Editor’s Note: In this second installment of the blog series on more responsive security, we take a closer look at the circular problems associated with four common security principles in managing “weak link” risks in Information Technology organizations.

Before discussing what constitutes this responsive approach to security, let us first look at a few of the fundamental principles of information security to understand the unique challenges organizations face today in managing security risks.

Read More »

Tags: design, information security systems, Risk Management, security, security principles

This post was authored by Alex Chiu and Shaun Hurley.

Last month, Microsoft released a security bulletin to patch CVE-2014-6332, a vulnerability within Windows Object Linking and Embedding (OLE) that could result in remote code execution if a user views a maliciously crafted web page with Microsoft Internet Explorer. Since then, there have been several documented examples of attackers leveraging this vulnerability and attempting to compromise users. On November 26th, Talos began observing and blocking an attack disguised as a hidden iframe on a compromised domain to leverage this vulnerability and compromise Internet Explorer users.

Read More »

Tags: botnet, cnc, Exploit, IE, malware, security, Talos, vulnerability

As we often say at Cisco, every business is a security business. That’s been true ever since widespread online presence led to widespread cyber threats. It became even more applicable as those threats became more sophisticated and less detectable. And now, with the Internet of Everything (IoE), that phrase is more relevant than ever before.

Cisco estimates that by 2020, 50 billion devices will be connected, whether you know it or not. Other advances in technology, such as mobility and cloud computing, will require a new way of thinking about network security. In today’s world of IoE, security must be top of mind as the number and type of attack vectors continues to increase, as does the amount of data that needs to be protected. Take a look at three key considerations for building your security program.

First, it’s essential to understand what kinds of threats are coming at you, as well the motivation behind them. You cannot protect against what you cannot see. Second, you need application visibility and control; a real-time, accurate picture of devices, data, and the relationships among them that helps make sense of billions of devices, applications, and their associated information. And third, you need an adaptable, flexible security posture supported by some of today’s biggest innovations and brightest minds.

The IoE is creating a host of new security challenges. A risk mitigation strategy based on these key tenets is essential to securing your information assets. Please let me know your thoughts, experiences and strategies regarding this complex issue in the comments section.

Given that modern attacks are complex and sophisticated, there is not a single product or tool that will ever be 100% effective at detecting threats. Prevention eventually fails. Therefore, you need protection before, during, and after an attack.

Modern-day networks are large and complicated. It is a nightmare for incident response teams and security investigators because it often takes days and months to identify that their networks were compromised. A wide variety of tools, technologies and platforms are available, like big data platforms, machine learning algorithms, statistical techniques, threat intelligence platforms, reputation feeds etc. It is often confusing for the decision makers to identify what is needed for their environment.
Read More »

Tags: breach detection, Cisco Security, johari window, security

A little more than a year ago when Sourcefire became a part of Cisco, we reaffirmed our commitment to open source innovation and pledged to continue support for Snort and other open source projects. Our announcement of the OpenAppID initiative earlier this year was one of several ways we have delivered on this promise.

Today we are announcing the alpha release of a new Snort 3.0 architecture. This alpha release builds on several ideas that were part of the original 3.0 prototype developed several years ago and goes well beyond those initial concepts.

Snort 3.0 expands on the extensible architecture users have come to know and includes several new capabilities that make it easier for people to learn and run Snort. We encourage you check out it out at www.snort.org, give us your feedback and help us build a strong foundation for the future. As Joel mentions in his post, this is a very early release that is intended for community feedback more than anything else.

When I first began building Snort, I architected it so that we could continue to extend it over time. By working with the Snort community, it quickly evolved from the initial primitive idea of an easy-to-use intrusion detection engine to the powerful traffic analysis and control capabilities we have today. With millions of downloads and hundreds of thousands of registered users, Snort is the most widely deployed IPS technology in the world and has become the standard for intrusion detection and prevention. Snort is also the foundation of Cisco’s Next-Generation IPS and is one of the core technologies that cemented Sourcefire’s position as a leader in the security industry.

Cisco understands the power of open source and how it can help customers solve tough challenges. In the coming months you’ll hear more from us about Snort 3.0 and our continued efforts to deliver meaningful capabilities that underscore this commitment.

Tags: open source, security, Snort