Cisco Blogs


Cisco Blog > Security

Cisco Launches Security Incident Response Services

In security, there’s a gap between perception and reality. According to the Cisco 2015 Annual Security Report, 90 percent of companies are confident about their security policies, processes, and procedures – yet 54% have had to manage public scrutiny following a security breach. Not only are there direct costs to a security breach – there are also intangible expenses, including a negative impact to brand reputation, and the erosion of customer trust.

As John Chambers articulated recently at the World Economic Forum in Davos, “There are two types of companies: those who have been hacked, and those who don’t yet know they have been hacked.”  2015 is going to be another year where organizations around the world can expect to be under attack or will discover that they have been infiltrated.

There is a widening gap between resources and needs, as security practitioners lack both funding and manpower to adequately protect assets and infrastructure.  Because of this, CISO’s are increasingly looking to external experts for security guidance.

This is why we are unveiling our Security Incident Response Services.   Our new Incident Response Service is designed to advise organizations on how to reduce time to detection, containment and remediation. Our experts identify the source of infection, where it entered the environment, and what data was compromised. By going to the source – patient zero – and identifying malware movement throughout the environment, organizations can minimize the cost and overall impact of any breach, as well as identify methods to reduce future risk.  The service leverages threat intelligence from the Cisco Talos Security Intelligence and Research Group, Cisco security technologies including AMP Threat Grid and the expertise of the Cisco Security Solutions (CSS) team.  The Incident Response Service supports businesses in two areas:

Cyber Attack Response

Every event is unique and our Security Incident Response methodology provides expedience and allows for flexibility to continuously adjust to the dynamic threat landscape. Whether it’s an insider threat, distributed denial of service, advanced malware at the endpoints or customer data breach, the team guides an organization through identification, isolation and remediation using analysis and data mining, forensic image analysis, infected system dynamic instrumentation, malware reverse engineering and exploit analysis and re‐implementation.

Cyber Security Readiness

As businesses fall victim to increasingly targeted cyber-attacks and data breaches, they need external expertise to assess and promote security best practices as well as to protect corporate data and prepare for the inevitable data breach incident. An important pre-requisite for a successful incident response capability is a strong Incident Response plan, When an incident occurs, everyone knows how to respond, how to escalate, what to do, quickly and effectively. Cisco Incident Response offerings spans infrastructure breach preparedness assessments, security operations readiness assessments, breach communications assessments, and training among other activities.

Our team of experts has been actively working with customers for cyber attack response.  A recent engagement was initiated when a company had identified consumer credit card data exfiltration.  Working hand-in-hand with the customer, federal law enforcement and Cisco Talos, the Incident Response Services team discovered a new malware family targeting point of sale (PoS) systems.  The team identified malware patient zero and its lateral movement mechanism.  This ultimately led to the team’s discovery of a new family of malware, “PoSeidon,” which is detailed in this blog post.  Using best of breed technology, our incident response expertise, and working closely with Talos, the Cisco Incident Response Service team compressed the process of identifying, isolating and remediating for this customer by developing detection and countermeasures.

For more information on Security Incident Response Services team, please see our overview video and our Cisco Security Launch Page.

Tags: , ,

Incidence Response – Safety, Reliability and Recovery for Industry and Workers

Dan O’Malley talks about Cisco Systems offerings that are resonating in the Energy Industry and elsewhere. Cisco helps customers pre-plan for storms and to respond to disasters with sophisticated collaboration and device connectivity enabling technologies.

Many new technologies enable worker safety and visibility using 2-way radios, smart devices, and mobile broadband “connecting people and devices and work crews together smartly over the internet”. In the video Dan talks about the challenges customers face and how Cisco is helping them get ‘positive business outcomes’.

Yes – I know what you mean – what does that really mean? Well, mother nature doesn’t always cooperate, so getting outages dealt with as quickly as possible is one positive outcome. Keeping in touch with workers, especially those in dangerous areas, and warning them if safety issues occur is another. And maybe even having ‘wearable’ biometric devices attached to workers to see how they’re doing physically, and monitoring their vitals in real time by operations centers. That’s another.

Just keeping track of field workers is a challenge – and making best use of a constrained ‘expert pool’ might be another. Some newer ‘millennial’ devices are, of course, part of the architectural approach, but so are traditional two-way radios and other devices – so that everyone can communicate and collaborate to get the job done. And it’s getting the job done that really gives good business outcomes – ask any customer!

So, in the words of Dan:

It’s about smartly connecting people, and devices and work-crews together smartly over the internet. That’s what we do.

…and providing the best business outcomes possible: Read More »

Tags: , , , , ,

Engaging All Layers of Defense: Incident Response in Action

The Cisco 2015 Annual Security Report highlights many creative techniques that attackers are exploiting to conceal malicious activity, often taking advantage of gaps in security programs. They are continually refining and developing new techniques to gain a foothold in environments and, increasingly, they are relying on users and IT teams as enablers of attacks to persistently infect and hide in plain sight on machines.

Given this complex and dynamic threat landscape, organizations need a mature and adaptable incident response process.

Read More »

Tags: , , , ,

Responsive Security in Action

In 2013, our internal Information Security team carried out a series of controlled anti-phishing exercises. The purpose was to raise employees’ awareness of potential spear phishing attacks through emails. Spear phishing has been a common first step for Advanced Persistent Threat (APT) attacks to gain access to a user’s system before launching further attacks at internal targets. As such, if employees are vigilant against such attack patterns, we should effectively reduce the risk of successful APT attacks involving email phishing.

Through a series specially designed phishing emails executed over the four quarters, at one to two emails each month, the team captured an average “click” rate of 26%. The lowest click rate was 5%, and a highest was 61%. However, month over month, there was no discernible trend, as some months were low and others suddenly shot up. What was the data telling us? Did the users’ awareness rise or remain indifferent because of this exercise?

Read More »

Tags: , , ,

Getting More Responsive Security by Learning From Disaster Responses

Editor’s Note: In the two previous blogs, we discussed some of the issues and dilemmas found within information security knowledge and practice domains. Those challenges arise fundamentally from the traditional approach that many organizations have adopted to address information security requirements. In this fourth installment, we look at how good preparation can improve security outcomes, as illustrated in a few case examples.

As the Dutch philosopher Erasmus once said, “prevention is better than cure.” Most organizations’ security approaches have focused primarily on erecting defensive systems to prevent attackers from compromising information and systems through exploiting security weaknesses associated with technology, process, or people in the organization.

Read More »

Tags: , , ,