Avatar

This blog was guest-written by Brandi DeCarli, Founding Partner of Farm from a Box.

Every aspect of our modern-day lives has been impacted by technology. From cloud and robotics to digital currency and drones, our lives are inextricably tied to the technology that surrounds us. While farming may not be the first thing that comes to mind when thinking of technology, it has played a key role in changing the face of agriculture and our global food system.

In the past 50 years, the Green Revolution has pushed to increase crop yields through large-scale intensification of single crops. Advances in mechanized farming allowed for larger and larger acreage to be farmed. By focusing on the large-scale intensification of a single crop, the natural checks and balances that diverse ecosystems provide were no longer in place.

To maintain production, it required heavy use of fertilizers and pesticides, which has directly impacted soil fertility and ecosystems around the globe. Now, with 40% of our agricultural soil degraded and 70% of our freshwater resources being gulped up by agriculture, it is clear that our current approach is not sustainable.

While advances in technology have enabled global agricultural production to increase with our growing population, those gains came at an unprecedented environmental cost. As we work to feed a growing global population, the environmental pressures will continue to increase.

By 2050, the world’s population is expected to grow by more than two billion people. Half will be born in Sub-Saharan Africa, and another 30 percent in South and Southeast Asia. Those regions are also where the effects of climate change are expected to hit hardest.

So, how can make sure that the growing need for food worldwide is met in an ecologically sustainable way? And what role can technology play? The opportunity may be in shifting our focus from mass production to production by the masses.

An estimated 70% of the world’s food comes from small, rural farms that are no bigger, on average, than two acres.  And despite the increase in large-scale industrialized farms, small, rural farms are still the backbone of our global food supply. But these rural areas are often the most vulnerable to the effects of climate change.

The challenges of drought, degraded soil, and inefficient and labor-intensive methods contribute to and exacerbate low and unreliable crop production. Without access to the infrastructure or technologies that can support a productive farm, farmers will either struggle with low yields, depend on chemical inputs that further deplete the soil, or rely on outside aid.

This is where Farm from a Box comes in.

Farm from a Box works to bridge the “access” gap by providing a complete, off-grid toolkit for sustainable, tech-powered agriculture. Built from a modified shipping container, each unit contains a complete ecosystem of smart farm technologies to enhance agricultural productivity; from renewable power and micro-drip irrigation to Information and Communications Technology equipment.

Designed as the “Swiss-Army knife” of farming, this mobile infrastructure provides all the tools needed to support a two-acre farm. By empowering farmers to grow and sustain food production at the community level, we build greater resilience to climate shocks, boost livelihoods, and help bridge the access gap by making healthy food locally available.

With its own off-grid power, Farm from a Box can act as its own micro-grid in remote locations; drip irrigation helps save water and stabilize crops through drought conditions while also extending the growing season; internal cold-storage helps keep crops fresher longer, reducing post-harvest loss by 80%; Wi-Fi connectivity improves information access and exchange; and a cloud-based IoT system helps monitor production and efficiencies.

By introducing micro-irrigation, we can extend the growing season and better support a wide variety of crops throughout the year, while lowering the amount the water used by applying it directly to the plant. The off-grid power array and storage provide a reliable energy source to power the pump, move the water through the irrigation lines, cool the internal cold storage area, and support the charging of auxiliary needs.

We have also connected each unit with Wi-Fi capabilities and a complete IoT system to improve operational efficiency, optimize water and energy use, and provide guidance on farm management and market information. Because we have integrated sensors on all of the primary systems, we can monitor and control the performance of the system, and also set alerts for when a component dips below or exceeds certain levels.

Let me give you an example of how this applies in a real-world situation. We recently teamed up with the United Nations World Food Programme Tanzania and WFP’s Innovation Accelerator to support food and nutrition security for refugee and host communities. Our Farm from a Box system will be used to increase the availability of nutritious crops, provide low-cost agricultural commodities and, through increased production, boost the income levels for both refugees and the surrounding host communities.

Because the farm is operating in a remote location in eastern Tanzania, information becomes a vital component to ensuring the system is working as it should be, and the farmers have the data they need to know what is happening and why. Through our cloud-based IoT system, both the community and the WFP has open access to see how much energy the solar panels are producing, how much water is being used, and if the overall system is functioning properly.

Now, technology for the sake of technology isn’t a standalone solution; how it is utilized in overall value creation is where we find the real impact. By marrying technology with small-scale regenerative farming practices, we can improve soil quality, reduce dependence on outside inputs, conserve water, and build up nutrients.

Techniques like composting, crop rotation and diversification, cover cropping, and no-till practices nurture the soil’s fertility and help produce a healthier crop. By shifting our focus from industrialized agriculture to local organic agriculture, we can potentially convert carbon from a greenhouse gas into a food-producing asset.

Farm from a Box is just one of many innovations that are working to empower smallholder farmers with sustainable solutions; there are vertical farm systems, small farm robots that automate field work, drones that use near-infrared and thermal sensors to “see” how plants are doing. Technological innovations like these can help us achieve better health, well-being, and equity throughout our planetary system as a whole.

But we need creative solutions, and sometimes that requires thinking outside of the box. I don’t come from a technological background, nor does my business partner, but we saw a problem and thought, “There must be a better way.” We all have the power to change our world for the better. Food is something that connects us all and has a direct impact on our everyday lives and environment.

When we first set out to start Farm from a Box, our intention was to create a mobile infrastructure that could provide people with the tools they need to grow their own nutritious food. Over time, that idea has grown; we now see Farm from a Box as a tool that could transform local production and nutritional security globally.

Whether it is a local school, community group, or remote village in an underdeveloped country, smallholder farmers are the ecological gatekeepers to building a more sustainable and equitable food supply. Technology has the potential to help solve the intractable problems facing humanity and will continue to play an increasingly vital role in global food security and planetary health. But it will require innovative thinking from all of us to achieve it.

Take your first step in joining us by registering today for our session in the Women Rock-IT Cisco TV series, “Global Problem Solvers Who are Guardians of Our Planet.”

Authors

Austin Belisle

No Longer with Cisco

Avatar

Maybe your users mistakenly clicked on a suspicious ad. Or maybe they were tricked into opening an email link. But no matter how it happened, here you are: Ransomware has encrypted your files, and you need to pay a hefty fee to get them back. It’s not just you: The attacks continue to proliferate — now approaching a $1 billion annual market — as they infect the computers and networks of entire organizations.

The good news is that the risks of ransomware can be reduced. In fact, this was the exact topic of our May 25th #CiscoChat, “Securing Your Network in the Age of #Ransomware.” While WannaCry may be the most prolific ransomware attack that comes to mind right now, our chat covered topics beyond just WannaCry. During the Chat, we discussed how the best ransomware defense strategies take a multi-pronged approach, including DNS layer protection, segmentation, and other advanced defenses.

Missed out on the great discussion? We’ve put together a handy highlight reel of all the best responses to our questions:

  1. What are some things you can do to update your cybersecurity strategy in the wake of the WannaCry NHS cyber attack?


  1. Why is network segmentation important in your cybersecurity plan?


  1. How do you mitigate the risks associated with shadow IT within your organization?

  1. Given the growth of the Internet of Things, how important is cloud and perimeter security to your organization?


  1. Is cybersecurity a top priority across your organization, or only within IT?


  1. How do you promote a security-minded culture throughout your organization?


  1. If your organization suffered a severe ransomware infection today, could you recover with little to no disruption?

Check out the full chat on our Storify archive. For more on securing your network against ransomware, check out our free ebook, Ransomware Defense for Dummies. To everyone who participated in our May 25th #CiscoChat: Thank you! We enjoyed the opportunity to have a conversation with you. We hope you were able to take away something that will help you improve your own network cybersecurity. Join us for another Chat soon!

Authors

Greg Hamilton

Program Manager

#Cisco Chat & Cisco Digital Training and Certification

Avatar

Wow, what a week it has been for Cisco and especially for DevNet! Last week on May 23rd and 24th something magical happened. A lot of people were caught by surprise, but Cisco organized its first-ever conference catering to its developer community. As we ramp down a very successful event, it is worth having a look at where Cisco’s developer program started, where it is currently, and where it is going.

The Vision

Let’s start with the beginning. Rising like a phoenix from the ashes of CDN, Cisco Developer Network, and based on Rick Tywoniak’s vision for a new developer community, a small DevNet team took on the gargantuan task of planning, organizing and executing the impossible. 3 years ago on the dot, the DevNet team took part in its first major event, Cisco Live US 2014. Back in May 2014 the team was nervously stepping into unknown territory. Nobody could predict if the event would be a success or a failure. Fast forward 3 years for DevNet Create and just like then you could feel the nervousness and the excitement in the air. In both cases the events turned out to be hugely successful.

DevNet-Zone-2014

After that first Cisco Live in San Francisco’s Moscone Center it was apparent to everybody that more was needed. The community was and still is thirsty for knowledge. Since then, the DevNet Zone at Cisco Live events around the world kept growing both in physical size as well as number of attendees. Within these 3 years the community has grown tremendously with events around the world, hackathons, DevNet Express and support from the Cisco SE organization. We’re currently at around 500,000 users as part of our community and look at welcoming a lot more in the near future.

The Growth

So this year, we’ve decided to have our own conference. Just three years after that first DevNet Zone. The community is mature enough that we can have a completely separate event! Everyone was invited but the focus was on IoT, Cloud and DevOps application developers. As Cisco transitions more and more into a software company through acquisitions like AppDynamics, and by exposing comprehensive APIs, this developer community will be critical to Cisco’s success.

DevNet-Create-keynote-day1

This is great but after all this is an enterprise networking blog. What do application developers have to do with enterprise networking? As an embattled network engineer, I was wondering myself what this conference has to offer me, the networking geek. Will I be able to find something that will “spark” my interest? It turns out there were a lot of sessions that I’ve found useful. Starting with Susie Wee’s keynote on the first day in which she mentioned how the lines between applications and a programmable infrastructure are becoming blurred, continuing with Todd Nightingale, Cisco Meraki’s GM/SVP that confirmed Meraki’s commitment to building relevant APIs, and ending with Anthony Shaw from Dimension Data on why you should not run in a datacenter as well as how you can integrate Cisco Spark in your networks as part of a monitoring solution. Personally, I’ve learned a lot of new things.

The sessions covering Cisco technologies were few and far in between. This was on purpose. The majority of the sessions on the agenda were not Cisco but industry related. So I’ve also brushed up on my containers, Kubernetes, micro services and API design best practices during the conference.

While I find the presentation sessions at these conferences useful I like much more to get hands on with the technology if possible. I found that I am not the only one that feels like that because the hands on learning labs and mini-hacks area was completely full for the most part of the two days. For the learning labs we’ve had at the event a subset of the labs that are available at https://learninglabs.cisco.com. The mini-hacks were fun challenges around Cisco Meraki, Cisco Spark, Cisco Jasper, AppDynamics, FastLane, CitySDK and Census API in which the attendees had to find a solution by hacking and combining features exposed by different technologies. There were also workshops in which the presenters demoed a specific use case and attendees could follow along on their personal computers.

Mini-hacks-and-learning-labs

Let’s not forget the Meraki challenge in which conference attendees that completed 2 Meraki mini-hacks on site or 3 self-paced learning labs are getting free Meraki hardware. A lot of access points are on the line so make sure you join in and complete the challenges to get your own at https://devnetcreate.io/2017/pages/meraki/meraki.html

There were several major announcements made during the conference:

  • Cloud Native Computing Foundation (CNCF) Technical Oversight Committee (TOC) voted to accept CNI (Container Networking Interface) as the 10th hosted project,
  • Cisco Spark SDKs for iOS and JavaScript and Cisco Spark Widgets for messaging and calling were released,
  • Cisco Meraki announced the investment of a million dollars worth of hardware, sample code and licensing that is available for Meraki developers for free, to name just a few.
  • The Department of Commerce introduced their Opportunity project leveraging the Open Data platform and their plans to create public solutions around it.

The Celebration

All in all it has been an amazing event and I want to thank all the DevNet Create participants for joining us at Bespoke in San Francisco for Cisco’s first developer conference ever! Big thank you to our contributing partners!

DevNet-Create-2017-Partners

Last but definitely not least, thank you to the amazing DevNet team that has done the impossible and with very strict deadlines managed to organize and execute on Cisco’s first developer conference.

We’ve come a long way in DevNet, we’ve learned a lot, we’ve changed a lot and we adapted based on our community’s feedback. And we will do the same in the future. Look out for ever more events, more learning labs and workshops, more social responsibility projects, a bigger online presence and more Cisco SDKs and APIs. 3 years from now the Moscone Center will not be big enough to fit us all, but until then see you all at the next DevNet Create event!

 

Authors

Adrian Iliesiu

Principal Engineer

Cisco DevNet

Avatar

There has been a lot of discussion lately around why IoT projects fail. Many projects stall at the proof of concept (POC) phase, and only about a quarter of these investments are considered a success.  With these setbacks however, there are some notable achievements as well.

As part of our factory of the future webinar series, we are excited that this month’s topic will dive right into successful industrial IoT projects and the key themes and developments that made these projects impactful to the business such as:

  • Overcoming adoption challenges
  • Building the right foundation for security, analytics, and automation
  • Prioritizing business cases that will demonstrate ROI

https://www.youtube.com/watch?v=iOOGanHzejQ

You can register for our event on June 6th, Real World Deployments for Industrial Applications, here. If you missed any of our past events, don’t worry! We have them on-demand  with manufacturing topics such as:

We’ll continue to add more webinar topics throughout the year, so be on the lookout for additions to the series. We also invite you to explore the following manufacturing topics:

Hope you can join us on June 6th!

Authors

Eric Ehlers

No Longer at Cisco

Avatar

Sometimes you get the opportunity to walk away from the Cisco booth to see – and feel – what’s energizing the industry. From NAB 2017, here are a few of my walkaway takeaways:

1. NAB isn’t just for “traditional broadcasters” anymore. This year, the transition of IP deeper into the video food chain came with a palpable sense of urgency. If foot traffic and meeting volume is any indication, NAB ’17 was one of those inflection points for the record books: We had more visitors and meetings than ever.

Last year, it was all about that important shift of SDI to IP. This year, it was SDI to IP, sure, but it was also about how to find the right technologies and companies to get traditional video to behave more like Internet-styled video (from creation through consumption). NAB President Gordon Smith’s comment, in one of the show dailies — that 90 of the top 100 TV shows originate from traditional broadcasters — is significant.

The only thing that makes broadcasters “traditional” is their transmission mechanism. Broadcast. They’re on the IP bandwagon now, because they want to be, and they have to be, if they want those 90 of 100 top TV shows to reach beyond their “traditional” distribution.

And the future of broadcasting was evident at NAB, as the opportunities are seemingly endless once you have a solid foundation in IP. There was a growing buzz in the South Hall around capabilities like artificial intelligence and machine learning, which will surely kick IP broadcast into overdrive.

2. Storage is making its way back into the video spotlight. Storage always matters, local or cloud — but with the onslaught of big, bulky 4K video, and 360-degree video, and the VR/AR camps, we’re back to dealing with gigantic video files. The need for big storage and handling popped up both in capture and transmission — nearly half of the lower South Hall was populated with companies focused on the processing, encoding, and workflows associated with big files. Storing large files is also a big part of what’s enabling the global shift to cloud-based DVR services.

3. The next big thing is making “traditional broadcast” video act more like its over-the-top (OTT) cousins. A big part of the overall transition to IP is the work of making IP video behave better than “traditional” broadcast techniques — and again, I am focusing on the distribution mechanism here (broadcast), not the industry segment known as broadcasters.

Consider: It used to be that IP video streamed to a handheld, Internet-connected screen was kind of a drag. It took forever to load, or the buffering became tedious, or something else happened that caused viewers to just bail. Adaptive Bit Rate (ABR) techniques, which make devices more aware of the network, and vice versa, are fixing that. That means “right sizing” a stream for the device that will display it, taking into account any network congestion that stream encounters along the way.

Without missing a beat, the South Hall was also buzzing about bringing that elusive video quality to IP streaming. So everything in the video delivery ecosystem is becoming more intelligent in order to transcend “best effort” connections. From our perspective, it’s about making the IP network more content – and content quality – aware. The future of IP Networking for video will be sensing and correcting for video quality, everywhere: from the encoder to the transmission network to the client.

The shift from “traditional” broadcast to IP video is on, and was more real than ever at NAB this year. Whether you were visiting the Cisco booth, or walking the show floor, the shift to IP broadcasting, scalable storage workflows and quality-aware IP streaming was ever-present. It is immensely satisfying to be with Cisco and at the center of these industry transformations that will help our collective customers to reduce time to market, simplify operations, and monetize content across multiple screens. Hats off to the Cisco team who made this year’s NAB our best ever.

Authors

Yoav Schreiber

Marketing Manager

Service Provider Video Marketing

Avatar

Voiceworks delivers telephony solutions from the cloud

Voiceworks BV, an Almere based company in The Netherlands, is one of the largest and fastest growing VoIP & web technology specialists. They are achieving great success in the Dutch and German telecom world with its corporate Unified Communications (UC) and fixed-mobile-integration services delivered from the cloud both as a Mobile Virtual Network Enabler (MVNE) and Mobile Virtual Network Operator (MVNO). In 2015 Voiceworks expanded by acquiring OnePhone GmbH, a German Mobile Virtual Network Operator (MVNO), which was an important step for Voiceworks and ensures local presence in Düsseldorf with a larger range throughout Germany. In 2017, Voiceworks also acquired Xenosite BV, a dutch broadband and telecom supplier in the business market.

Voiceworks is one company that has a full range of disciplines present, including product development, customer support, installation consultancy and commissioning. They develop their communication software completely in-house under the Summa (voice, UC) and Summa Networks (HLR/HSS) brand and is considered leading edge for the telecoms sector. In recent years, the business telecom provider has developed several innovative services using the Agile software development model, and marketed to Dutch clients through its extended resellers channel of approximately 200 partners. For all services the company uses the cloud, and the far-reaching fixed-mobile-integration is an important principle of the company.

What was Voiceworks’ challenge?

The challenge for Voiceworks was present in their current mobile packet core platform was somewhat rigid. Key features on 4G or beyond were missing and lacked support for Private Access Point Name (APN) which was a requirement for their customer base. Also the support of the current vendor did not allow to quickly deploy new functions or fix operational issues. After a review of their vendor options, Voiceworks selected the Cisco Ultra Packet Core (UPC). Voiceworks engaged in a on-premises proof-of-concept (PoC) labtest. Due to the excellent online documentation and professional help of the involved System Engineers Voiceworks was able to quickly install the mobile platform themselves on their own lab COTS hardware. Voiceworks reviewed both VMWare ESXi and Ubuntu KVM as hypervisor and ultimately choose a KVM deployment. This new mobile platform will enable Voiceworks to quickly deploy new services in minutes and easily scale operations. Currently deployed into its live network, and the solution has carried customer traffic with complete reliability, scalability, and quality.

The Solution Detail

The new Ultra Services Packet Core solution delivered the virtualization needed along with the future proofing required. The platform also enabled Voiceworks a network capable of:

  • Fast (self) Deployment: UPC is a light weight system which allowed for PoC deployment in a couple of days
  • Open System: UPC supports both KVM and VMware which gives Voiceworks a choice for the hypervisor
  • Cost Effective: UPC is attractively priced for smaller operators which creates a new mobile market
  • Private APN: this creates a complete new service for the Voiceworks resellers
  • Proven technology: UPC runs the same proven software that is deployed in more than 70 operators worldwide.

Authors

Jim O'Leary

Sr. Manager Mobile Solutions Marketing

Avatar

In early February, a group of healthcare CXOs and innovation leaders toured a set of iconic US hospital innovation labs and healthcare innovation centres. Their aim was to study innovation process in the US and gather learnings appropriate for application in Australian and New Zealand (ANZ) healthcare communities. The facilities visited included:

  • Mass General Healthcare Transformation Lab
  • Pulse@Challenge
  • MIT Hacking Medicine
  • Institute for Healthcare Improvement
  • Johns Hopkins (Sibley Innovation Hub)
  • Johns Hopkins Technology Innovation Center
  • UNC

These insights, together with the work done by Cisco on innovation infrastructure in ANZ, formed the material for a three-hour roundtable conversation at Cisco Live 2017 in Melbourne. The event brought together 25 CXO’s from around Australia to discuss drivers of healthcare innovation in ANZ and what can be done to accelerate these processes.

The key takeaways from the roundtable were:

  • Healthcare is increasingly challenged by constrained budgets, rising expectations and growing complexity of care. Innovation is a critical lever to drive improvements to healthcare.
  • Innovation models need to be tailored to the specific organisational and broader context
  • While there are numerous innovation models, all share a common set of underlying requirements including access to information and the capacity to distil needs, barriers, ideas and solutions.
  • One of the most fundamental challenges in hospital innovation relates to poor coupling between clinical process innovation and information technology innovation. This causes inefficiency and risk.
  • Clarity about the role and status of digital information infrastructure is fundamental in improving innovation. The infrastructure maturity model is a tool for diagnosing and improving this.
  • There is interest in creating a community and collaboration around this subject – anchored by an emergent dataset (aggregated results of the IMM) and using a new co-creation platform.

To find out more, read the full roundtable report.

Authors

Brendan Lovelock

Health Practice Lead

Cisco Australia

Avatar

You often hear that one of the top reasons Cisco employees love coming to work is our people. The people are, to our core, the heartbeat of Cisco. From the individual personalities that fill the wide open, brightly lit offices to those authentic co-workers who never pass up an opportunity to stop in the inviting coffee areas on their way to the leading tech equipped conference rooms – our people bring life to what we do.

It is no different here in Lisbon, Portugal – our team simply makes coming to the office something we look forward to daily as we all seek to innovate and change the world

What drives this kind of environment that embraces you the moment you enter it? I can only speak from my own experiences.

I am a passionate photographer. It is something I love to do, but – of course – it is not part of my role here at Cisco. Or is it? I started to take pictures of my colleagues for their Linked in profiles as I wanted them to have nice, strong representations of who they are, and soon after that I was photographing all kinds of events here for our offices in Lisbon. From #FridayFeeling to helping our teams share why they #LoveWhereYouWork – suddenly, my personal passion for photography and my role here at Cisco began to blend.

Through Cisco, and our @WeAreCisco social media accounts that help to tell our employee stories, I was encouraged and empowered to continue bringing one of my highest passions of photography into the workplace.  And because of this, I have been able to connect with other teams – onsite and worldwide! – which has helped to grow my network and connections with others! This has enriched my work experience even further and I feel I am not just part of my core team, but also the larger Cisco team as I help to share our experiences through imagery.

For this post, I wanted to dig deeper still.  So, I asked some of my colleagues what they feel is special about Cisco, about our hub in Lisbon, and what drives them in telling the world why they #LoveWhereYouWork.

 

Stefina Goorhuis, Working Team Lead – Virtual Partner Account Manager

Actually money is not the reason I am staying here, it is the people, the vibe, and the good feeling I have when coming to work. After so many years, many of these colleagues became friends! Hence, I am excited to come to work and see them again. On top of having a role I really enjoy, interacting with partners, and seeing I make a difference in their company is totally why I love working for Cisco.

 

Sara Valentim, Virtual Line Manager

”We have an open space here at our office where we share knowledge and some fun moments during our day. Our office is close to nice gardens and the beach, which allows us to organize great activities like picnics during lunch and hanging out after work due to our great weather and proximity to these locations in Lisbon. ”

Danila Pesacane – Virtual Partner Account Manager for Italy

“Keep calm, listen carefully, and treasure every word. Immerse yourself entirely in your job role and know that you can learn a lot by facing the challenges you come across directly. The help of the Cisco Partners’ experience is always available too. Love what you do – we do!”

 

In the spirit of collaboration and accepting new challenges, some of the virtual teams based in Lisbon, took on the #LoveWhereYouWork contest wholeheartedly and came up with some brilliant ideas. My own team, of course, was easy to convince – they already had their own ideas about what they wanted to convey. Other teams were really creative as well – one team even did a photo shoot on Cisco’s rooftop to try a brand new, never used location.

For so many, the diversity of people around the office, the human factor in a corporate world, and being part of  company that celebrates humanity and embraces our differences is invaluable. This work frame offers the opportunity to meet and develop healthy, actual human working relationships, while sharing your own values, skills, and knowledge. We learn from each other here at Cisco – and because of this, we grow together too!

At Cisco, our culture allows us to be human. Instead of being told to leave the parts of us that don’t apply to our jobs at the office door, Cisco embraces us entirely – from our families and hobbies to passions and skills we’re hoping to learn and grow. Cisco embraces the atmosphere of wholeness and integrates other talents, skills, and knowledge beyond ones job role capabilities. If you don’t know something, but want to learn more – Cisco enables that to happen, and because of their dedication to employees being their authentic selves – you feel you can become even MORE yourself.


Be you, with us! We’re hiring – apply now!

 

Authors

Mariana Sennfelt

Working Team Lead – EMEAR Lead Development Representatives & LDR for DACH

Global Customer Marketing Engagement

Avatar

With 95 percent of breaches starting with a malicious email campaign, it’s more important than ever for organizations to be prepared and to be certain that their email security solution will truly protect their data, assets and users.

In a recent blog post we discussed the need for advanced threat protection at the email gateway and the smartest and safest way to approach email security.  In this blog post we’ll take a look under the hood and examine Cisco’s solution for protecting from today’s stealthy email attacks: Cisco AMP for Email.

Let’s start with an example: The HR department at Acme, Co. gets an email from a potential employee with a resume attached. No problem, right? HR receives messages like this regularly, so they open the attachment. However, the attachment contains an executable file that downloads malware in the background. The malware begins to harvest information: passwords, credentials, and company access authorizations have all been compromised and unknowingly gave hackers the ability to steal sensitive company and customer information. These kinds of scenarios are happening every day, so how are you supposed to determine which attachments are real and which ones are malicious? What do you do if a malicious email evades your front line defenses?

So how could Cisco AMP for Email help the HR team at Acme? Cisco Email Security offers multiple layers of protection to block email-based threats. This includes blocking emails from senders with bad reputations, anti-spam engines, anti-virus scanning, AMP and others. Everything that isn’t caught by anti-spam is processed through multiple anti-virus engines that protect against known and emerging threats. For more advanced threats, Cisco Advanced Malware Protection performs additional automated analysis using Cisco threat intelligence.

You may ask yourself, why invest in AMP on Email, if the solution already provides anti-virus scanning with engines from multiple security vendors? The answer to this is simple: most AV tools perform signature-based detection, which means if a piece of malware was specifically crafted to invade your organization and consecutively not yet known to AV vendor – it can be easily bypassed by bad actors. While AV engines will still catch a subset of known threats, we need to ensure protection against more sophisticated or even targeted attacks. AMP for Email adds an additional layer of valuable defense by combining point-in-time detection with continuous analysis. One example of efficacy improvement was observed by Cisco’s own IT department – after enabling AMP functionality on ESA, the overall malware catch rate was improved by approximately 50%. That’s due to the fact that around 31% of encountered malware attacks were zero-day threats blocked by AMP.

AMP for ESA doesn’t just improve your initial blocking and detection. AMP takes your ESA to the next level by continuously tracking disposition changes for files that have crossed your email gateway, being initially classified as clean. If malicious behavior is spotted down the line, AMP sends a retrospective alert allowing you to investigate, contain and remediate the malware.

So how does AMP for Email do it? Let’s now look under the hood.

  • Global threat intelligence from Cisco Talos – security starts with strengthening your defenses using the best global threat intelligence so you can block malware as new threats emerge. Cisco’s team of threat researchers continuously feed threat intelligence into AMP services.
  • File Reputation Lookup – ESA calculates SHA256 hash of the attachment and queries the file reputation service. The service responds with a verdict, either clean, malicious or unknown. Based on the verdict, an action can be taken accordingly – either to deliver, block or quarantine a message. For executable files, ESA also uses machine-learning based technology, that identifies unknown threats using active heuristics to gather execution attributes and produce a Spero fingerprint, which is sent to the service to determine probability of a file being malware.
  • File Analysis – for files with unknown verdict or those that were not seen at all, ESA performs an additional layer of inspection by sending an attachment to Threat Grid, Cisco’s advanced sandboxing solution. While analysis is performed, the message is typically quarantined and not delivered to end user. Threat Grid performs automatic static and dynamic analysis, producing human readable behaviour indicators for each file submitted as well as a threat score. Before an unknown file is submitted the pre-classification engine scans it to select only files with suspicious content (embedded macros, exes, flash, etc), reducing the need to quarantine emails containing benign file attachments.
  • File Analysis Quarantine – a differentiating capability of AMP on ESA, when compared to other AMP integrations, is the ability to hold a message, while the attachment is analysed by Threat Grid and before we ensure if it’s malicious. The average analysis time is 7 to 15 minutes and based on the analysis results, ESA can either release a message to the recipient, release a message without malicious attachment or remove the message completely.
  • Mailbox Auto Remediation – if a file is not detected as malicious the first time through the gateway, but is later determined to be malicious, a retrospective event is generated. Microsoft Office 365 allows the ESA to reach in and quarantine the message with malicious attachment from the mailbox. At the time of this writing, without O365, the ESA will alert the administrator of a file that was delivered to a user.

Still asking yourself if that’s really worth to invest in AMP on ESA? Consider the results of a recent trial – in two weeks of AMP evaluation in an organization with 25,000 email users, there were roughly 195,000 files extracted from emails for analysis. Out of those more than 1200 were convicted and dropped by AMP, meaning those files were not known to the AV engines running on ESA. At least 18 files were dropped due to ESA convicting a file based on Threat Grid sandboxing results, preventing malware from ever getting to the end user inbox. Cisco AMP for Email is a critical first step that helps protect your organization from the number one attack vector.


For more information:

 

Authors

Evgeny Mirolyubov

Technical Marketing Engineer, Advanced Threats Solutions at Security Business Group