Cisco Blogs


Cisco Blog > Security

A New Way Forward: Continuous Threat Protection for Organizations of All Sizes

Organizations are under relentless attack, and security breaches happen every day. A global community of attackers creates advanced malware and launches it via multi-faceted attacks and through multiple attack vectors into organizations of all sizes.

These increasingly costly attacks against organizations of all sizes place customer data, corporate secrets, and intellectual property at risk. Smaller organizations that form part of the supply chain are targeted not only for their own assets but as an entry point for attacks against larger organizations that they partner with.

We believe the most effective way to address these real-world challenges is with continuous threat protection that is both pervasive and integrated. This goes beyond traditional point-in-time detection and taps into context-rich threat intelligence, dynamic malware analysis, and retrospective security to allow continuous breach detection, response, and remediation across the full attack continuum.

For this reason, we are unveiling new models of Cisco ASA with FirePOWER Services for SMB, midsize organizations, and branch offices. These next-generation firewall (NGFW) models bring integrated threat defense, low total cost of ownership, and simplified security management to smaller and distributed organizations.

Read More »

Tags: , , ,

Threat Spotlight: Spam Served With a Side of Dridex

This post was authored by Nick Biasini with contributions from Kevin Brooks

Overview

The use of macro enabled word documents has exploded over the last year, a primary example payload being Dridex. Last week, Talos researchers identified another short lived spam campaign that was delivering a new variant of Dridex. This particular campaign lasted less than five hours and was successful at mutating the subject and attachments to avoid detection. The five hour campaign actually consisted of two separate emails that both had malicious word documents as attachments. A sample of the two different subject lines are shown below.

Campaign One Subject:
Debit Note [97994] information attached to this email

Campaign Two Subject:
48142 – Your Latest Documents from RS Components 822379272

*Note: Italicized text used to identify mutating portions of email subject

Both campaigns centered on invoices being sent as word document attachments. Not only did the attackers use different subjects for every email they also rarely reused an attachment name. Less than five percent of the emails observed contained re-used attachment names.

Read More »

Tags: , , , ,

Research Spotlight: FreeSentry Mitigating use-after-free Vulnerabilities

This post was authored by Earl Carter & Yves Younan.

Talos is constantly researching the ways in which threat actors take advantage of security weaknesses to exploit systems. Use-after-free vulnerabilities have become an important class of security problems due to the existence of mitigations that protect against other types of vulnerabilities, such as buffer overflows. Today, Talos is releasing FreeSentry, a mitigation for use-after-free vulnerabilities.

FreeSentry works as a plugin for LLVM with an associated runtime library that tracks pointers when they are set to objects and invalidates them when the memory associated with that object is freed. Our initial approach was published at the 2015 Network and Distributed System Security (NDSS) Symposium in February. The paper can be downloaded here. At CanSecWest 2015, Yves Younan of Talos presented an enhanced version of FreeSentry which included further developments, such as porting the original mitigation from C Intermediate Language (CIL) to LLVM. The CanSecWest slides are available here. Note that the LLVM performance numbers in the CanSecWest presentation were preliminary numbers, and have been updated for this post.

Read More »

Tags: , , ,

Endpoint Visibility to Combat Advanced Attacks – I Want That

Protecting data, maintaining compliance, and enabling the business is a balancing act. Put too many controls in place and you inhibit workflow. Rely exclusively on traditional security tools and you lack the visibility to detect and respond to advanced attacks quickly.

The industrialization of hacking has created an effective and efficient criminal economy. Attackers are fast and the malware they write and resell is smart, able to evade traditional defenses and quick to do damage. If attackers get through – and they will since there is no such thing as 100% breach prevention – IT security professionals need to be able to detect potential malicious activity as it happens, analyze it, and take action. And, increasingly, network-centric detection is not enough.

An explosion of new, untethered devices means that endpoints extend everywhere and so does the workplace you need to protect. Windows and Mac desktops and laptops, tablets and smartphones, and even smart watches make it possible to connect back to the corporate network anytime from anywhere. Attackers are taking advantage of this proliferation of endpoints and using gaps in security to drive their attacks home. Endpoint visibility is becoming a must-have.

To combat these more frequent and destructive attacks, you need to see beyond traditional indicators of a breach, like a signature or a hash or an IP address, to identify behavior-based activities that may point to malicious activities. This visibility must be on workstations so that you can track executables and processes across your environment and cut detection time down to minutes or seconds. You also need to maintain that visibility on devices connected to a protected network or roaming on public or personal in-home wi-fi.

Cisco Advanced Malware Protection (AMP) for Endpoints gives you the visibility and control you need to protect data, maintain compliance, and enable the business – everywhere workers may be. For example, the Prevalence capability in Cisco AMP displays files that have been executed across the organization ordered from lowest to highest number of instances. Files with low prevalence likely indicate a malicious executable you need to investigate. And because AMP is cloud-based you can continue to track devices and deliver the same level of protection whether devices are on or off the network.

Customers across a broad range of industries are using Cisco AMP for Endpoints to increase protection against today’s elusive attacks. Listen to Tim McGuffin, Information Security Officer at Sam Houston State University, describe how his team used Cisco AMP for Endpoints to detect and respond to a malware attack disguised as bad user behavior, and how they maintain a secure infrastructure while ensuring academic freedom and research.

Tags: , ,

Research Spotlight: Project FTR

image00

image02_a

 

 

 

 

 

 

Intro

Historically, networks have always been at risk for new, undiscovered threats. The risk of state sponsored hackers or criminal organizations utilizing 0-day was a constant, and the best defense was simply to keep adding on technologies to maximize the odds of detecting the new threat – like adding more locks to the door if you will. Here at Cisco Talos we’re constantly pushing the envelope. Recently after some thinking juice we started brainstorming ways to better address the constant threat of attacker utilizing unknown 0-day. Today, we’re happy to inform our customer base about our new inspection technology code name project Faster Than Realtime, or FTR. Project FTR is the next generation of detection technology, that which will truly revolutionize the industry.

Project FTR

To mitigate the ever-growing threat of new and unknown attacks we simply decided to add a few options to our existing inspection infrastructure. Snort’s new Quantum Pre-Detection (QPD) leverages Predictive Attack Detection (PAD) by putting packets into an Ethereally-Buffered Capture (EBC) file.  Snort then reads the .ebc via PAD so that QPD can tell you that you are under attack before you’re even under attack.

Read More »

Tags: , , , , , , ,