Cisco Blogs

Cisco Blog > The Platform

Cisco to Expand Security Consultancy Services with Acquisition of Portcullis

There’s no question that cybersecurity is top-of-mind for Fortune 500 companies. This, compounded by a significant global security talent shortage, contributes to the burgeoning need for security companies to deliver both a comprehensive technology portfolio and a strong security consultancy service practice.

With this as the backdrop, Cisco is pleased to announce its intent to acquire Portcullis Computer Security, Ltd., a privately held UK-based consultancy that provides cybersecurity services to enterprise clients and the government sector. Portcullis’ range of security consulting services includes assessments to identify vulnerabilities, forensic testing, first responder training to prepare for attacks, policy review and creation, security awareness training, and overall security posture audits. Together, Cisco and Portcullis will provide strategic guidance to our clients to help them with their most difficult security challenges.

Through this acquisition, we increase our ability to offer robust security, risk and compliance services to help clients overcome operational and technical security challenges, anticipate and respond to new threats, and drive new business.

The acquisition of Portcullis also complements the talent and skills Cisco gained through the Neohapsis acquisition earlier this year. Portcullis has a long history of providing security consulting services in Europe, with an extensive customer network, and a respected reputation for penetration testing of web applications and infrastructure. When paired with Cisco’s existing security services portfolio, Portcullis will help accelerate Cisco’s security services business and more quickly expand its security consulting services outside of North America.

The Portcullis team will join the Cisco Security Solutions organization under the leadership of Vice President James Mobley. The acquisition is expected to be complete in the second quarter of fiscal year 2016.


Tags: , , , , , , ,

Responsive Security in Action

In 2013, our internal Information Security team carried out a series of controlled anti-phishing exercises. The purpose was to raise employees’ awareness of potential spear phishing attacks through emails. Spear phishing has been a common first step for Advanced Persistent Threat (APT) attacks to gain access to a user’s system before launching further attacks at internal targets. As such, if employees are vigilant against such attack patterns, we should effectively reduce the risk of successful APT attacks involving email phishing.

Through a series specially designed phishing emails executed over the four quarters, at one to two emails each month, the team captured an average “click” rate of 26%. The lowest click rate was 5%, and a highest was 61%. However, month over month, there was no discernible trend, as some months were low and others suddenly shot up. What was the data telling us? Did the users’ awareness rise or remain indifferent because of this exercise?

Read More »

Tags: , , ,

Getting More Responsive Security by Learning From Disaster Responses

Editor’s Note: In the two previous blogs, we discussed some of the issues and dilemmas found within information security knowledge and practice domains. Those challenges arise fundamentally from the traditional approach that many organizations have adopted to address information security requirements. In this fourth installment, we look at how good preparation can improve security outcomes, as illustrated in a few case examples.

As the Dutch philosopher Erasmus once said, “prevention is better than cure.” Most organizations’ security approaches have focused primarily on erecting defensive systems to prevent attackers from compromising information and systems through exploiting security weaknesses associated with technology, process, or people in the organization.

Read More »

Tags: , , ,

Issues and Dilemmas in Information Security Practices

Editor’s note: In A Circular Problem in Current Information Security Principles, we highlighted one of the challenges in our knowledge domain that contributes to the ineffectiveness of today’s information security practices. In this third installment, we review the issues and dilemmas that are common in our practice environment.

One of the challenges information security management teams face is justifying their value proposition to the business to ensure that security requirements receive adequate resource allocations. The paradox here is that if security management within an organization is effective, the results typically show no observable outcome (i.e., no security incident). Interestingly, even if a security incident is not present, it does not necessarily mean that good security management practices are in place. They might be missing because of a security detection mechanism flaw, or simply because the attacker has no interest in carrying out an attack during that time period.

On the other hand, when a security breach occurs, the security manager is often questioned for failure to anticipate and prevent the incident. Security managers therefore often fall back on past or external incidents as a form of justification. Business managers frown on these explanations because they normally do not believe they are no better than their peers or competitors in the industry. Read More »

Tags: , , ,

A Circular Problem in Current Information Security Principles

Editor’s Note: In this second installment of the blog series on more responsive security, we take a closer look at the circular problems associated with four common security principles in managing “weak link” risks in Information Technology organizations.

Before discussing what constitutes this responsive approach to security, let us first look at a few of the fundamental principles of information security to understand the unique challenges organizations face today in managing security risks.

Read More »

Tags: , , , ,