Cisco Blogs


Cisco Blog > Security

Leveraging the Network as a Security Sensor and Policy Enforcer

The topic of cybersecurity has become so ubiquitous that it’s almost a daily occurrence to read or hear about security breaches in the news. Cisco understands this paradigm shift within the nature of computing, that the Digital Economy and the Internet of Everything now requires what we are calling Security Everywhere. Security has to span the extended network in order to protect against an ever growing array of attack vectors. Scott Harrell, Vice President Product Management has written a more detailed blog about this specific topic here .

The key point to note about Security Everywhere is that organizations are under unrelenting attack and breaches are happening every day. Attackers have also created sophisticated malware that can be launched into the network, gather information to intelligently understand exactly what, when and how to attack and then launch an extremely surgical and devastating attack against the network. Our Cisco 2015 Annual Security Report is an excellent resource for detailed research about the nature and frequency of attacks against the enterprise.

Read More »

Tags: , , ,

ISE Ecosystem Expands to Drive Deeper Visibility and Control with Cisco Identity Services Engine

In one of my previous posts, I noted how Network Access Control (NAC) platforms have started evolving into more visibility-focused and context-aware platforms in the face of major business trends such as enterprise mobility, the migration of resources to the cloud, and the ubiquitous Internet of Everything. Consequently, “new NAC” technology has quietly transformed from a complicated set of controls – outdated in a more mobile world – into a powerful business enabler for enterprises.

The Cisco Visual Networking Index (VNI) forecasts that over fifty billion new connected devices will hit networks by the year 2020. With this massive proliferation of network-enabled devices firmly in mind, I am proud to announce that the latest version of the market-leading Cisco Identity Services Engine (ISE) is now available. Cisco Identity Services Engine builds upon the solid foundation of our last release to round out the current platform by focusing on expanding the ISE partner ecosystem with new, exciting categories for context-aware security as well as advancing endpoint security capabilities.

Read More »

Tags: , ,

My Resume Protects All Your Files

This post was authored by Nick Biasini

Talos has found a new SPAM campaign that is using multiple layers of obfuscation to attempt to evade detection.  Spammers are always evolving to get their messages to the end users by bypassing SPAM filters while still appearing convincing enough to get a user to complete the actions required to infect the system. The end payload for this campaign is Cryptowall 3.0. Talos has covered this threat repeatedly and this is another example of how the success of Ransomware has pushed it to one of the top threats we are seeing today. Whether its Exploit Kits or SPAM messages threat actors are pushing as many different variants of Ransomware as possible.

Email Details

The use of resume based SPAM isn’t anything new.  An analysis of our telemetry has found countless messages in the last 30 days related to Resumes. Threat actors have tried many different techniques associated with these messages including using password protected zip files, word documents with embedded macros, and malicious URLs redirecting back to a malicious sample. This threat combined a series of techniques to try and avoid detection that has been surprisingly successful against some products. Below is a sample of one of the emails that we saw in our telemetry.

Sample Email

Sample Email

Read More »

Tags: , , ,

Implementing a Hot Threat Dashboard

Logjam, Freak, Shellshock, BEAST, POODLE, Heartbleed. Each new vulnerability requires a fire-drill to see if you’re vulnerable, if you have protective mechanisms, and to verify that your organization can detect attacks against your corporate network. On top of that, you may also receive bulletins from threat intelligence partners, law enforcement, and other warnings that require heightened vigilance and the ability to detect new attacks.

Hot threats board posted in each SOC.

Hot threats board posted in each SOC

Read More »

Tags: , , , ,

Angler EK: More Obfuscation, Fake Extensions, and Other Nonsense

This post was authored by Nick Biasini

Late last week Talos researchers noticed a drastic uptick in Angler Exploit Kit activity. We have covered Angler previously, such as the discussion of domain shadowing. This exploit kit evolves on an almost constant basis. However, the recent activity caught our attention due to  a change to the URL structure of the landing pages. This type of change doesn’t occur often and was coupled with some other interesting tidbits including how the HTTP 302 cushioning has evolved and the payload of another ransomware has changed.

During research Talos identified several active Angler campaigns delivering different payloads via different methods.  The first campaign was delivering Cryptowall, which will be covered in detail here. The second delivered Bedep with click fraud and illustrates the variety with which Angler can be used to deliver different payloads.  The details of Bedep with click fraud has been covered thoroughly and will not be specifically discussed in this article.

Read More »

Tags: , , , ,