Year: 2017

March 23, 2017 Leave a Comment
Avatar

How Malformed RTF Defeats Security Engines

This post is authored by Paul Rascagneres with contributions from Alex McDonnell

Executive Summary

Talos has discovered a new spam campaign used to infect targets with the well known  Loki Bot stealer. The infection vector is an RTF document abusing an old exploit (CVE-2012-1856), however the most interesting part is the effort put into the generation of the RTF. The document contains several malformations designed to defeat security engines and parsers. The attacker has gone out of their way to attempt to evade content inspection devices like AV or network security devices. According to VirusTotal, the initial detection rate of a malicious RTF document recovered from a recent spam campaign is only 3 out of 45 available engines.

Read More >>

Authors

Avatar

Talos Group

Talos Security Intelligence & Research Group

Leave a Comment
Avatar

What Kept Me Going

I got asked a lot of questions after my last blog post, How I Found My Cisco Family. The most popular seemed to be, “What kept you going?”

And every time I heard those words I would have to pause and wonder…could it really be just one thing?

Yes, my life was difficult. My mother was a drug addict, who spent years of my young life in jail. My father was a man who had never dealt with his demons, and wound up taking that out on me. By the age of 16, after being kicked out by my mother, I was on my own.

There are a lot of ways life could have gone for me. At a time in life where most are still coming of age, I quickly had to become an adult. I walked to work at a restaurant, where I also ate my meals because I could afford nothing else, and would attend night classes to finish my high school education. I did this until I was 18.

I’m not entirely sure what makes one a survivor. But, for me, at an early age I knew my life was different. I simply knew that there was more out there for me than the life I had led up to that point, and that alone – on many days – kept me going.

How did I get from there to here though – at age 26 and working for Cisco, the best tech company ever? I had to tell myself a couple different things:

1.It’s OK to not be OK. Whatever challenge you face – whether it’s a family crisis, a health crisis or a financial one – you will at times feel absolutely helpless. That is normal, and it is okay.

You have to have faith that the tough times will pass. You will be tested, and there will be moments where you may think it will be easier to quit, but I can’t stress how important it is that you don’t.  Just. Keep. Going. You have to have courage to face struggles you encounter head on. Do not give up on yourself, ever

If people put you down or tell you that you’ll never amount to anything, PROVE THEM WRONG. I encountered this so many times in my life. Every time someone told me no, or that I wasn’t good enough – it made me more and more hungry to show them who I really am, and that I was going to do bigger and better things – that their comments were not going to stop me.

And now here I am – a woman in tech at a fortune 500 company!

2.Enlist in your friends. I wouldn’t be half the person I am today without the people that I have surrounded myself with. It is a choice to select positive influences. Choose those who will rally around you and support you – over those that only promote negativity, and people who will take very opportunity to suck the joy out of you.

I’ve tried to take a little perspective from each person I’ve encountered. This helps me to have a different approach to each problem I face, and ensures that I have more understanding and compassion to those I meet along the way. Your tribe is your family, and family sometimes goes beyond blood. That is why my Cisco family means so much to me.

3.Don’t be scared to be honest about who you are, and where your journey brought you. This one was really hard for me as I spent most of my young adult years being ashamed of who I was and what I had gone through. I would consistently feel like I couldn’t “hang” with some people because they were better or more affluent than me, or that I didn’t deserve to have a job at Cisco because, “Why would Cisco hire me?”

But, you know what? I was wrong.

Cisco values people like me because I add to the fabric of our culture, and Cisco thrives on adding people to our We Are Cisco tribe that come from all backgrounds. This just enhances our ability to innovate and change the world.

Once I came to terms with the fact that I fought tooth and nail to be where I am it allowed me to realize I wouldn’t dare take it for granted. I earned everything that I have accomplished, and working for Cisco is no different. Cisco allows me to keep defying odds, and I love being able to have that opportunity.

I am proud to be here. I am proud to be #WeAreCisco.

 

Want to join our #WeAreCisco Tribe? We’re hiring!

Authors

Avatar

Monica Naim

Collaboration Regional Leader

1 Comment
Avatar

Payment Processor Secures Global Network with Stealthwatch

Elavon is the fourth-largest payment processing company in the world. They process more than 3 billion transactions annually, worth more than $300 billion. Elavon has more than a million customers and is a leading payment solutions provider for airlines and a top five provider for hospitality, healthcare, and retail.

With a globally distributed network that handles highly valuable data, Elavon places a high priority on securing and monitoring their environment. To help achieve this, they rely on Cisco Stealthwatch for network visibility, continuous threat detection, and quicker response times.

https://youtu.be/_4PVf0BJkds

Stealthwatch has helped Elavon achieve the following:

Network visibility

A top priority of Elavon’s was gaining an understanding of traffic patterns on the company network, including the ability to monitor traffic in real-time and to investigate past network activity. This allows the company to quickly identify anomalous and malicious behavior that could help identify and mitigate an attack before damage is done.

Stealthwatch utilizes Elavon’s existing Cisco network for data by collecting NetFlow, a context-rich and common source of network traffic metadata, from infrastructure devices such as routers, switches, and firewalls. For every transaction, Stealthwatch allows them to see:

  • Sender and receiver IP address
  • Sender and receiver port number
  • Time
  • Duration
  • Bytes transferred

In addition, Elavon uses Cisco Identity Services Engine (ISE), which has a long-standing integration with Stealthwatch. ISE attaches user and device identity information to each transaction, providing a greater depth of visibility.

Threat detection and response

Elavon uses Stealthwatch as an early warning system for threat activity. According to Phil Agcaoili, Chief Information Security Officer at Elavon, one of the top benefits of Stealthwatch is its ability to monitor the network and detect threat activity when security personnel can’t.

As Stealthwatch collects NetFlow, it builds a baseline of normal network behavior. When a host displays behavior that exceeds thresholds of expected behavior, Stealthwatch alerts security operators to the anomalous traffic. For instance, when a host in marketing normally accesses only a few megabytes of network resources a day but suddenly collects gigabytes of data from a sensitive engineering database, it could be a sign of data hoarding in preparation for exfiltration. Detecting this behavior early allows security personnel to respond and mitigate the threat before damage is done.

Stealthwatch also helps facilitate faster response to security incidents. Stealthwatch’s historical and real-time traffic data allows investigators to quickly grasp what is happening and trace it back to a source. Integration with Cisco ISE further speeds the process by attributing the traffic to a specific user and device.

Elavon’s network operations team also uses Stealthwatch to help diagnose network performance problems. For example, Stealthwatch can quickly identify spikes in network traffic, which could the result of a security issue or network performance problem. Elavon can then quickly investigate to determine the source and respond to the problem.

Stealthwatch helps secures Elavon’s global network

The cybersecurity organization at Elavon has aspired to be world-class, and ensuring the safety of their customers and their data is a top priority. To help achieve this goal, they rely on the network visibility, real-time situational awareness, and threat detection of Stealthwatch. Cisco has been a critical partner in bringing Elavon’s security vision to reality.

For more information on how Stealthwatch can help you protect your network, click here.

Authors

Avatar

Jody Ma Kissling

Security Marketing Executive, Stealthwatch

2 Comments
Avatar

How Can IoT Accelerate Digital Transformation?

Digital Transformation will be in full swing before you know it. By digitizing the most important assets through the Internet of Things (IoT), companies can dramatically grow their business, increase operational efficiency, and deliver exciting customer experiences. No wonder, IoT is predicted to be one of the most important factors impacting business fundamentals in the coming decades.

But how do you align your business requirements with IT? What about operations? Security? Considering the huge potential and complexity of IoT as a tool for Digital Transformation, it takes experience, an ecosystem, and the right network to accelerate time to value.Plenty to ponder on. Let’s chat on Wed, April 5th at 11AM PST about benefits and obstacles on the way to digitization through IoT.

To participate in the #Ciscochat:

  • Make sure you’re logged into your Twitter account.
  • Follow @CiscoServices and @Cisco_IoT on Twitter.
  • Search for the #CiscoChat hashtag and click on the Latest tab.
  • Add to the conversation by using the #CiscoChat hashtag in your tweets. This way, others can find your contributions to the discussion.
  • When replying to specific participants, add a “.” at the beginning of the tweet so your question or comment will appear in your public twitter feed.
  • If you need multiple tweets to answer a question, preface each tweet with “1A,” “2A,” etc. This will make it easier for others to follow along with the conversation.

Welcome introductions and questions will begin at 11am PST. Don’t forget to bring your own questions to the discussion, too. See you there!

 

Authors

Avatar

Srinivas Hanabe

Director, Enterprise PSM

Enterprise Networking and Mobility

March 22, 2017 2 Comments
Avatar

Network Automation Fuels Scientific Innovation and Discovery

Written with Mara Fowler, Cisco Customer Stories

Over the past several centuries, significant scientific discoveries have fueled the rise of modern medicine.  Researchers like Pasteur, Fleming, and Salk identified groundbreaking medical treatments that saved untold numbers of lives.  During this time of medical innovation, Chemical Abstracts, which would later become Chemical Abstracts Service (CAS), now an important division of the American Chemical Society (ACS), was established.

With its exceptional scope of scientific information, CAS is the gold standard for providing the research solutions behind thousands of science experiments and medical cures. CAS collects, analyzes and shares chemical data with researchers around the world, which fuels scientific innovation and new drug paradigms.  This indispensable information, taken from a wide range of scientific journals, patent authorities, and regulatory agencies, is stored in multiple databases and needs to be available on demand. This is critical as CAS’s customers need instant access to accurate, secure scientific data in order to develop tomorrow’s breakthroughs and patents.

However, managing the network traffic for this vast trove of vital information became increasingly difficult for CAS.  Saddled with the low-level, manual tasks required to support a traditional network, CAS engineers were challenged to meet increasing demands to deploy solutions with agility and speed.   The organization needed to transform itself to be able to rapidly and securely deliver solutions through the use of automation.  To accomplish this, CAS turned to Cisco’s SDN solution, Cisco Application Centric Infrastructure (ACI).

By incorporating Cisco’s ACI solution and streamlining its network infrastructure into an application-based policy, CAS increased its network bandwidth throughput by a factor of four. Time-consuming tasks like resource provisioning were automated with ACI. This allowed engineers to focus on higher-level projects, such as building out its cloud environment which will drive its business forward.  In addition, the solution allows for a data center that’s secure, yet flexible enough to manage the future growth of CAS’s chemical content and its corresponding demand.

This increased operational efficiency has allowed CAS to focus on the things that matter; in this case organizing millions of pieces of scientific data and ensuring researchers have access to it. Through network automation and a digital foundation built with Cisco, CAS can bring new research solutions to market and tap into new areas of scientific discovery.  Pairing Cisco technology with CAS’s research solutions is paving the way for the next groundbreaking scientific discovery; the next cure for a disease; the next medical revolution.  There’s never been a better time to save a life.

To learn more about Cisco ACI, go here, or how it helped CAS, go here.

Authors

Avatar

Christina Grenier

No Longer with Cisco

Leave a Comment
Avatar

Cisco at IWCE 2017

IWCE (International Wireless Communications Expo) 2017 will be held at the Las Vegas Convention Center from March 27-31. Cisco will be at the event, alongside our partners.

We will provide several presentations and participate on multiple panel discussions while at the event. We’ll discuss topics such as cybersecurity, IOT, Smarter Cities Infrastructure, and new developments in wireless communications solutions using private and public networks that are now available to government and enterprise customers.

Cisco will also have a presence in the Exhibition Hall where we will showcase new mission and business critical voice solutions for next-generation instant communications using Cisco Spark with live incident collaboration and Cisco Instant Connect that are now available to government and enterprise customers.

Cisco Spark is a complete business collaboration service from the Cisco cloud that enables messaging, meeting, or calling anyone, anywhere, and anytime.

Cisco Instant Connect delivers secure, reliable communications with a full-featured push-to-talk (PTT) user experience, including enhanced capabilities beyond two-way PTT mobile radio handsets.  Also, Cisco can migrate customers to Mission Critical PTT (MCPTT). Public safety users can get packet priority on the carrier or Firstnet LTE network. Learn more here.

Cisco’s software solution, in conjunction with our partner Etherstack, provides public safety, utilities, and industrial customers with integrated best of breed interoperable broadband technologies if you are looking to migrate from end-of-life land mobile radio (LMR) systems into a fully-open, secure converged network supporting voice and data needs today and into the future.

As a supporter of public safety mobile vehicles, Cisco is featuring our model 829 Industrial Integrated Services Router featured in the Exhibit Hall. The Cisco 829 router, designed with a compact footprint and for harsh environments, provides highly secure, reliable, and easy-to-manage 3G/4G LTE WAN cellular and Wireless LAN connectivity in mobile situations.

If you are in attendance, be sure to stop by booth 1649 to see Cisco’s leading mission and business critical collaboration technologies and meet Cisco executives.

 

Authors

Avatar

AJ Ramsey

Global Industries Marketing Lead

GMCC-Services Marketing

Leave a Comment
Avatar

Smart manufacturing: when factories go digital

I dedicate time daily to read up on manufacturing technology and trends across many sectors of the industry. Usually I focus this time on reading blogs, industry articles, and reports that I’ve subscribed to or bookmarked over the years.

On occasion I attend industry events which allows me to talk with industry peers, attend sessions, and get some face time with industry analysts. This is one of my favorite exercises as I get real-time feedback on what’s currently going on with colleagues who are focused on the journey toward smart manufacturing.

Recently, I attended the IDC Directions event in Santa Clara with other industry peers to uncover the latest in digital economy and how it’s impacting a wide range of topics including:

  • How are companies investing in IoT and what are the outcomes they’re trying to achieve?
  • What kind of technology architectures are driving how the IoT will be deployed and utilized?
  • How is IoT changing business landscapes and what does that mean for companies and their offerings to customers?

I wrote up a full article on the conference that you can find here. I’m curious what you think about the trends that IDC discussed at the conference. Are they in line with how you’re approaching IoT? What digital trends are you seeing with your customers? Feel free to drop me a note in the comments section below.

 

 

Authors

Avatar

Eric Ehlers

No Longer at Cisco

Leave a Comment
Avatar

Vulnerability Spotlight: Code Execution Vulnerability in LabVIEW

Overview

LabVIEW is a system design and development platform released by National Instruments. The software is widely used to create applications for data acquisition, instrument control and industrial automation. Talos is disclosing the presence of a code execution vulnerability and a memory corruption vulnerability which can be triggered by opening specially crafted VI files, the proprietary file format used by LabVIEW.

Read More>>

Authors

Avatar

Talos Group

Talos Security Intelligence & Research Group

Leave a Comment
Avatar

Wondering who will speak at the OpenStack Summit?

A couple weeks ago I posted about the OpenStack Summit speaker selection process. I shared an interview with one of the track chairs, Gary Kevorkian. I speculated about how much or how little the voting process impacts the choices the organizers make. And I shared a list of talks submitted by my Cisco colleagues.

This is the follow-up to that post.

Don’t get too excited–I don’t have any more juicy tidbits from Gary about how the talks are chosen. I’m pretty sure he gave me all he’s got (or all he’s going to give) on that topic.

I do however have a list of the Cisco talks that were chosen. So if you took the time to vote and you’ve been wondering how it all shook out, please take a moment to look at the results below.

Oddly, if you voted for any of our talks about networking you were in the minority. Most of those didn’t make the cut this time. But if you wanted to hear us speak about strategy or security, you’re in luck. We got a number of talks accepted in each of those categories, and we’re thrilled about that. We know some people in the OpenStack community eyed Cisco with a bit of suspicion in the beginning, wondering what it was we wanted with your software project, and whether we were really just hanging out trying to sell boxes.

So we understood when you weren’t all that interested in what we had to say on non-networking issues. And we appreciated that in spite of whatever suspicions you may have been harboring, you still trusted our networking know-how enough to vote us up on stage to speak about that on a pretty regular basis.

But now…now we feel like we’ve graduated (or at least we’re graduating). Now we’re getting to speak on a much broader range of issues that we’re passionate about: securing the cloud, embracing digital transformation, designing cloud-native apps, leveraging containers effectively, and closing the gap between what users are asking for and IT is able to deliver. So thank you for voting–and for your interest in what we have to say. We can’t wait to share what we’ve got, hear what you’ve got, and walk out of that summit better equipped than ever to deliver powerful, simple, user-friendly cloud solutions to the business world.

See you there!

Architectural Decisions

Designing Cloud Native Apps – Deep Dive, CB Anantha Padmanabhan, Meenakshi Sundaram Lakshmanan, Rahul Upadhye

Architecture and Operations – Networking

Securing OpenStack Networking, Naveen Joy

Architecture and Operations – Ops Tools

Kolla-Kubernetes: Day 2 Operations Enable Sleep Optimization, Pete Birley (independent), Serguei Bezverkhi, Steve Wilkerson (AT&T)

Business and Strategy

Panel from the Trenches: Will Containers Save Us?, Christopher MacGown, Forrest Carpenter, Jonathan LaCour (DreamHost), Ben Cherian (InkTank Storage), Jesse Proudman (IBM Blue Box)

CIO Cloud Strategy

OpenStack’s Digital Transformation Opportunity, Niki Acosta (moderator), Kip Compton, Tim Yeaton (Red Hat), Al Sadowski (451 Research)

Community Building – Business and Strategy

Finding the Balance between Open Source and Proprietary Work, Dave McCowan, Douglas Mendizábal (Rackspace), Christopher Solis (IBM), Fernando Diaz

The Evolution of the User Group: Facilitating OpenStack Adoption, Gary Kevorkian, Lisa-Marie Namphy (OpenStack Bay Area Meetup), Beth Cohen (Verizon), John Studarus (OpenStack San Diego Meetup)

Community Building – Developers 

OpenStack Mentoring: The Ninja Becomes the Sensei, Emily Hugenbruch (IBM), Anne McCormick, Amrith Kumar (Tesora), Trevor McCasland (AT&T), Chirag Shahani (Nuage Networks)

Developers – Big Data

Using OpenStack Orchestration for Big Data Workloads, Hart Hoover

Evaluating OpenStack

Enterprise Cloud Offering Models and Service Strategies, Robert Douglas, Istvan Blasko

Hands-on Workshop

Barbican Workshop – Securing the Cloud, Dave McCowan, Douglas Mendizábal (Rackspace), Ade Lee (Red Hat), Kaitlin Far (JH-APL), Fernando Diaz

Lightning Talks

Advanced Threat Prediction and Orchestration for Service Chains in SP Cloud, Aman Sinha, CB Anantha Padmanabhan, Rahul Upadhyaya

Networking

FWaaS v2 – A New Beginning, Sridar Kandaswamy, Yushiro Furukawa (Fujitsu Ltd.), Chandan Dutta Chowdhury (Juniper Networks)

Project Updates

Project Update – Barbican, Dave McCowan, Douglas Mendizábal (Rackspace), Kaitlin Farr (Johns Hopkins)

Project Update – Horizon, Rob Cresswell, Richard Jones (Red Hat)

Project Update – Kolla, Steven Dake

Security

Comparing the Barbican and Vault Security Models, Dave McCowan, Douglas Mendizábal (Rackspace)

Authors

Avatar

Ali Amagasu

Marketing Communications Manager