, I might add):
Web-based Authentication - Provides network admission control through a web browser to any host devices and operating systems
IPv6 First Hop Security – Protection against man-in-the-middle attack, malicious or rogue devices, and IP address theft
Neighbor Binding Integrity
UDLD - detect unidirectional links caused by incorrect wiring or cable/port faults to prevent forwarding loops and black-holing of traffic in switched networks.
Time-based POE - time-based shutdown of ports or POE for operational cost savings
So more features means it costs more, right? Nope. These Cisco switches are actually just as affordable—and in many/most cases, even more affordable — than Competitive switches. See for yourself. Here’s a few examples of comparable products you can look up:
Cisco SG300-28 versus HP 2530-24G (J9776A) -- $513 versus $724
Cisco SG300-52 versus HP 2530-48G (J9775A) -- $910 versus $1,129
Cisco SG300-28PP versus HP 2530-24G-POE+ (J9773A) - $876 versus $1,218
Cisco SG300-52P versus HP 2530-48G-POE+ (J9772A)- $1,232 versus $2,324
But don’t stop there. Have a look at the features and pricing for rest of the Cisco Small Business portfolio. You will see very similar results in other parts of the portfolio as well (For example, compare Cisco SF500 switches against HP 2620 series). By the way, these Cisco switches come with a Limited Lifetime Warranty, which includes next business day (NBD) advanced replacement as part of the product – no need to purchase a separate Service contract to get this. We can only do this since we truly stand behind these products.
“Cisco has raised the bar for this product category”
Krones boosts production efficiency in data center and executes safe migration from RISC platforms for mission-critical applications
Here’s a great story about the Machinery and Engineering company Krones Group, out of Neutraubling, Germany. The company manufactures machinery and complete plants for process, bottling, and packaging technology.
Millions of bottles, cans, and specially shaped containers are processed daily on behalf of breweries, the soft-drink sector, and manufacturers of wine, sparkling wine, and spirits as well as for the chemical, pharmaceutical, and cosmetics industry.
The company’s data centers are a key enabler for business growth. Consisting of 200 physical servers and 700 virtual machines spread across three locations, this critical infrastructure previously used a mix of technologies from different vendors. During a typical day, the three facilities handle around 1.3 petabytes of data and, in the case of the largest SAP database with more than 6TB, serve 5500 users concurrently. This data center environment relied on reduced instruction set computer (RISC) processor architectures for business critical applications such as SAP and databases, mostly running Solaris operating systems.
Krones selected a Cisco Smart+Connected™ Manufacturing solution, based on the Cisco® Unified Data Center. This pre-validated architectural approach combines server respective computing performance, network, and management into a platform designed to automate IT as a service across physical and virtual environments. The end result is increased budget efficiency, more agile business responsiveness, and simplified IT operations.
Migration from RISC/Solaris to Cisco UCS/Linux has begun and is already improving agility. IT infrastructure can now respond quicker to changes andrequirements in the development of application and business processes. Read More »
I am still feeling the energy from the Girls in ICT venue held in New York City on April 26, 2012 where I participated on a panel with outstanding women from Microsoft, Ushahidi and Facebook.
The conference included women pioneers from government and private industry who engaged in a stimulating dialogue on the topic of girls in ICT; to recruiting and retaining women in ICT a topic where shared accountability is a MUST.
Further, ITU Secretary General, Dr. Hamadoun Touré pointed out Cisco in his opening keynote:
“Special mention should go to Cisco, a long time partner of ITU, which today organized more than 40 different events globally – and I know that many other tech companies have also been very active in promoting events and celebrations.”
In my most recent blog “U.S. manufacturing: is it sustainable?“, I referenced an article about how U.S. manufacturing has been leading the economy out of the depths of the Great Recession. The authors put forward a thesis with supporting data that suggest Americans believe the manufacturing industry is the basis for wealth creation and is fundamental to a sustained and successful U.S. economy.
The rub is that only 30% of Americans said they have or would encourage their children to pursue a manufacturing career.
Why such a discrepancy? An answer to this question is not simple. However, I do believe we must seek that answer and address the gap, if the U.S. is to remain competitive in the global marketplace. Being an engineer myself--a manufacturing and controls engineer no less--I know the first and most essential step to a solution is making sure we’ve defined the problem well.
According to the survey, the top three reasons why kids aren’t interested in engineering:
Kids don’t know much about engineering (44 percent).
Kids prefer a more exciting career than engineering (30 percent).
They don’t feel confident enough in their math or science skills (21 percent) to be good at it. This is despite the fact that the largest number of kids ranked math (22 percent) and science (17 percent) as their favorite subjects.
Survey findings on the adult side:
Only 20 percent of parents have encouraged or will encourage their child(ren) to consider an engineering career.
The vast majority of parents (97 percent) believe that knowledge of math and science will help their children have a successful career.
So, while American children and adults both feel that math and science are important (even enjoyable), there is an ironic disconnect (cognitive dissociation?) between recognizing the importance and committing to pursue a career in engineering and manufacturing.