Cisco Blogs

Cisco 2014 Annual Security Report: Trust Exploitation a Permanent Fixture in the Cyber World (Trustworthy Systems Can Be, Too)

January 16, 2014 - 2 Comments

The Cisco 2014 Annual Security Report has been released, following months of collaboration between threat researchers and other cybersecurity experts at Cisco and Sourcefire. As promised, it provides a “warts-and-all analysis” of security news from 2013 and our perspective for the year ahead based on the hard data collected through Cisco security products and analyzed by our researchers.

Our report that the cyberthreat and risk landscape has only grown stronger and more complex over the past year is not a revelation, perhaps. But we also now assert that because the cybercrime network has become so mature, far-reaching, well-funded, and highly effective as a business operation that very little in the cyber world can—or should—be trusted without verification.

We also expect adversaries to continue designing campaigns that take advantage of users’ trust in systems, applications, and the people and businesses they know. It’s an effective strategy. How do we know? Because 100 percent of the networks analyzed by Cisco have traffic going to known malware threat sites, and there is no doubt that the vast majority of those compromises relied initially on some abuse of trust.

The Cisco 2014 Annual Security Report highlights three key challenges organizations will face in the year ahead as it becomes only more difficult for them to define which systems and relationships are trustworthy, and which are not. These issues are:

  • A greater attack surface area: New ways of doing business, such as cloud computing and mobility, are rapidly expanding the attack surface. Cybercriminals have myriad inroads to the network. Quite often, they also have a very easy path from there to the ultimate destination: the data center, where high-value information resides.
  • The proliferation and sophistication of the attack model: Companies have become the focus of targeted attacks that are hard to detect, remain in networks for long periods, and amass network resources to launch attacks elsewhere. Even basic Internet infrastructure services—including web hosting servers, nameservers, and data centers—have become key targets for hackers who want to launch increasingly larger campaigns.
  • Complexity of threats and solutions: Monitoring and managing information security has never been more difficult for security teams. Point-in-time solutions long-relied upon by organizations for cybersecurity are simply inadequate in today’s complex threat environment where many attacks are not only stealthy, but also relentless.

Adding to today’s security challenges is the fact that counterfeit and tampered IT products are a growing problem. The Cisco 2014 Annual Security Report notes that malicious actors will seek out and exploit any security weakness—known vulnerabilities and intentional backdoors— in the technology supply chain.

I’ve written a lot in the past year about what it takes to develop trustworthy systems: building security from the ground up, from the beginning to the end of a product’s life cycle. I’ve also explained how Cisco has invested considerable time, effort, and money in the effort to make our products robust enough for deployment as trustworthy systems. I also would like to emphasize the important role that IT customers and users have in maintaining the effectiveness of trustworthy systems in fending off attempts to corrupt their operations. Trustworthy systems are essential to cybersecurity, of course, but they do not guarantee immunity from an external attack.


In an effort to keep conversations fresh, Cisco Blogs closes comments after 60 days. Please visit the Cisco Blogs hub page for the latest content.


  1. its really amazing and nice blog.really it is helpful.I kike your post, really awesome tips.

  2. John, can the promise of less NSA spying help the U.S. networking technology industry regain lost trust?

    “President Barack Obama announced a ban on U.S. eavesdropping on the leaders of close friends and allies on Friday, and rein in the vast collection of Americans’ phone data in a series of reforms triggered by Edward Snowden’s revelations.” via

    What’s your assessment, were these assurances enough to change the negative perception, particularly in Europe? Should the American networking technology sector, collectively as a group, request more substantive measures?

    Frankly, I’m not convinced that President Obama’s statement goes far enough to renew the confidence in American ICT products.