Many people take the term “Internet of Things” too literally, and assume that IoT is about the things, themselves. But they’re missing the whole point! It’s not the “things” that makes IoT special. After all, connected devices are neither new nor particularly interesting, particularly since the data each individual item produces is of little value. But by networking these devices together, IoT enables us to benefit from their ability to combine simple data to produce usable intelligence. In turn, that intelligence can be used by businesses to increase operational efficiency, and by individuals to make life easier and more comfortable.
But despite the many benefits of IoT, the billions of connected sensors, devices, and other smart objects it comprises will also dramatically increase the diversity of threats we will face. As a result, securely embracing IoT will require a multi-layer approach to security – including cloud, perimeter, physical, and device-level security, as well as end-to-end data encryption.
Ensuring that we can reap the overwhelming benefits of IoT without undermining security isn’t going to happen on its own; it will take strong leadership and a great deal of teamwork throughout the industry. That’s why I’m proud that Chris Young, Cisco’s Senior Vice President of Security, recently topped the list as one of the top 100 thought leaders for IoT! It will take leaders like Chris, who have a strong understanding of security and a passion for IoT, to help ensure that we can securely embrace IoT.
I honestly expect IoT to change the world in a variety of ways. But truly harnessing its power requires that we inspire and cultivate a true culture of security throughout every level of the extended network – which means that leadership and teamwork will be far more valuable than the technology, itself.
Tags: Cisco, cyber security, Internet of Everything, internet of things, IoE, IoT, IoT Security, network security, security
Last week I published a brief blog about the OpenSSL heartbeat extension vulnerability, also known as the Heartbleed bug.
One commenter asked, “What about the Cisco.com website? Is it safe to change our passwords on the site?” We received a handful of similar questions from customers today, so I would like to offer our formal advice.
The Cisco Security Incident Response Team (CSIRT) has not found any Cisco.com infrastructure that was vulnerable to the Heartbleed vulnerability. There is also no evidence to suggest a compromise of Cisco.com user accounts.
You are safe to change your password by visiting the Cisco.com profile management page – in fact regular password changes are something we actively recommend.
Regardless of the website you are visiting, use of a strong password and regular password changes are an important part of online safety. If you are looking for more password advice, we recommend the following US-CERT security tip: Choosing and Protecting Passwords.
Tags: cisco.com, Heartbleed, password, security
A recent Bloor Research Market Update on Advanced Threat Protection reminds us of something that many security vendors have long been loath to acknowledge: traditional, point-in-time technologies, like anti-virus or sandboxes, are not entirely effective when defending against complex, sophisticated attacks.
This is due to something we have said before and we will say again: malware is “the weapon of choice” for malicious actors. We know blended threats introduce malware. Our 2014 Annual Security Report notes that every Fortune 500 company that was spoken to for the report had traffic going to websites that host malware. Bloor tells us all, once again, that attack methods are becoming more complex.
To put it plainly, when it comes to networks being breached, it is not a case of if, but when.
Read More »
Tags: Advanced Malware Protection, Advanced Threat Detection, AMP, analyst, Cisco, malware, research, security, Sourcefire
Security concerns around cloud adoption can keep many IT and business leaders up at night. This blog series examines how organizations can take control of their cloud strategies. The first blog of this series discussing the role of data security in the cloud can be found here. The second blog of this series highlighting drivers for managed security and what to look for in a cloud provider can be found here.
In today’s workplace, employees are encouraged to find the most agile ways to accomplish business: this extends beyond using their own devices to work on from anywhere, anytime and at any place to now choosing which cloud services to use.
Why Bring Your Own Service Needs to be on Infosec’s Radar
In many instances, most of this happens with little IT engagement. In fact, according to a 2013 Fortinet Survey, Generation Y users are increasingly willing to skirt such policies to use their own devices and cloud services. Couple this user behavior with estimates from Cisco’s Global Cloud Index that by the year 2017, over two thirds of all data center traffic will be based in the cloud proves that cloud computing is undeniable and unstoppable.
With this information in mind, how should IT and InfoSec teams manage their company’s data when hundreds of instances of new cloud deployments happen each month without their knowledge?
Additionally, what provisions need to be in place to limit risks from data being stored, processed and managed by third parties?
Here are a few considerations for IT and InfoSec teams as they try to secure our world of many clouds:
Read More »
Tags: 2014 annual security report, CIO, Cisco Security, CiscoCloud, cloud, cloud security, data security, Fortinet, Hadoop, infosec, ITaaS, OLAP, security, Service Provider, wired
Editor’s Note: This is the third part of a four-part series featuring an in-depth overview of Infosec’s (Information Security) Unified Security Metrics Program (USM). In this installment, we discuss the effectiveness of the USM program at Cisco.
Information security is all about risk reduction, and risks are notoriously difficult to measure – ask any insurance salesman or actuary. So how do we handle this conundrum for a security metrics program that hasn’t even reached its second anniversary yet?
Peter Drucker, noted business management author, once said, “Efficiency is doing the thing right. Effectiveness is doing the right thing.” Even at this early stage of the USM program, we can see four clear indicators demonstrating we’re doing the right things to improve Cisco’s security posture across the IT organization and Cisco. They include the creation of newly defined partnerships, leveraging existing IT risk management frameworks, developing well-defined feedback mechanisms, and gaining increased support and visibility at the CIO level.
Read More »
Tags: information security, infosec, metrics, security, unified security metrics program, usm