Year: 2017

July 18, 2017 3 Comments
Avatar

The Official Talos Guide to BlackHat 2017

It is once again time for Security Summer Camp – the week in July that many of us descend upon Las Vegas for Black Hat and DEFCON. This is your official guide to what Cisco’s Talos Threat Intelligence team is doing at Black Hat 2017.

Whether you are looking to catch some great talks, hunting down the best parties, or just trying to avoid LineCon in all it’s forms, here is a quick run-down of where and how you can catch Talos speakers, Cisco events, and some fun stuff from other teams within Cisco as well.  Read on for the full details of what Cisco has in store for this year!

Event At-A-Glance:

Event microsite: http://demand.cisco.com/CiscoBlackHat2017
Black Hat USA website: blackhat.com/us-17
Chat with us: @CiscoSecurity and @TalosSecurity
Booth: #700 – Snorty pigs, t-shirts, and amazing booth talks by the Talos crew and Cisco Security
Also visit: Cisco Cloud Security @ booth #240
Cisco Party / Talos VIP party: Private event at Heart of Omnia – Register early!

Wed. July 26

Talos Session – The Evolution of Threat Propagation Techniques- Craig Williams 3:00-3:50 p.m. Business Hall Theater B (on show floor)
Talos Flash Talks: 10:00am- 7:00pm, Cisco Booth #700 – Full schedule below
Career Zone: 10:00am- 7:00pm, Black Hat Business Hall, Booth CZ2
Cisco Black Hat Party: 8:00pm, Heart of Omnia, Caesar’s Palace – Register early!
(Bonus: Get your Beers with Talos Podcast swag, available exclusively at the party!)

Thurs. July 27

Talos Session – Evolutionary Kernel Fuzzing – Rich Johnson 2:30 -3:20 p.m. Lagoon ABCGHI
Flash Talks: 10:00am- 5:00pm, Cisco Booth #700 – Full schedule below
Career Zone: 10:00am- 5:00pm, Black Hat Business Hall, Booth CZ2

The Details:

Cisco Party:

Wed. July 26, 8:00pm Heart of Omnia, Caesar’s Palace

Omnia Terrace

Join Cisco and the Talos team at the Heart of Omnia at Caesar’s Palace.

You will enjoy music, open bar, great food, and entertainment. Black Hat badge required for general admission entry.  Unwind, have fun with your peers and the Talos team!  We will be giving out an exclusive Beers with Talos podcast t-shirt as well.  Talos VIP attendees will be treated to some additional perks once inside, this party WILL be full, so register early!

The Evolution of Threat Propagation Techniques:

Wed. July 26, 3:00 – 3:50 p.m. Business Hall Theater B (on show floor)

Craig Williams Talos
Craig Williams, Talos Outreach

Join Talos Outreach Senior Manager Craig Williams on a journey through the evolution of todays threat landscape.  He will be covering specific insights on the latest techniques used by threats we have seen in recent weeks like Nyetya/NotPetya, WannaCry, and more.

The challenge with malware isn’t writing the malware itself but the ability to get the malicious software onto end systems. Every attacker struggles with this problem – “how do I get this malware on more end hosts?” Newer payloads like ransomware ensure attackers are making more money than ever before. As long as businesses continue to pay, this threat will increase, that’s basic economics.

This increase in cash flow drives the evolution of threats and propagation techniques like never before. In this talk we will discuss the evolution     of these techniques and how to defend against them.

Evolutionary Kernel Fuzzing:

Thurs. July 27 at 2:30 – 3:20 Lagoon ABCGHI

The modern model of vulnerability mitigation includes robust sandboxing and usermode privilege separation to contain inevitable flaws in the design and implementation of software. As adoption of containment technology spreads to browsers and other software, we see the value of exploits continue to rise as multiple vulnerabilities must be chained together with extreme levels of binary artistry to achieve full system control. As such, there has recently been a high demand to identify kernel vulnerabilities that can bypass sandboxes and process isolation to successfully achieve full system compromise.

With this heightened demand, the past few years has seen a massive first wave of kernel vulnerability discovery in the graphics layer of the Windows kernel and the peripheral drivers of the Linux kernel. This first wave has proven successful even though the methods utilized tend to be using more rudimentary techniques of dumb mutational fuzzing or manual code review. This is a good indicator that it is time for investment in more advanced techniques that can be applied to kernel vulnerability research such as evolutionary fuzzing guided by code coverage.

This lecture will discuss methods for applying evolutionary coverage guided fuzzing to kernel system calls, IOCTLS, and other low level interfaces. First, to understand what makes an effective guided kernel fuzzer, we will discuss the tools available for open source drivers and kernels such as trinity and syzkaller which have found hundreds of vulnerabilities in the Linux kernel. Next we will look at using system emulators like QEMU for instrumenting kernel interfaces with code coverage to gain an understanding of the performance and limitations of this approach. Finally we will leverage our own custom driver to enable hardware branch tracing with Intel Processor Trace as a new method for evolutionary fuzzing against unmodified kernel binaries on Linux and Windows. The driver enabling this approach on Windows is authored by the presenter and available to the security community as opensource. This will be the first public lecture showing how to use highly performant modern hardware tracing engines to enable closed source kernel vulnerability research using coverage guided fuzzing.

Cisco Booth Lightning Talks:

Wed. July 26, 10:00am–7:00pm
Thurs. July 27, 10:00am– 5:00pm
Cisco Booth #700

IMG_2064On the full schedule, we have 18 NEW talks from Talos, and 11 other talks from Umbrella, and Cisco’s Web Security and Services teams! You won’t want to miss these sessions. Have a seat and enjoy a 30-minute presentation in Cisco booth 700. Plus, grab some great swag and a t-shirt.

Here is the full schedule of booth talks at the Cisco/Talos booth area (Italics indicates a talk from the Talos team):

Wed July 26 Speaker Title
10:00 – 10:30AM Paul Rascagneres Player 3 Has Entered the Game: Say Hello to ‘WannaCry’
10:30 – 11:00AM Jaeson Schultz The Dark Side of the DNS
11:00 – 11:30AM Regina Wilson Vulnerability Disclosure Policy
11:30AM – 12:00 Richard Harman Internet Of Crap: Spelunking in Security Camera Firmware
12:00 – 12:30PM Earl Carter The Evolution of Malware Distribution
12:30 – 1:00PM Scott Bower Advanced Email Security – Combatting Today’s Blended Threats
1:00 – 1:30PM George Tarnovsky X-Ray Reverse Engineering
1:30 – 2:00PM Ronnie Flathers How I owned your Windows domain with “Informational Findings” and what you can do about it
2:00 – 2:30PM Sam Dytrych Analysis of Video Game DRM Bypass
2:30 – 3:00PM Kevin Parra Midyear Security Report
3:00 – 3:30PM Keti Kilcrease Learn by Doing- Segment Your Network with Software Defined Segmentation
3:30 – 4:00PM Alec Gleason Static Files in the Modern Web Age
4:00 – 4:30PM Nick Biasini Exploit Kits Are Dead, Long Live Exploit Kits
4:30 – 5:00PM Jaime Filson Images, not just for memes
5:00 – 5:30PM Brandon Stultz Protecting Networks with FirePOWER
5:30 – 6:00PM Patrick Mullen From Vaporware to Alpha – Snort 3.0!
6:00 – 6:30PM Vanja Svajcer Modified Zyklon and plugins from India
6:30 – 7:00PM Brian Ford Packet Capture for Incident Investigation and Response
Thurs July 27 Speaker Title
10:00 – 10:30AM Kevin Parra Midyear Security Report
10:30 – 11:00AM Earl Carter The Evolution of Malware Distribution
11:00 – 11:30AM Vanja Svajcer Nyetya Attack: Latest Updates
11:30AM – 12:00 Patrick Martin Talos Crete
12:00 – 12:30PM Nick Biasini Exploit Kits Are Dead, Long Live Exploit Kits
12:30 – 1:00PM Jaeson Schultz The Dark Side of the DNS
1:00 – 1:30PM Paul Rascagneres Player 3 Has Entered the Game: Say Hello to ‘WannaCry’
1:30 – 2:00PM Warren Mercer Introducing ROKRAT
2:00 – 2:30PM David Maynor Talos Interdiction: MeDoc and the Ukraine
2:30 – 3:00PM Atheana Altayyar The Anatomy of an Attack
3:00 – 3:30PM Kristyanne Patullo Preventing Tomorrow’s Attacks using Cisco Umbrella
3:30 – 4:00PM Brian Ford Finding Malware in Encrypted Connections Using Encrypted Traffic Analytics
4:00 – 4:30PM Andrew Akers Accelerated Response with Network Visibility and Enforcement
4:30 – 5:00PM Kevin Parra Midyear Security Report


Career Zone:

Wed. July 26 – Thurs. July 27
Black Hat Business Hall, Booth CZ2

now-hiringInterested joining the best threat intelligence team in the business? Talos is looking for the best, brightest, and most promising in the threat research and intelligence areas to join one of the largest teams in the industry. If you have the talent and a passion for threat research, malware hunting, interdiction, vuln dev, linguistics, reversing, machine learning, etc.,  we want to talk with you. Find us in the Career Zone at Black Hat and introduce yourself – you may even get an invite to some private events to meet more of the team – not to mention the best job you’ve ever had.

Friendly Reminders:

There are lots of things you should know before heading to Black Hat and DEFCON. Here’s a quick list of things to absolutely remember:

  • Business cards
  • Spare juice packs – nothing drains devices like a conference, although turning off Bluetooth and wi-fi radios helps and may not be a terrible idea at any conference.   If you aren’t charging, you are probably going to have a dead phone by the time the parties start in the evening.
  • Comfortable walking shoes – yes, many venues are connected, but they are connected via LONG walks. Many attendees rack up more than 8-10 miles per day on their pedometers!
  • Space in your suitcase – there is swag-a-plenty and you need to get it home!
  • Water – because it’s the desert.

We are looking forward to meeting and seeing everyone at Black Hat and DEFCON. Be sure to come by booth #700 and say hello …and, of course, pick up a NEW limited edition Snorty pig for your collection!

Staying for DEFCON?

Talos is a proud sponsor of the Packet Hacking Village at DEFCON this year!  Okay, now make sure your Bluetooth and Wi-Fi are off. You know what – just power down.  Also, make sure to join Talos Senior Security Research Engineer Patrick DeSantis for his talk in the DEFCON 101 track and Talos Research Lead Rich Johnson for his talk on kernel fuzzing:

From Box to Backdoor: Using Old School Tools and Techniques to Discover Backdoors in Modern Devices

Thursday at 11:00
DEFCON 101 track

Stringing together the exploitation of several seemingly uninteresting vulnerabilities can be a fun challenge for security researchers, penetration testers, and malicious attackers. This talk follows some of the paths and thought processes that one researcher followed while evaluating the security of several new “out of the box” Industrial Control System (ICS) and Internet of Things (IoT) devices, using a variety of well known exploitation and analysis techniques, and eventually finding undocumented, root-level, and sometimes un-removable, backdoor accounts.

Authors

Avatar

Mitch Neff

2 Comments
Avatar

Surgery Centers, EHRs and Campfire Coffee: Matt’s Story

If you’re like me, the digital shakeups rumbling across industries interest you. And, this curiosity bumps you into examples while just “doing life.”

It even happens while camping with friends.

While sipping campfire coffee around a picnic table, a friend told me about his new position as a hospital purchasing operations manager at an ambulatory surgery center (ASC). Matt’s story started with the hope and excitement that comes with most new jobs, but soon enough, tarnish crept in around the edges.

His experience reflected the challenges and opportunities happening across ASCs, mostly stemming from digital transformation in healthcare. Here’s his story—and some takeaways.

Setting the scene: Shiny possibilities at a surgery center

Matt was eager to start his new position. It offered great potential to apply his extensive experience in large and midsize healthcare organizations, blending knowledge from his past roles as a clinician (heart surgery technician) and a business professional (medical supply sales and consulting).

The start date came and Matt got to work.

With nine operating rooms, his ASC routinely handles 60+ outpatient procedures per day, ranging from ophthalmological to orthopedic operations. Matt manages a broad range of processes that directly affect how the center serves its patients, staff, attending physicians, and physician owners. He plans, orders, and manages an extensive inventory of medical equipment, supplies, and medications. He ensures that everything needed to perform each day’s scheduled procedures is prepared and ready to go—in the right place and at the right time. Fielding staff and clinicians’ complaints when things don’t run smoothly? Yup, this lands with Matt, too.

Challenges arise: Missing medical equipment, Wi-Fi dead zones, and more

As we continued sipping coffee, Matt’s story took a slightly dark turn. “Surprise” procedures routinely materialized on the next day’s schedule, requiring supplies not in inventory. Emergency orders and rush charges mounted. Inspecting, counting, checking (and rechecking) inventory consumed inordinate chunks of time. Searching for missing equipment became routine. Where was that microscope? Who last saw it? The staff communicated via mobile calls and texts, except when Wi-Fi dead zones interfered. These sorts of problems created staff frustration, reduced staff productivity, and increased costs.

Before taking the job, Matt knew his new employer had not adopted an electronic health record (EHR) system. Having previously worked at large hospitals with advanced implementations, he knew that an EHR would solve most of these problems. Even so, it was more difficult than anticipated to excel at his responsibilities—making the ASC click along as he knew it should—with limited digital capabilities to improve patient care or business operations.

Focusing in: Industry-wide EHR Hesitation

Matt’s experience is not unusual. Widespread EHR adoption remains slow among the ASC community. According to OR Manager, an industry association, “Many ASCs are reluctant to move forward for fear of implementations that are non-conducive to an ASC workflow. ASCs do not usually see patients more than once, so EHRs may seem impractical.”1

There may be another factor. When the Centers for Medicare & Medic­aid Services (CMS) began implementing the Patient Protection and Affordable Care Act (ACA), it provided financial incentives for EHR use. However, the agency did not include ASCs. 2

Finding a solution: ASCs and the promise of healthcare digitization

Despite the rationale for holding back, the digitization of ASCs is bound to accelerate. For one thing, the CMS did include physician practices in financial incentive eligibility for EHR adoption. Approximately 87 percent of U.S. office-based physicians use an EHR system.3 And, since physician groups often own or invest in ASCs (as is the case with Matt’s ASC), this will likely spur EHR use.4

Additionally, ASC consoli­dation and acquisition by hospitals may drive surgery centers toward the EHR systems of affiliated hospitals.5

Further, technology pervasiveness across healthcare is significantly affecting and in some cases, entirely reshaping diagnosis, treatment, and communications. A tremendous amount of information and structured data is now available to guide treatment, assess outcomes, and measure quality of care. Beyond EHRs, digital health tools such as apps and wearable devices are becoming commonplace. To position themselves for the future, ASCs will need to prepare.6

The takeaway: Three considerations for building a better digital healthcare infrastructure

As more ASCs adopt EHRs and embrace digital capabilities, they’ll evaluate options. An OR Manager report commented on the “growing number of vendors either adding ASC-specific EHRs to their product lines or specializing in serving ASCs,” making it easier to find a fit. It also outlined ground rules for selecting an EHR.

Alongside functional evaluation, it’s important to choose the right technology infrastructure. Healthcare professionals are not (and don’t want to be) technology specialists, yet they should keep in mind three top-line considerations for their healthcare digital infrastructure.

Make mobile a standard: When physicians can use tablets/portable devices to chart notes, or patients can easily use apps to access portals, they’re more likely to maximize the benefits of an EHR.

 See how via Cisco Mobility in Healthcare

Demand strong security measures: To take advantage of digitization opportunities, healthcare organizations must rigorously attend to security and regulatory requirements to keep their patients, facilities, data, and devices safe, sound, and secure.

 Learn more in the Cisco Cybersecurity Strategies for Healthcare white paper

Ensure systems run quickly and effectively: Slow load times and data entry latency frustrate clinicians and staff and eat into limited time, both work time and patient/provider face time. The technology infrastructure supporting the EHR system matters—a lot.

  Learn about Cisco’s partnership with a major EHR vendor

Maybe not immediately, but I’d bet that relatively soon, Matt’s ASC will digitize its operations, clinician support, or patient service. (Maybe all three.) When the next group camping trip rolls around, I’ll be eager to chat again with my friend and learn what’s changed.

Better coffee would be nice, too.

1, 2, 4, 5 Online patient records: A trend ASCs should learn to embrace, OR Manager, Vol. 31 No. 1, 2015.

3 National Center for Health Statistics

6 3 Health Care Trends That Don’t Hinge on the ACA, Harvard Business Review

 

Authors

Avatar

Nada MacKinney

Marketing Mgr, Digital Transformation

Enterprise Solutions Marketing

July 17, 2017 Leave a Comment
Avatar

PyREBox, a Python scriptable Reverse Engineering sandbox

This post was authored by Xabier Ugarte Pedrero

In Talos, we are continuously trying to improve our research and threat intelligence capabilities. As a consequence, we not only leverage standard tools for analysis, but we also focus our efforts on innovation, developing our own technology to overcome new challenges. Also, Talos has traditionally supported open-source projects, and has open-sourced many different projects and tools that are currently used as part of our workflow like FIRST and BASS.

 In this blogpost we present PyREBox, our Python scriptable Reverse Engineering sandbox. PyREBox is based on QEMU, and its goal is to aid reverse engineering by providing dynamic analysis and debugging capabilities from a different perspective. PyREBox allows to inspect a running QEMU VM, modify its memory or registers, and to instrument its execution with simple Python scripts. QEMU (when working as a whole-system-emulator) emulates a complete system (CPU, memory, devices…). By using Virtual Machine Introspection (VMI) techniques, it does not require to perform any modification into the guest operating system, as it transparently retrieves information from its memory at run-time.
Several academic projects such as DECAF, PANDA, S2E, or AVATAR, have previously leveraged QEMU based instrumentation for reverse engineering tasks. These projects allow to write plugins in C/C++, and implement several advanced features such as dynamic taint analysis, symbolic execution, or even record and replay of execution traces. With PyREBox, we aim to apply this technology focusing on keeping the design simple, and on the usability of the system for threat analysts.

Read More

Authors

Avatar

Talos Group

Talos Security Intelligence & Research Group

4 Comments
Avatar

For Women in Cybersecurity, Possibilities are Endless

This blog is the third in a series of posts sharing perspectives from Cisco women in security. Previous blogs featured Michele Guel, Engineer and Chief Security Architect and Michelle Dennedy, Chief Privacy Officer.

When the public thinks of cybersecurity we often envision people sitting in dark rooms writing code and fighting hackers. Although those people exist and are necessary, cybersecurity as a career is much more expansive and is an excellent option for women looking for rewarding opportunities.

I stumbled upon my cybersecurity career before there was an industry for the field. Educated in computer science and trained in information technology, it wasn’t until a Cisco executive approached me about a job change that I considered security. In my previous roles I excelled in bridging relationships between various IT and business departments, not knowing at the time how imperative this skill would be for a soon-to-explode security industry.

I learned that cybersecurity is an aspect of business operations that is layered on top of technology and business practices. Because of this and the evolving threat landscape, cybersecurity practitioners are continually evolving the policies and practices based on risks, technologies and instincts. Additionally, they must be effective communicators to align security strategies and plans that enable businesses rather than hinder them. Often, non-security employees think security teams have a magic button we hit when we need to increase our defenses. In my role, I break down these myths by communicating best practices with different departmental teams and offer guidance to ensure all business operations are carried out securely.

Relationship development and communication – two skills not often associated with cybersecurity, but just as important as the people behind the computers writing code and catching bugs.

For women just starting college or looking to make a career change, cybersecurity offers a range of jobs suitable for the most technical savvy to communication experts. We are starting to see an uptick in women entering traditionally male dominated fields and the creation of new jobs, such as mine, that stem from a continuously changing threat environment. As more businesses incorporate security policies into daily operations, cybersecurity is quickly becoming everyone’s job. We can’t afford to exclude certain populations of people, especially when they possess the skills to solve today’s challenges.

Cisco leadership encourages women to challenge the status quo and offers on the job training and mentoring to build leaders within the organization.  The company has built a culture that eliminates barriers and encourages passionate employees to take risks, try new roles and learn different skills. Its supportive businesses, like Cisco, that are helping women carve out a space in the industry to contribute and positively affect cybersecurity efforts.

Like all careers, cybersecurity requires passion and determination. Women now have the same opportunities as our male counterparts but we need to exude the same level of confidence and take similar risks to make our voices heard. I encourage women to think about what excites them professionally and step outside of comfort zones to build a rewarding career in cybersecurity. The possibilities are endless.

Sujata Ramamoorthy is Director and Chief Security Officer for Cloud Platform and Services at Cisco. She has received industry recognition for her leadership being named the Gold Winner for the 2014 Women World Awards for Female Executive of the Year and the Golden Bridge Bronze Award for Security Woman Executive of the Year 2014.

Authors

Avatar

Sujata Ramamoorthy

No Longer with Cisco

Leave a Comment
Avatar

Cisco and Ericsson Light Up Cisco Live

Over 28,000 people from around the world flocked to Las Vegas last month to attend Cisco’s annual showcase of new technologies, Cisco Live.  For the second year in a row, Ericsson participated in the event as a Diamond Sponsor, with a large booth and multiple keynote presentations.

For the first time, however, Ericsson also attended as a Cisco Global Gold Partner, one of only five companies to achieve such recognition. The new Global Gold designation means Ericsson can serve customers around the world, delivering end-to-end services and solutions with consistent quality regardless of geographic location.

Visitors to the Ericsson booth saw and heard about the many services and solutions Cisco and Ericsson deliver together, including Evolved Wi-Fi Networks, Collaboration Mobile Convergence, and Connected Sports Venues. And with the help of an advanced race car simulator, they also experienced the potential power of a next-generation 5G network.

Check out the video below and see our web site for more on what Cisco and Ericsson did together at Cisco Live and how we’re “Creating the Networks of the Future Together.”

https://www.youtube.com/watch?v=q1985Gd098I

Authors

Avatar

Kurt Rosenthal

1 Comment
Avatar

Want to Know More about Cisco DNA for Mobility? Find Out Here!

Your network is complicated and you don’t have time for an intricate solution. Wouldn’t it be great if there was an answer that offers everything you need in one easy package?

Say hello to Cisco Digital Network Architecture (DNA).

Simply put, Cisco DNA is a new software-defined network that provides your network the performance, flexibility and options you need to serve wireless users and their devices. Cisco DNA anticipates and responds faster than ever before. Informed context runs Cisco DNA making it more and more intuitive. This allows you to spend less time and budget on maintenance and more time on innovation

But that’s just the tip of the Cisco DNA iceberg.

To get a better understanding of what Cisco DNA is and what it would mean to your network, there are two ways of learning. One is through our Cisco DNA video, which you can watch here. The other way is through an interactive infographic, which you can read here.

When it comes down to it, Cisco DNA combines security, analytic insights, automation and assurance into one bundle. Learn more today!

Authors

Avatar

Byron Magrane

Product Manager, Marketing

Leave a Comment
Avatar

Memcached – A Story of Failed Patching & Vulnerable Servers

This blog authored by Aleksandar Nikolich and David Maynor with contributions from Nick Biasini

Memcached – Not secure, Not Patched Fast Enough

Recently high profile vulnerabilities in systems were used to unleash several global ransomware attacks that greatly impacted organizations. These types of vulnerabilities were previously patched and could have been addressed by organizations before the attacks commenced. This is just the latest example in a long line of threats that are successful in large part because of the inability for patches to be applied in a timely and effective manner. In late 2016 Talos disclosed a series of vulnerabilities in a software platform called Memcached. After releasing the vulnerabilities Talos has been monitoring the amount of systems that were vulnerable as well as the rate at which they have been patched. This blog will give a quick overview of the vulnerabilities and discuss the unfortunate findings of the Internet wide scans that we have been conducting over the last six months.

Read More >>

Authors

Avatar

Talos Group

Talos Security Intelligence & Research Group

1 Comment
Avatar

Automation and Big Networks: The More, The Better

Recently I had the good fortune to be invited to address a Light Reading BCE audience in Austin, where the theme was the future of big networks. There was plenty of discussion, as you might imagine, about software defined networks/SDNs, network function virtualization (NFV) and artificial intelligence (AI) — all of which matter greatly to the future of big networks.

But for several reasons, if I had to pick one category of work that best represents the future of the network, it’s automation.

Why, because it’s the only way to keep up with the ceaseless changes that come with marketplace disruptions.  Such disruptions are happening in every market segment, really, not just big networks — think about how our children are learning, compared to how we learned. Or how we bank: 95 percent of Sweden is cashless, now, and Denmark wants to go entirely cashless. The ATM machines that were such a game changer in the 1970s, are now being removed by the thousands.

And here’s a particularly sobering prediction, from IMD: In three years, 40 percent of the incumbent players in our market aren’t going to exist anymore.

These disruptions are happening because of digitization, which is at the root of everything — including us. The good news is, broadband consumption continues to grow 50+ percent every year, with no real hint of stopping – (to be exact, Cisco VNI data says that globally, peak Internet traffic grew 51% in 2016). What a great business to be in, where every year grows!

The bad news is, revenues aren’t growing at nearly the same rate — which means we have to be creative. We need to get exponentially more done, in exponentially (or, at least, historically) less time.

As a mathematician, I appreciate the challenge that is a double exponential: More cycles, in less time. The answer can only be in automation, to be faster and more efficient, with ruthless simplification of our networks, and relentless collaboration.

The tools are there, in SDN, and our collective use of the clouds. And in programmability, certification, virtualization, open source — it’s not one or the other of such tools, it’s all of them together. Tools matter to how we simplify our networks.

Here’s what I mean by that, tactically: The days of using a command line interface to manage a box are going away. Why, because it’s not about managing boxes anymore. It’s about managing networks, with model-driven networking. Taking that piece of software, that used to be in a box, and moving it to a higher-level control plane — to be able to look at the network, and manipulate it, more holistically.

Which brings us to standards. We’re involved in so many standards organizations, and open source associations — the whole “so many to pick from!” quip isn’t so much a joke anymore. You’ve probably asked yourself this, too: Are they really open? Any time any of us has to do the same work four times, it means that we could’ve used that energy elsewhere, to move something forward in a more efficient way.

The more we can simplify and unify, the more we can innovate. By that I mean getting all the way into deep-level data to use in analytical ways. Leveraging artificial intelligence/AI, to cross-correlate what’s happening on the optical link, or the firewall, or the router, to make intelligent decisions.

For web-scale companies that grew up on broadband, automation is already a big thing. They’re 100 percent automated; “the box”is abstracted . By contrast, for traditional service providers, the box means everything! Each component requires massive fault tolerance, with every possible backup failure plan — which makes for a very box-heavy network. For web-scale players, none of that matters, because it’s all one layer up. Something fails? No worries. Something else can automatically take over, because it’s all in that external level of control plane.

There’s another very real reason to automate, and that’s the amount of operational costs that can be removed. We’re already seeing this in data centers — yes, someone who runs a data center is far different from someone who manages an entire outdoor infrastructure, but there’s something to be learned there about what automation can do.

The first step in the journey to automated, holistic networks is orchestration. Orchestration is the foundational step to launching new services, running them, and monitoring them. If you haven’t done it yet, you really should!

And then there’s the very hot topic that is compute power: Figuring out where we put tens, or hundreds, or thousands of boxes; finding the perfect allocation for mobile edge resources; establishing where deep-edge compute goes. The whole mobile edge discussion, by the way, reminds me a lot of CDNs, except that was primarily for video caching. We didn’t really lead that charge, as an industry — the CDN providers did. With mobile edge compute, we have a real opportunity to take the lead, and establish its location, use, and business rules.

As in the keynote that triggered this blog, I’ll end with a call to action: Let’s figure out what we have to do, as an industry, together, to get automated. What are the right open standards and open source components that’ll get us there — at scale? Our collective network scale is phenomenal.

It’s my belief, and Cisco’s belief, that there’s never been a better time to look at how to automate so much of what we’ve done manually, in order to increase our speed of innovation.

 

Authors

Avatar

Yvette Kanouff

Senior Vice President/General Manager

Service Provider Business

1 Comment
Avatar

How ISVs Can Take Advantage of Cisco DNA in the New Era in Networking

With Cisco’s launch of The Network. Intuitive., we are delivering an open and extensible architecture that is constantly learning, adapting, and protecting. As Nirav Sheth pointed out in his blog about the new network on June 21, we are leading a breakthrough approach from the traditional, manual “set and forget” network to a new intuitive network that’s more agile, intelligent, automated, and secure.  This intuitive network can be a true game changer for all of Cisco’s different partners in the Cisco Partner Ecosystem.

If you are an Independent Software Vendor (ISV), you may be wondering—what’s in it for me? Cisco DNA offers extensibility and the potential for higher levels of software integration and partnerships for application vendors, including the ability to:

  • Reduce Application Performance Problems—Application vendors can proactively recognize and address performance issues before end users call to complain about application performance. This is all done through Cisco DNA Center, a central management dashboard for the network that enables customers to design, provision, automate policy and assure services centrally. It can predict issues before they occur with Cisco DNA Assurance & Analytics services, powered by the Cisco Network Data Platform; by leveraging open APIs, application vendors can tap into the incredible insights that only the network can provide and add new values for their customers.
  • Increase Customer Confidence with Enhanced Security—Application vendors can deploy their applications with better security by finding and addressing attacks, which helps them increase the integrity of their applications for customers. This is done through Cisco Encrypted Traffic Analytics (ETA) which can detect malware even when it is hidden in encrypted traffic. Cisco is the ONLY vendor with 99.99% accuracy that can find the “bad guys.”
  • Optimize Deployment of Applications—Application vendors can optimize their software by using our network APIs with Cisco Easy Quality of Service, create custom application policies, and use Dynamic Network Access Control (DNAC) to properly identify and classify those applications. In addition, Cisco Network Data Platform (NDP) will ensure those applications are working optimally for the best customer experience. Application vendors then can help customers easily roll out new business solutions faster and more securely using Cisco Software-Defined Access. SD-Access provides a single, secure network fabric that can simplify the onboarding of new applications and services, while extending value to the edge of the network for devices and things via automation and leveraging policy-based segmentation. Imagine rolling out applications in days versus months, and your customers’ satisfaction!
  • Optimize Mobile Application User Experience—Any application vendor that has an iOS business application can take advantage of Cisco DNA to offer our mutual end customers an optimized user experience. Cisco can help you develop and test your iOS application optimizations for a Cisco network, and go to market with this joint solution. For more information, take a look at Susie Wee’s latest blog.
  • Accelerate Your Virtual Service Adoption with Cisco Enterprise NFV—To address market growth in network functions virtualization (NFV), Cisco offers application vendors a way to help customers accelerate virtual service adoption and reduce complexity and support. Cisco offers Cisco Enterprise Network Functions Virtualization (Enterprise NFV), a solution that helps application vendors validate and deploy their virtualized network function (VNF) services on Cisco DNA.
  • Determine Network Readiness for Digital Transformation—For instance, application vendors can help customers determine if their enterprise network is ready for digital transformation with Cisco DNA Advisor, then use Cisco Readiness Planner to help customers build their roadmap, which can include a partner’s complementary products, solutions and services. Application vendors can also capture professional services dollars from offering this service to customers.

When ISVs work with Cisco on network-enabled digital transformation projects, the results can be powerful.  For example, Cisco ecosystem partner LiveAction has created a solution called LiveNX, a network performance analytics platform that simplifies the network to create better digital experiences for end users. LiveNX relies on Cisco APIC-EM and Cisco DNA to retrieve real-time information from the network, retain historical information for analytics, and deliver continuous insights to customers. One of LiveAction’s customers in the financial services space has already benefited from the improved WAN management and visibility made possible by LiveNX. As a result of implementing the solution, they extended their initial 125 site rollout to 825 sites in half the originally proposed time thus accelerating their time to value.

Cisco is excited to see the differentiated offers that innovative software vendors will deploy to help customers transform their businesses. If you want to explore possibilties for developing a joint solution based on what I’ve just shared, check out Cisco DevNet. If you’ve already developed an integration with Cisco DNA, and want to go to market together with Cisco, engage with us via the Solution Partner Program website.

Questions or comments? Feel free to connect with me on Twitter.

Authors

Avatar

Denny Trevett

Vice President

Partner Model, Customer Experience