Avatar

During the last few years we have witnessed how the cyber security threat landscape has evolved. The emergence of the Internet of Things combined with recent events have profoundly changed how we protect our systems and people, and drive us to think about new approaches for vendors to disclose security vulnerabilities to customers and consumers. But beyond disclosing vulnerabilities, we need to accelerate how their customers consume and respond to disclosures in an automated way.

Let’s face it, no software or hardware is immune to security vulnerabilities. Which means that the scope of managing them is a big task for administrators. In order to effectively protect their network, we as an industry need to make it easier for customers to identify and address known vulnerabilities within their networks.

To that end, today I am joining forces with the OASIS standards body to launch the Common Security Advisory Framework (CSAF) Technical Committee (TC). The purpose of the CSAF Technical Committee is to standardize the practices for structured machine-readable security vulnerability-related advisories. And then we will further refine those standards over time.

The CSAF TC will base its efforts on the Common Vulnerability Reporting Framework (CVRF) specification originally developed by the Industry Consortium for Advancement of Security on the Internet (ICASI).

If you are not familiar with OASIS, here is a quick recap from their website:

“OASIS members broadly represent the marketplace of public and private sector technology leaders, users and influencers. The consortium has more than 5,000 participants representing over 600 organizations and individual members in more than 65 countries.

OASIS is distinguished by its transparent governance and operating procedures. Members themselves set the OASIS technical agenda, using a lightweight process expressly designed to promote industry consensus and unite disparate efforts. Completed work is ratified by open ballot. Governance is accountable and unrestricted. Officers of both the OASIS Board of Directors and Technical Advisory Board are chosen by democratic election to serve two-year terms. Consortium leadership is based on individual merit and is not tied to financial contribution, corporate standing, or special appointment.”

Prior to creation of the TC, the CVRF standard has been adopted by several technology vendors and MITRE, which produce information in the CVRF format. And a number of organizations are consuming information produced in the CVRF format. But there is a significant opportunity to build upon the existing CVRF standard, and enable a more universal adoption of this process that saves customers time and increases the security of their networks in a more real-time manner. The new TC can offer immediate value and quickly support future development to improve the interoperability and utility of the framework in support of providing structured machine-readable security advisories.

The CSAF TC will make substantive additions and other changes to the CVRF, supporting documentation, and create open source tooling.

If you would like to join the OASIS CSAF go to https://www.oasis-open.org/committees/csaf 

Authors

Omar Santos

Distinguished Engineer

Cisco Product Security Incident Response Team (PSIRT) Security Research and Operations

Avatar

On October 4, 2016, powerful Hurricane Matthew crashed into the southwestern tip of Haiti as a category 4 storm with 145 mph winds, destroying homes, major bridges and infrastructure and flooding communities.  Next Matthew moved northward from Haiti and Cuba to Florida, Georgia and the Carolinas, at peak, reaching sustained winds of 160 mph. Authorities have reported at least 900 deaths due to the hurricane, including at least 39 deaths across five southeastern states with more than half of them in North Carolina.
14612537_10154652248104711_8462461607654923366_o

Cisco Tactical Operations (TacOps) is a highly skilled and dedicated team that can mobilize and respond to natural disasters and other catastrophes when normal communications infrastructure have been degraded or destroyed. TacOps has many resources at its disposal including Network Emergency Response Vehicles (NERVs), Emergency Communications Unit (ECU) Trailers, and a variety of portable kits. Their trained logistics coordinators and engineers maintain strong relationships with local and federal government agencies and humanitarian organizations worldwide – including NetHope, American Red Cross, USAID, FEMA, and the U.S. Department of Defense. Cisco TacOps plays a key role in public safety when needed.

These resources and their services were called into action in North Carolina as a result of destruction caused by Hurricane Matthew. The hurricane dumped up to 15 inches of rain in less than a day in areas over the eastern third of the state swelling rivers to some of their highest levels ever recorded and resulting in wide-spread flooding and evacuations for tens of thousands.

Trained to work in just such a challenging environment, the TacOps team mobilized with the Cisco NERV and other deployable communications equipment during the acute phase of the emergency, to provide secure networking and communications services to support emergency management staff, 911 operators, and regional Urban Search and Rescue (USAR) teams.  The Cisco NERVs are NIMS Type II mobile communications centers with advanced technologies to facilitate secure emergency collaboration and inter-agency interoperability. The priority for TacOps support is given to mission-critical public safety, government, and critical infrastructure agencies.  It is not required that they be a Cisco customer or partner and there is no charge for the services provided.
2

During Hurricane Matthew, the Cisco TacOps team supported over 15 GB of data across first responder organizations over a 24 hour period.  From an operations perspective, this included:

  • NERV data connectivity via Cisco’s Ku-Band High-Throughput Satellite (HTS) service
  • Air-to-ground radio interoperability using Cisco Instant Connect, enabling helicopters and ground personnel to communicate and coordinate rescues in flood zones
  • SIP-based IP telephony to support Emergency Operations Center and USAR staff
  • IP-based video surveillance for situational awareness
  • Printing support for a 911 Public Safety Answering Point (PSAP), and
  • Advanced cybersecurity protection

Building a Legacy of Digital Support During Disasters

Cisco TacOps was formed in 2003, initially to support the military with field networks and communications.  When Hurricane Katrina struck in 2005, Cisco deployed hundreds of employees and tons of networking equipment to the devastated US Gulf Coast; however the response was not coordinated at the corporate level, and there were no standard deployable communication technology platforms resulting in a lack of efficiency.  With many lessons learned from this experience, the TacOps team’s focus was shifted to disaster response, and they have since become Cisco’s primary crisis team to provide emergency networking and communications support. The team is now comprised of nine full-time engineers and operations coordinators who are supported by more than 300 Disaster Incident Response Team   (DIRT) employee volunteers in the United States, China, Europe, and Brazil. Through an ongoing training program, Cisco ensures that our engineers and DIRT members are prepared to respond in the harshest of disaster environments.  Since Katrina, the TacOps team has responded to dozens of incidents around the world.

3

TacOps also serves as an opportunity for those of us at Cisco to share in our belief that there has never been a better time for technology to help out with some of the world’s toughest challenges and to develop new approaches to tackle these issues.  By leveraging the accelerating transformation of digital technologies in areas such as secure wired and wireless IP-based data, voice, video (surveillance & teleconferencing) and radio, we can support, and in some cases improve, ongoing public safety activities. With Cisco TacOps we are dedicated to providing real-time coverage of global events including weather, natural disasters, geopolitical events, critical infrastructure, disease outbreaks and many more that may affect Cisco and its customers.

The TacOps team does more than just set up networks when disasters strike; they show people the value of communications during their aftermath.

To find out more, check out the Cisco TacOps website: www.cisco.com/go/tacops  or contact them at: tacops-info@cisco.com

 

 

 

Authors

AJ Ramsey

Global Industries Marketing Lead

GMCC-Services Marketing

Avatar

Vulnerability Discovered by Tyler Bohan and Cory Duplantis of Cisco Talos

Talos has identified an exploitable out-of-bounds write vulnerability in the ELF Section Header parsing functionality of Hopper (TALOS-2016-0222/CVE-2016-8390). Hopper is a reverse engineering tool for macOS and Linux allowing the user to disassemble and decompile 32/64bit Intel-based Mac, Linux, Windows and iOS executables. During the parsing of ELF section headers, there is a user controlled size that is not validated, a malicious threat actor could craft an ELF file with specific section headers to trigger this vulnerability, potentially leading to remote code execution. A malicious threat actor could use a zip file containing the crafted executable to target threat researchers, sent via phishing or file sharing sites. This type of exploit can also be used as an anti-analysis measure in an attempt to defeat sandboxes and automated disassembly.

Hopper has been updated the changelog can be read at this URL: https://www.hopperapp.com/rss/html_changelog_v3.php

Hopper1

Read more

Authors

Talos Group

Talos Security Intelligence & Research Group

Avatar

#CiscoChampion Radio is a podcast series by Cisco Champions as technologists. Today we’re discussing Cisco CloudCenter.

Cisco Champion 2016Get the Podcast

  • Listen to this episode
  • Download this episode (right-click on the episode’s download button)
  • View this episode in iTunes

Cisco Guest
Dave Goldman, Cisco Technical Solutions Architect

Cisco Champion Hosts
Brad Haynes (@gk_bradhaynes), Client Solutions Specialist
Eric Perkins (@perk_zilla), Solutions Architect

Moderator
Lauren Friedman (@lauren)

Continue reading “#CiscoChampion Radio, S3|Ep. 26: Cisco CloudCenter”

Avatar

The digital transformation of Argentina has begun – and Cisco is at the forefront of the change.

First though, it’s important to note that, Latin America faces some daunting statistics: 21 million Latin Americans will be unemployed by the end of this year, and at the same time, the region will need 449,152 IT professionals over the next four years to fill the IT skills gap. To close this gap, industry and government alone cannot go digital without people who know how to manage the network and use the software.

Cisco is helping, with support from Argentina’s new president Mauricio Macri. Recently named one of the World’s 100 Most Influential People and the Most Powerful President in Latin America by Time magazine, Macri has wasted no time initiating a much-needed digital transformation for his country, starting with technical training.

Just last month, I participated in the Argentina Business & Investment Forum in Buenos Aires. The high profile event was a groundbreaking initiative launched by Argentinian President Mauricio Macri and hosted by the Argentina Investment and Trade Promotion Agency. It was designed to highlight investment opportunities, attract foreign direct investment, and mark Argentina’s historical return to international markets.

While at the Forum I had the opportunity to be part of a keynote panel called the Innovation Imperative. This panel discussed how to inject further dynamism, entrepreneurship and innovation into the Argentinean economy. Panelists included, Horacio Rodriguez Larreta, Mayor, City of Buenos Aires and Andres Ibarra, Minister of Modernization, Argentina. The conversation was focused on the steps Argentina is taking towards digital transformation, including closing the country’s digital skills gap.

To that end, this past May, Cisco and Argentina’s Ministry of Education signed an agreement to reduce the skills gap through teaching networking communication skills. The Cisco Networking Academy will teach technical and professional skills development training free of charge with support from INET (National Institute of Technical Education). Cisco’s Country Manager for Argentina, Gabriel Sakata: “Cisco is committed to supporting the development of the skillset on networking technology, as well as information technology. These two areas are essential for the country’s transformation.”

Now technical schools and institutes for professional development in Argentina are getting another boost that will help them meet the demand for tech-savvy employees. In September, the Ministry of Education and Cisco signed a second agreement, this time with the Municipality of Lanús. Lanús is a major industrial center that is part of Buenos Aires’ greater metropolitan area, and contains one of the largest medical centers in the region (the Eva Peron Medical Center).

Through this agreement, students who enroll in the vocational center at Eva Peron Medical Center will now learn how to use Telepresence technology for telemedicine as part of the nursing career path curriculum. This initiative will produce a generation of nursing school graduates who are fully prepared for jobs in modern, digitally transformed medical facilities. With these technical skills, the nursing school graduates will be able to get better jobs. They will also spread their expertise in telemedicine technology throughout Argentina, helping the entire country transform, and improving the quality of life for more and more patients of digitally equipped medical facilities.

And it all starts with Cisco’s commitment to technical training. Just another example of how we are working together to make the world a better place for everyone.

Authors

Jordi Botifoll

No Longer with Cisco

Avatar

Yesterday, the US Environmental Protection Agency (EPA) presented Cisco Systems with a Green Power Partner of the Year award. The Green Power Leadership Awards recognize Green Power Partners for their leadership, overall renewables strategy, and impact on the green power market.

Cisco Systems was one of only three organizations nationwide to be chosen as a Green Power Partner of the Year in 2016.

Kathy Mulvany, Vice President of Corporate Affairs, accepting the award from Alexis Strauss, Acting Regional Administrator, U.S. EPA
Kathy Mulvany, Vice President of Corporate Affairs, accepting the award from Alexis Strauss, Acting Regional Administrator, U.S. EPA

“Receiving the Green Power Partner of the Year Award is a great honor,” said EPA Administrator Gina McCarthy. “We applaud Cisco Systems’ exemplary leadership in using and advancing the market for green power. This should serve as a model for the entire country.”

Cisco has been recognized by the US EPA for green power use in the past. We won Green Power Partner of the Year for the first time in 2008 and again in 2013. Additionally, we have been listed on the EPA’s Top Partner Rankings for multiple years.

As of July 25, 2016, Cisco Systems ranks 4th on EPA’s National Top 100 list, 3rd on the Top 30 Tech & Telecom list, and 4th on the Fortune 500 Partners list. These rankings are updated quarterly at the EPA’s site.

Purchasing electricity generated from renewable and low-carbon sources is a key component of our GHG reduction strategy to meet our GHG reduction goals. Cisco has been purchasing renewable electricity primarily in the U.S. and Europe since FY06.

Today, we have a comprehensive global plan to reduce GHG emissions which extend all the way to employee homes:

  • Participate in utility green energy programs (Austin Energy and Duke Energy in the U.S., and various programs throughout Europe)
  • Install onsite solar PV systems at campuses across the world (2.7 MW installed to date)
  • Implement longer-term renewable energy power purchase agreements (PPAs); our first is a 20-MW solar photovoltaic project in southern California
  • Purchase green-e-Certified RECs in the U.S. and India where utility green power, onsite systems, and PPAs are not readily available options to pursue
  • Encourage employees to install solar on their homes through an employee solar discount program

In FY15, Cisco used over 1.1 billion kilowatt-hours (kWh) of green power globally, making up 97 percent of our overall US and 72 percent of our global electricity use.

According to the EPA, this amount is equivalent to the electricity use of nearly 100,000 average American homes annually. By choosing clean, renewable energy, we are accelerating the transition to a more sustainable and low-carbon energy future.

Please read more about our commitment to environmental sustainability at csr.cisco.com.

Authors

Catherine Paquette

Business Analyst

Global Energy Management and Sustainability (GEMS)

Avatar

Vulnerability discovered by Aleksandar Nikolic of Talos.

Talos has identified an information disclosure vulnerability in Foxit PDF Reader (TALOS-2016-0201/CVE-2016-8334). A wrongly bounded call to `memcpy`, while parsing jbig2 segments within a PDF file, can be triggered in Foxit PDF Reader causing an out-of-bounds heap memory to be read into a buffer. The `memcpy` call is properly sized, but the source is smaller than the size argument, causing the adjacent memory to be copied into a buffer, where heap metadata, addresses and pointers can be copied and later reused, disclosing memory layout. Combined with another vulnerability, this information disclosure can be used to leak heap memory layout and bypass ASLR. Phishing campaigns commonly use PDF files, as malicious attachments or linked downloads, to deliver malware.

Read more

Authors

Talos Group

Talos Security Intelligence & Research Group

Avatar

Everyone knows that Software Defined Networking (SDN) and Network Function Virtualization (NFV) technologies are key to future Service Provider(SP) success. But how to get there is something that most service providers are struggling with. I was at SCTE/ISBE conference in Philly last week, which is one of the largest cable technology shows with over 10,000 attendees roaming through the Philadelphia convention center. I gave a session on the business impacts of SDN and NFV. I was also able to attend a few of the talks to get an idea of where the overall cable industry is moving from a technology standpoint.

One of the key areas of focus was 5G and its emergence as an opportunity for operators to get into new business models driven by IoT and digitization. And the common theme was that to take advantage of the next generation digital opportunities, cable operators have to start moving to SDN- and NFV-based architectures to differentiate themselves in the marketplace.

While SDN and NFV were recognized as ways forward for SPs, every SDN/NFV session focused on specific solution deployment – From SD-WAN, to SD-Optical and SD-DOCSIS. So coming out of those sessions, I thought, if operators are expected to transform how they do business and compete in a digital market, they will have to look at a comprehensive migration beyond deploying specific solutions.

So here is a way forward that could make the transition more transformational, smoother and operationally impactful. I recommend focusing on three steps:

  1. Implement an SDN automation and orchestration platform
  2. Deploy NFV infrastructure
  3. Deliver virtualized services

Starting with Automation and Orchestration

Talking to various operators, two key challenges they are facing today are operational complexity and service rigidity. SDN from its inception was meant to automate the network to make it more flexible. So the first step should be to transform your operations and your back-office by deploying an automation& orchestration platform.

figure1

Figure 1. Impact of Automation on Opex

My colleague recently did a blog highlighting what type of impact automation is having on existing service provider operations. The results from the customer case studies show on average 60-70% in time and motion savings across service and network operations. Automating individual service lifecycle processes, such as adding a new customer, resolving an incident, handling a change request and disconnecting a service, has an immediate impact on your bottom line. So operators should start with automation to get 50-60% operational expenditures (OpEx) efficiency shown in Figure 1.

The business case analysis included customers that specifically implement the Cisco Network Services Orchestrator. A North American operator saves on average $117 in OpEx for every dollar invested in automation as shown below in figure 2. The numbers vary by region and operator, but the theme remains the same –there is tremendous amount of savings from automation.

Capture1

Figure 2. Average annual savings for every dollar invested in automation

Moving to delivery of Virtual Services

Once the automation platform is in place and existing services and network operations are automated, the next step is to deploy virtualized infrastructure to deliver virtual services that are on-demand, zero touch and elastic. The deployment of a Network Function Virtualization Infrastructure(NFVI) solution will enable you to tap into new revenue opportunities such as SD-WAN and other virtualized ICT services. A recent global survey done to identify these new opportunities by AMI-Partners shows that the adoption of SDN and NFV by SPs could open up a $47B new opportunity by 2019. This ICT as a Service (ITaaS) global opportunity is shown in figure 3.

figure3

Figure 3. Regional SP revenue opportunity in ICT services with the adoption of SDN & NFV

So to get the operational efficiency and tap into the new virtual services revenue opportunities, SPs need to make a transformational move to SDN & NFV. To get more details, please check out my colleague Sanjeev Mervana’s blog on automation and a recent ITaaS webinar on the ICT revenue opportunities from SDN & NFV.

Authors

Ben Bekele

Director Prouduct Management

Avatar

In April we covered the description of Email Spoofing using Microsoft Outlook, but what about detecting and mitigating it on the Mail Transfer Agent (MTA)? There are multiple technologies that have attempted to address the issues surrounding spoofed emails on the MTA, but they all have shortcomings that can limit their usefulness.

DKIM, or Domain Keys Identified Mail, allows recipient mail systems to retrieve a cryptographic key from the sender’s DNS and perform calculations on the headers of the message to determine if the message came from that sender. This only works if the sender uses DKIM on outgoing mail and publishes the key for the recipient to verify the calculations. It also has limitations when dealing with third party senders that send email with spoofed ‘From’ addresses.

SPF, or Sender Policy Framework, lets senders list all of the systems that send email on behalf of the company. It’s easy to do, but can be problematic again with third party senders and with automated systems that send email directly outbound instead of through the MTA. Additionally SPF has limits on the amount of data that can be in the DNS text file, including limits on recursion, and both DKIM and SPF require the recipient to make a decision on what to do with a message that fails checks.

DMARC, or Domain-based Message Authentication, Reporting, and Conformance, is a step in making DKIM and SPF easier to use by allowing the sender to publish a DNS text record that tells the recipient what they should do with a message that fails checks. While helpful, this does not address problems of DMARC compliant email senders such as webmail systems that allow the ‘Friendly From’ address to be specified by the sender. These systems can be abused in that the envelope sender passes the DMARC checks, but the ‘Friendly From’ address that is spoofed is the one that Microsoft Outlook displays to the recipient. This behavior is allowed by SMTP in that there is no enforcement on the envelope sender and the ‘Friendly From’ address being the same and it’s not a good idea to force that behavior since it would cause problems; for example, breaking third party marketing campaigns.

In Cisco Email Security AsyncOS 10.0 release, a new feature was introduced to make detecting and handling these spoofed messages easier with Forged Email Detection. In previous versions a combination of Message Filters, various Content Filters, and dictionaries could be created and used to detect and mitigate these messages. But with the 10.0 release, much of the workflow has been consolidated into a Content Filter Condition using an administrator-created dictionary Text Resource to match against containing common terms for the organization. It scores the email based on matches to the “Friendly From” field in the message and for Cisco, the terms would include: CEO, CFO, CIO, CISO, Chuck, Robbins, crobbins, chuck.robbins, and more. This would allow for matching on messages that purport to come from high-value senders in the company enabling customers to combat email spoofing and Business Email Compromise more effectively.

To learn more about other features included in our latest AsyncOS 10.0 release, you can watch this video. To learn more about Cisco Email Security, visit cisco.com/go/emailsecurity.

Authors

Raymond Jett

Technical Marketing Engineer

Security Business Group