A Programmatic Approach to Using Cisco’s Security Intelligence Feed
If you’re an end-user or manager of software that has publicly known security vulnerabilities, wouldn’t you want to know about it? If you’re a software developer, wouldn’t you want to know if there are third-party software vulnerabilities that may impact your applications or products? Do you have a patch management compliance requirement for managing software […]
Tips and Tricks: Nmap is still relevant
This post provides an overview of the Nmap scanning tool, specifically the improvements made to Nmap version 6.25, and covers three tips to help users unlock some of the benefits of Nmap 6.25: automating the scanner, identifying and discovering vulnerable services on your networkk, and good old-fashioned plain vanilla scanning.
Cisco Live 2013 Orlando: Security Training and Breakout Sessions
The Security track of sessions for Cisco Live Orlando (June 23-27, 2013) includes 72 breakout sessions, 74 hours of labs and seminars, and 3 Product Solution Overview sessions, accounting for about 15 percent of all the content delivered at Cisco Live. This post summarizes a number of the sessions being presented by members of the Cisco Security Intelligence Operations (SIO) organization.
Cross-Site Request Forgery Attacks and Mitigations
Cross-Site Request Forgery (CSRF) attacks: there are already enough articles out there that can explain what a CSRF attack is and provide potential examples. There are also plenty of security alerts that have been released by various vendors whose products are affected by CSRF-related vulnerabilities. CSRF attacks usually target web applications and attempt to make […]
Consider the Best Approach for Your BYOD Mobility Environment
Mobile devices have quickly become a mainstay in enterprise environments and continue to be consumer driven, and yet they find their way into our day-to-day business lives. As these new devices are being brought into the work environment by employees, enterprise IT is increasingly being forced to accommodate for business use. This is not new news. We observe this pattern through our customers today and live this phenomenon within our own everyday work environment at Cisco. Here at Cisco, employees have the flexibility to choose their device and to securely connect to voice, video and data services from anywhere under an Any Device policy. Cisco manages over 64,000 mobile devices today.
Securing a BYOD Environment Requires Deployment Flexibility
When Cisco integrated our Identity Services Engine (ISE) platform with leading mobile device management (MDM) systems, it was clear from the start that we had struck a chord among IT administrators trying to wrestle with the onslaught of employee-owned mobile devices accessing their networks. First and foremost for IT organizations was gaining visibility to all mobile devices — rogue or authorized — that were present on the wireless network. Cisco ISE delivered that capability, providing IT staff with a detailed view of what types of mobile devices were on the network. Coupling that with ISE's native BYOD enrollment capabilities or the active management capabilities of MDM platforms — as well as network intelligence from the Cisco Wireless Network — was key to gaining full control over this Wild West of mobile devices
Security Geeks and Wonks Unite!
Are we heading to a day of reckoning, where the forces of cyber crime overwhelm and erase the good things that information technology delivers? If we head down our current path of incremental, individualized approaches to cyber security, the answer is “Yes.” But I’m enough of an optimist to think that if the IT and security geeks and wonks of the world can unite, share information, work hard, and not worry about who gets the credit, we stand a fighting chance.
Apache Darkleech Compromises
Dan Goodin, editor at Ars Technica, has been tracking and compiling info on an elusive series of website compromises that could be impacting tens of thousands of otherwise perfectly legitimate sites. While various researchers have reported various segments of the attacks, until Dan’s article, no one had connected the dots and linked them all together. Dubbed “Darkleech,” thousands of […]
I Can’t Keep Up with All These Cisco Security Advisories: Do I Have to Upgrade?
"A security advisory was just published! Should I hurry and upgrade all my Cisco devices now?" This is a question that I am being asked by customers on a regular basis. In fact, I am also asked why there are so many security vulnerability advisories. To start with the second question: Cisco is committed to protecting customers by sharing critical security-related information in a very transparent way. Even if security vulnerabilities are found internally, the Cisco Product Security Incident Response Team (PSIRT) – which is my team – investigates, drives to resolution, and discloses such vulnerabilities. To quickly answer the first question, don't panic, as you may not have to immediately upgrade your device. However, in this article I will discuss some of the guidelines and best practices for responding to Cisco security vulnerability reports.