Cisco Blogs

Cisco Blog > Security

Easy-to-Use Threat Intelligence for Organizations of All Sizes: Threat Awareness Service

From credit card numbers to medical records, small and midsize organizations hold the same sensitive information as large enterprises. We often think of multinational corporations and governments as the primary targets for cybersecurity breaches, but smaller companies face the same threats. As enterprises start to spend more on security, hackers are increasingly looking to pick lower-hanging fruit by targeting smaller organizations. In recent years, more than half of known breach victims have been organizations with less than 1,000 employees, and 66% have fewer than 10,000.[1]

Without the large security budget or dedicated cybersecurity expertise of a major enterprise, smaller organizations struggle to implement threat intelligence solutions that can help them see suspicious activity occurring in their networks. These solutions are generally hard to deploy, difficult to use, and costly to obtain.

To help organizations of all sizes gain continuous visibility into suspicious activity occurring on their networks, we are introducing Cisco Threat Awareness Service, a threat intelligence service that enhances threat visibility by making security information available 24 hours a day, 7 days a week. Accessed through a web portal, this cloud-based service provides visibility into inbound and outbound network activity from the outside and highlights potential threats requiring additional attention. Cisco Threat Awareness Service requires no configuration changes, network infrastructure, or new software, so you can deploy the service quickly, easily, and cost-effectively.

Read More »

Tags: , , , , , ,

Project Aspis


One of the hardest jobs on the Internet is to work the abuse desk at a hosting provider.  These teams have to strike a difficult balance between protecting their customers, ensuring that their services aren’t being abused by malicious actors and delivering the service and convenience their customers expect.  They don’t get near enough credit for their work.

Recently, Talos had the privilege to work with the abuse team from Limestone Networks.  In the course of our joint investigation, we learned that Limestone Networks had been working against the same actor abusing their services for months.  Based on our findings, this actor was costing them approximately $10,000 a month in fraudulent charges plus wasted engineering time and the overhead of managing the abuse tickets this actor was causing.  By working together, Talos and Limestone Networks were able to make their network a difficult one for the actor to work in by rapidly identifying and terminating the systems they were trying to use.  As a result, the actor moved off of their network.

The results of this experience were so positive, both for Limestone Networks and Talos, that today Talos is announcing Project Aspis.

What is Project Aspis?
Provided by Talos, Project Aspis assists hosting providers, in certain situations, who are dealing with malicious actors who are persistent in their environment and a threat to others on the Internet.
Read More »

Tags: , , ,

Changing the Way We Deliver Vulnerability and Threat Intelligence

We are making some changes to the way Cisco Security provides and shares vulnerability and threat intelligence to make it more consumable by our customers and the security community. The Cisco Security IntelliShield Service has been successfully delivering multi-vendor security intelligence to our customers for 15 years. During this time, the security intelligence market has continued to evolve to more integrated and automated solutions. Similarly, the Cisco Security strategy has evolved to add machine-readable security content.

We have seen an ever-increasing volume of multi-vendor reporting over the years. IntelliShield started publishing security intelligence alerts in May 2000 and we published 1337 alerts that first year. By 2005 that had increased to 1555 alerts and in 2010 to 5210 alerts. In 2014, IntelliShield published 7242 alerts and the volume continues to increase. As the volume of security activity has increased, security teams are faced with the challenge of efficiently handling that increased volume. The solution for this increased volume is to automate the reporting and sharing of vulnerability and threat intelligence through machine-to-machine standardized formats.  Read More »

Tags: ,

Hook, Line & Sinker: Catching Unsuspecting Users Off Guard

This post was authored by Earl Carter.

Attackers are constantly looking for ways to monetize their malicious activity. In many instances this involves targeting user data and accounts. Talos continues to see phishing attacks targeting customers of multiple high profile financial institutions.  In the past couple of months, we have observed phishing attacks against various financial customers including credit card companies, banks, credit unions, and insurance companies, as well as online businesses such as Paypal and Amazon. These phishing attacks have gone old-school in that they either attach an HTML document or include HTML data in the actual email to present the user with official looking pages that appear to be from the actual businesses being targeted.

Read More »

Tags: , , ,

Three Key Considerations When Evaluating Threat Intelligence Solutions

To address today’s evolving threat landscape, there’s been a shift from traditional event-driven security to intelligence-led security. Threat intelligence plays an integral role in this shift.

When you hear the term “Threat Intelligence,” it’s easy to have preconceived notions of what it means. Gartner defines threat intelligence as “evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.” I like that Gartner’s definition does not include intent. Why? Intent implies that the “menace” is trying to target you, but we know that too often this isn’t the case. Pretty much any piece of malware out there will damage unintended targets. One example is Stuxnet. It targeted Iranian nuclear enrichment facilities. Unfortunately it escaped the purported air-gapped system and has been seen in at least 10 other countries. In more practical terms threat intelligence must be:

  • Tactical
  • Contextual
  • Automated

Read More »

Tags: , , ,