Protecting Against regreSSHion with Secure Workload

On July 1, 2024, the Qualys Threat Research Unit (TRU) disclosed an unauthenticated, remote code execution vulnerability that affects the OpenSSH server (sshd) in glibc-based Linux systems.

Now we have seen how CVE-2024-6387 has taken the internet by storm, making network security teams scramble to protect the networks while app owners patch their systems.

Secure Workload helps organizations get visibility of application workload traffic flows and implement microsegmentation to reduce the attack surface and contain lateral movement, mitigating the risk of ransomware.

Below are multiple ways in which Secure Workload can be leveraged to get visibility of affected application workloads and enforce segmentation policies to mitigate the risk of workloads being compromised.

1. Visibility of SSH Traffic Flows

According to the Qualys Threat Research Unit, the versions of OpenSSH affected are those below 4.4p1, as well as versions 8.5p1 through 9.8p1, due to a regression of CVE-2006-5051 introduced in version 8.5p1.

With Secure Workload, it is easy to search for traffic flows generated by any given OpenSSH version, allowing us to spot affected workloads right away and act. By using the following search attributes, we can easily spot such communications:

◉ Consumer SSH Version

◉ Provider SSH Version

Figure 1: Visibility of OpenSSH version from Traffic Flows

2. Visibility of OpenSSH Package Version in Workloads

Navigate to Workloads > Agents > Agent List and click on the affected workloads. On the Packages tab, filter for the “openssh” name and it will search for the current OpenSSH package installed on the workload.

Figure 2: OpenSSH package Version

3. Visibility of CVE-ID Vulnerability in Workloads

Navigate to Vulnerabilities tab, and a quick search for the CVE ID 2024-6387 will search the current vulnerabilities on the workload:

Figure 3: Vulnerability ID Information Per Workload

4. Mitigating Risk of regreSSHion

Once the relevant workloads are spotted, there are three main avenues to mitigate the risk: either by microsegmenting the specific application workload, implementing organization-wide auto-quarantine policies to proactively reduce the attack surface, or performing a virtual patch with Secure Firewall.

◉ Microsegmentation: Microsegmentation policies allow you to create fine-grained allow-list policies for application workloads. This means that only the specified traffic flows will be permitted, denying any other traffic that might be generated from the workload.

Figure 4: Microsegmentation Policies For Affected Application Workload

◉ Auto-Quarantine: You can choose to implement organization-wide policies to reduce the attack surface by quarantining workloads that have installed a vulnerable OpenSSH package or are directly affected by the CVE ID.

Figure 5: Organization-Wide Auto-Quarantine Policies

◉ Virtual Patch: If quarantining a workload is too disruptive to the organization (e.g., business-critical applications or internet-exposed applications), you can perform a virtual patch with the help of Cisco Secure Firewall to protect the application workloads against the exploit while still maintaining connectivity for the application.

Figure 6: Virtual Patch with Secure Firewall Connector

Figure 7: Vulnerability Visibility and IPS Signature in FMC

5. Process Anomaly and Change-In Behavior Monitoring of regreSSHion

Even in the scenario where a workload is compromised, Secure Workload offers continuous monitoring and anomaly detection capabilities, as shown below:

◉ Process Snapshot: Provides a process tree of existing runtime processes on the workload. It also tracks and maps running processes to vulnerabilities, privilege escalation events, and forensic events that have built-in MITRE ATT&CK Techniques, Tactics, and Procedures.

Figure 8: Process Snapshot of Affected Workloads

◉ Forensic Rules: Secure Workload comes with 39 out-of-the-box MITRE ATT&CK rules to look for techniques, tactics, and procedures leveraged by adversaries. It is also possible to create custom forensic rules to track certain process activities, such as privilege escalation performed by processes. The system can also generate alerts and send them to the Secure Workload UI and SIEM systems.

Figure 9: Example Manual Forensic Rule Creation (left) and Built-In Mitre ATT&CK Rules (right)

Source: cisco.com

Continue reading

Maintaining Digital Compliance with the PCI DSS 4.0

The Payment Card Industry data security standards have evolved since 2002 when the first version was released. The most recent update, version 4.0.1, was released in June 2024. This updates the PCI 4.0 standard, which  has significant updates to both scope and requirements. These requirements are being phased now and through March 2025.

Cisco has been involved with PCI since the outset, having a seat on the board of advisors and helping craft the development of PCI standards through different evolutions. Cisco has consulted extensively with customers to help meet the requirements and provided extensive user friendly documentation on how customers can meet the requirements, both in minimizing the scope of the assessment as well as in ensuring security controls are present. We have released systems that are PCI compliant in control aspects as well as data plane aspects, and have built-in out-of-the box audit capabilities in a number of infrastructure based, and security based, solutions.

The purpose of this blog is to walk into the PCI DSS 4.0 with a focus on architects, leaders, and partners who have to navigate this transition. We will discuss what is new and relevant with PCI DSS 4.0, its goals and changes. We will then explore products and solution that customers are actively using in meeting these requirements, and how our products are evolving to meet the new requirements. This will be targeted to teams who already have been on the PCI journey. We’ll transition to an expansion into PCI DSS in more detail, for teams that are newer to the requirements framework.

One thing that is important to note about the 4.0 update, is it will be a phased rollout. Phase 1 items (13 requirements) had a deadline of March 31, 2024. The second phase is much larger and more time has been given, but it is coming up soon. Phase 2 has 51 technical requirements, and is due May of 2025.

Implementation timelines as per PCI At a Glance

What’s new in PCI DSS 4.0, and what are its goals?

There are many changes in PCI DSS 4.0. these were guided by four overarching goals and themes:

Continue to meet the security needs of the payments industry.

Security is evolving at a rapid clip, the amount of public CVE’s published has doubled in the past 7 years (source: Statista). The evolving attack landscape is pushing security controls, and new  types of attack require new standards. Examples of this evolution are new requirements around Multi-Factor authentication, new password requirements, and new e-commerce and phishing controls.

Promote security as a continuous process

Point in time audits are useful but do not speak to the ongoing rigor and operational hygiene needed to ensure the proper level of security controls are in place in a changing security environment. This step is an important step in recognizing the need for continual service improvement vis-a-vis an audit. This means that process will be have additional audit criteria in addition to the application of a security control.

Provide flexibility in maintaining payment security

The standard now allows for risk based customized approaches to solving security challenges which is reflective to both the changing security environment, and the changing financial application environments. If the intent of the security control is able to be met with a novel approach, it can be considered as fulfilling a PCI requirement.

Enhance validation methods and procedures for compliance

“Clear validation and reporting options support transparency and granularity.” (PCI 4.0 at a glance).  Clarity in the measurements and reporting is articulated. This is important for a number of factors, you can’t improve what you don’t measure, and if you’re not systematically tracking it in well-defined language, it is cumbersome to reconcile. This focus will make reports such as the attestation report more closely aligned to reports on compliance and self-assessment questionnaires.

How Cisco helps customers meet their PCI Requirements.

Below is a table that briefly summarizes the requirements and technology solutions that customers can leverage to satisfy these requirements. We will go deeper into all of the requirements and the technical solutions to these.

PCI DSS 4.0 Requirement	Cisco Technology/Solution
1. Install and Maintain network security control.	Cisco Firepower Next-Generation Firewall (NGFW), ACI, SDA, Cisco SDWan, Hypershield, Panoptica, Cisco Secure Workload
2. Apply secure configurations to all system components.	Catalyst center, Meraki, Cisco SDWan, Cisco ACI, Cisco CX Best Practice configuration report
3. Protect stored cardholder data	Cisco Advanced Malware Protection (AMP) for Endpoints
4. Protect cardholder data with strong cryptography during transmission over open, public networks	Wireless Security requirements satisfied with Catalyst Center and Meraki
5. Protect all systems and networks from malicious software	Cisco AMP for Endpoints
6. Develop and Maintain secure systems and software	Meraki, Catalyst Center, ACI, Firepower, SDWan. Cisco Vulnerability Manager
7. Restrict access to cardholder data by business need-to-know	Cisco ISE, Cisco Duo, Trustsec, SDA, Firepower
8. Identify users and authenticate access to system components	Cisco Duo for Multi-Factor Authentication (MFA), Cisco ISE, Splunk
9. Restrict physical access to cardholder data	Cisco Video Surveillance Manager, Meraki MV, Cisco IOT product suite
10. Log and monitor all access to system components and cardholder data	Thousand Eyes, Accedian, Splunk
11. Test security of systems and networks regularly	Cisco Secure Network Analytics (Stealthwatch), Cisco Advanced Malware Protection, Cisco Catalyst Center, Cisco Splunk
12. Support information security with organizational policies and programs	Cisco CX Consulting and Incident Response, Cisco U

A more detailed look at the requirements and solutions is below:

Requirement 1: Install and Maintain network security control.

This requirement is will ensure that appropriate network security controls are in place to protect the cardholder data environment (CDE) from malicious devices, actors, and connectivity from the rest of the network. For network and security architects, this is a major focus of applying security controls. Quite simply this is all the technology and process to ensure “Network connections between trusted and untrusted networks are controlled.” This includes physical and logical segments, networks, cloud, and compute controls for use cases of dual attached servers.

Cisco helps customers meet this requirement through a number of different technologies. We have traditional controls include Firepower security, network segmentation via ACI, IPS, SD-Wan, and other network segmentation items. Newer technologies such as cloud security, multi cloud defense, hypershield, Panoptica and Cisco Secure Workload are helping meet the virtual requirements. Given the relevance of this control to network security, and the breadth of Cisco products, that list is not exhaustive, and there are a number of other products that can help meet this control that are beyond the scope of this blog.

Requirement 2: Apply secure configurations to all system components.

This requirement is to ensure processes for components are in place to have proper hardening and best practice configurations applied to minimize attack surfaces. This includes ensuring unused services are disabled, passwords have a level of complexity, and best practice hardening is applied to all system components.

This requirement is met with a number of controller based assessments of infrastructure, such as Catalyst center being able to report on configuration drift and best practices not being followed, Meraki, and SDWan as well. Multivendor solutions such as Cisco NSO can also help ensure configuration compliance is maintained. There are also numerous CX advanced services reports that can be run across the infrastructure to ensure Cisco best practices are being followed, with a corresponding report and artifact that can be used.

Requirement 3: Protect stored account data.

This requirement is application and database settings, and there isn’t a direct linkage to infrastructure. Analysis of how account data is stored, what is stored, and where it is stored, as well as cursory encryption for data at rest and the process for managing these, are covered in this requirement.

Requirement 4: Protect cardholder data with strong cryptography during transmission over open, public networks

This requirement is to ensure encryption of the primary account number when transmitted over open and public networks. Ideally this should be encrypted prior to transmission, but the scope applies also to wireless network encryption and authentication protocols as these have been attacked to attempt to enter the cardholder data environment. Ensuring appropriate security of the wireless networks can be done by the Catalyst Center and Meraki in ensuring appropriate settings are enabled.

Requirement 5: Protect all systems and networks from malicious software

Prevention of malware is a critical function for security teams in ensuring the integrity of the financial systems. This requirement focuses on malware and phishing, security and controls, across the breadth of devices that can make up the IT infrastructure.

This requirement is met with a number of Cisco security controls, Email security, Advanced malware protection for networks and for endpoints, NGFW, Cisco Umbrella, secure network analytics, and encrypted traffic analytics are just some of the solutions that must be brought to bear to adequately address this requirement.

Requirement 6: Develop and Maintain secure systems and software

Security vulnerabilities are a clear and present danger to the integrity of the entire payments platform. PCI recognizes the need for having the proper people, process, and technologies to update and maintain systems in an ongoing basis. Having a process for monitoring and applying vendor security patches, and maintaining strong development practices for bespoke software, is critical for protecting cardholder information.

This requirement is met with a number of controller based capabilities to assess and deploy software consistently and at speed, Meraki, Catalyst Center, ACI, Firepower and SD-Wan, all have the ability to monitor and maintain software. In addition, Cisco vulnerability manager is a unique capability to take into account real world metrics of publicly disclosed CVE’s in order to prioritize the most important and impactful patches to apply. Given the breadth of an IT environments software, attempting to do everything at equal priority means you are systematically not addressing the critical risks as quickly as possible. In order to address your priorities you must first prioritize, and Cisco vulnerability manager software helps financials solve this problem.

Requirement 7: Restrict access to cardholder data by business need-to-know

Authorization and application of least privilege access is a best practice, and enforced with this requirement. Applied at the network, application, and data level, access to critical systems must be limited to authorized people and systems based on need to know and according to job responsibilities.

The systems used to meet this requirement are in many cases, shared with requirement 8. With zero trust and context based access controls we include identification in with authorization, using role based access controls and context based access controls. Some of these can be provided via Cisco identity services engine, which has the ability to take into account a number of factors outside of identity (geography, VPN status, time of day), when making an authorization decision. Cisco DUO is also used extensively by financial institutions for context based capabilities for zero trust. For network security enforcement of job roles accessing the cardholder data environment, Cisco firepower and Software Defined access have the capabilities to make context and role based access decisions to help satisfy this requirement. For monitoring the required admin level controls to prevent privilege escalation and usage of root or system level accounts, Cisco Splunk can help teams ensure they are monitoring and able to satisfy these requirements.

Requirement 8: Identify users and authenticate access to system components

Identification of a user is critical to ensuring the authorization components are working. Ensuring a lifecycle for accounts and authentication controls are strictly managed are required. To satisfy this requirement, strong authentication controls must be in place, and teams must ensure Multi-factor authentication is in place for the cardholder data environments. They also must have strong processes around user identification are in place.

Cisco ISE and Cisco Duo can help teams satisfy the security controls around authentication controls and MFA. Coupled with that, Cisco Splunk can help meet the logging and auditing requirements of ensuring this security control is acting as expected.

Requirement 9: Restrict physical access to cardholder data

“Physical access to cardholder data or systems that store, process, or transmit cardholder data should be restricted so that unauthorized individuals cannot access or remove systems or hardcopies containing this data.” (PCI QRG). This affects security and access controls for facilities and systems, for personnel and visitors. It also contains guidance for how to manage media with cardholder data.

Outside the typical remit of traditional Cisco switches and routers, these devices play a supporting role in supporting the infrastructure of cameras and IOT devices used for access controls.  Some financials have deployed separate air gapped IOT networks with the cost efficiencies and simplified stack Meraki devices, which simplifies audit and administration of these environments. The legacy proprietary camera networks have been IP enabled, and support wired and wireless, and Meraki MV cameras offer cost affordable ways to scale out physical security controls securely and at speed. For building management systems, Cisco has a suite of IOT devices that support building physical interface capabilities, hardened environmental capabilities, and support for IOT protocols used in building management (BACNET). These can integrate together and log to Cisco Splunk for consolidated logging of physical access across all vendors and all access types.

Requirement 10: Log and monitor all access to system components and cardholder data

Financial institutions must be able to validate the fidelity of their financial transaction systems and all supporting infrastructure. Basic security hygiene includes logging and monitoring of all access to systems. This requirement spells out the best practice processes for how to conduct and manage logging of infrastructure devices that allow for forensic analysis, early detection, alarming, and root cause of issues.

Cisco and Splunk are the world leader in infrastructure log analytics for both infrastructure and security teams. It is deployed at the majority of large financials today to meet these requirements. To compliment this, active synthetic traffic such as Cisco Thousand Eyes and Accedian help financials detect failures in critical security control systems faster to satisfy requirement 10.7.

Requirement 11: Test security of systems and networks regularly

“Vulnerabilities are being discovered continually by malicious individuals and researchers, and being introduced by new software. System components, processes, and bespoke and custom software should be tested frequently to ensure security controls continue to reflect a changing environment.” (PCI QRG)

One of the largest pain points financials face is the management of applying regular security patching across their entire fleet. The rate of CVE’s released has doubled in the past 7 years, and tools like Cisco Vulnerability management is critical prioritizing an infinite security need against a finite amount of resources. Additional Cisco tools that can help satisfy this requirement is: Cisco Secure Network Analytics (11.5), Cisco Advanced Malware protection (11.5), Cisco Catalyst Center (11.2), Cisco Splunk (11.6).

Requirement 12: Support information security with organizational policies and programs

People, process, and technology all need to be addressed for a robust security program that can satisfy PCI requirements. This requirement focuses on the people and process that are instrumental in supporting the secure PCI environment. Items like security awareness training, which can be addressed with Cisco U, are included. Cisco CX has extensive experience consulting with security organizations and can help review and create policies that can help the organization stay secure. Finally, having a Cisco Incident Response program already lined up can help satisfy requirement 12.10 for being able to immediately respond to incidents.

Source: cisco.com

Continue reading

The Trifecta Effect of Integrating XDR, SIEM, and SOAR

In the ever-evolving landscape of cybersecurity, the integration of cutting-edge technologies has become paramount to stay ahead of sophisticated threats. One such powerful combination that is revolutionizing security operations is the integration of Extended Detection and Response (XDR), Security Information and Event Management (SIEM), and Security Orchestration, Automation, and Response (SOAR). Let’s delve into the trifecta effect of integrating these technologies and how they can enhance your organization’s security posture.

Security Information and Event Management (SIEM)

SIEM solutions play a crucial role in centralizing and analyzing security event data from various sources within an organization. They provide real-time monitoring, threat detection, and incident response capabilities. By aggregating logs and data from security and non-security disparate systems, SIEM enables security teams to detect anomalies, investigate security incidents, and comply with regulatory requirements.

Extended Detection and Response (XDR)

XDR represents a holistic approach to threat detection and response by consolidating multiple security layers into a unified platform. It provides enhanced visibility across endpoints, networks, and cloud environments, enabling security teams to detect and respond to threats more effectively. By leveraging advanced analytics and machine learning, XDR can correlate and analyze vast amounts of data to identify complex threats in real-time.

Security Orchestration, Automation, and Response (SOAR)

SOAR platforms empower security teams to automate repetitive tasks, orchestrate incident response workflows, and streamline security operations. By integrating with XDR and SIEM, SOAR can enhance the efficiency and effectiveness of incident response processes. It enables teams to respond to security incidents rapidly, reduce manual errors, and improve overall response times.

How XDR, SIEM, and SOAR Complement Each Other

The trifecta effect of integrating XDR, SIEM, and SOAR brings together the best of all three worlds, creating a comprehensive and synergistic security solution. Here’s how the components of each technology complement each other:

• XDR and SIEM: XDR’s advanced analytics, machine learning, and threat detection capabilities are integrated with SIEM’s centralized log management and real-time monitoring. This combination enables organizations to detect and respond to both known and unknown threats more effectively, as well as comply with regulatory requirements. SIEM’s pattern recognition capabilities can help XDR identify threats through pattern recognition, while XDR’s API data access and stealth threat detection capabilities can enhance SIEM’s detection capabilities. XDR and SIEM can work together in a security architecture to provide a more robust and mature security posture. For instance, XDR can provide real-time visibility, and SIEM can provide forensic search, data archival, and customization. XDR can reduce the number of contextualized alerts sent to the SIEM for prioritized investigations, enabling security teams to respond to security incidents more efficiently.
• XDR and SOAR: XDR’s response integrations can have similar functionality to SOAR platforms, with the potential to make SOAR a native part of XDR platforms in the future. This integration allows for automated threat response, enabling security teams to automatically remediate threats in their environment without human intervention. SOAR’s orchestration and automation capabilities can also enhance XDR’s response capabilities, providing a more proactive defense posture.
• SIEM and SOAR: SIEM and SOAR can integrate best-of-breed components without vendor lock-in, allowing for more flexibility in security operations. SOAR’s incident response capabilities, such as use-case-based playbooks, can orchestrate response actions across the environment, assign tasks to personnel, and incorporate user inputs to augment automated actions. This integration can help SOAR platforms focus on incident response, while SIEM solutions can focus on data collection and analysis.

Case Study: Credential Stuffing Attack

Let’s walk through a scenario of a credential stuffing aAttack and model how this trifecta could come into play:

Phase 1: Attack Initiation and Initial Detection

An attacker begins a credential stuffing attack by using previously breached username and password pairs to gain unauthorized access to the organization’s web applications.

• XDR Role: XDR monitors the endpoints and detects a high volume of failed login attempts from various IP addresses, which is unusual and indicative of a credential-stuffing attack. XDR can also identify successful logins from suspicious locations or devices, adding this information to the incident details.
• SIEM Role: The SIEM system, collecting logs from web application firewalls (WAF), authentication servers, and user databases, notices an abnormal spike in authentication requests and login failures. This complements the XDR’s endpoint visibility by providing a network-wide perspective and helps to confirm the scale of the attack.

Phase 2: Alert Correlation and Confirmation of the Attack

The attack continues as the attacker tries to automate login requests to bypass security controls.

• XDR Role: XDR correlates the failed authentication attempts with geographic anomalies (such as logins from countries where the company does not operate) and reports these findings to the SIEM.
• SIEM Role: SIEM cross-references the XDR alerts with its log data, confirming the attack pattern. It leverages its correlation rules to identify legitimate accounts that may have been compromised during the attack, which XDR might not be able to determine on its own.

Phase 3: Automated Response and Mitigation

With the attack confirmed, rapid response is necessary to minimize damage.

• SOAR Role: Upon receiving alerts from both XDR and SIEM, the SOAR platform triggers a predefined response playbook that automatically enforces additional authentication requirements for the affected accounts, such as multi-factor authentication (MFA), and blocks IP addresses associated with the attack.
• XDR Role: XDR can automatically enforce endpoint-based security controls, like updating access policies or locking down accounts that have shown suspicious login activities.
• SIEM Role: SIEM supports the response by providing additional context for the SOAR to execute its playbooks effectively, such as lists of affected user accounts and their associated devices.

Phase 4: Post-Attack Analysis and Strengthening Defenses

After blocking the immediate threat, a more in-depth analysis is conducted to ensure all compromised accounts are secured.

• SIEM Role: SIEM facilitates a detailed investigation by querying historical data to uncover the full scope of the attack, identifying compromised accounts, and understanding the methods used by attackers.
• SOAR Role: SOAR provides workflows and playbooks to automatically reset passwords and notify affected users, while also updating security policies based on the attack vectors used.
• XDR Role: The XDR platform assists with forensic analysis by leveraging its integrated view across endpoints, network, and cloud to pinpoint how the attacker could bypass existing security measures.

Phase 5: Continuous Improvement and Monitoring

To prevent future attacks, the organization needs to refine its security posture and implement new controls.

• SOAR Role: SOAR can automate the rollout of new security policies across the organization and conduct simulated phishing exercises to educate employees about security best practices.
• SIEM Role: SIEM takes charge of long-term data collection and analysis to monitor for new patterns that may indicate a repeat of the attack, ensuring continuous improvement in the organization’s security monitoring capabilities.
• XDR Role: XDR continuously monitors for any signs of a resurgence of the attack or similar tactics being used, ensuring ongoing vigilance and quick detection of any new threats.

In this scenario, XDR and SIEM play complementary roles where XDR’s real-time analysis and endpoint visibility are enhanced by SIEM’s ability to provide a broader view of the network and historical non-security context. The SOAR platform bridges the gap between detection and response, allowing for quick and efficient mitigation of the attack. This integrated approach ensures that no aspect of the attack goes unnoticed and that the organization can rapidly adapt to and defend against such sophisticated cyber threats.

Impact of Non-Integrated Approach

Removing either SIEM or XDR from the scenario would significantly affect the organization’s ability to effectively detect, respond to, and recover from a credential-stuffing attack. Let’s consider the impact of removing each one individually:

Removing SIEM

• Loss of Centralized Log Management: Without SIEM, the organization loses centralized visibility into the security data generated by various devices and systems across the network. This makes it more challenging to detect patterns and anomalies that are indicative of a credential stuffing attack, especially when they span across multiple systems and applications.
• Reduced Correlation and Contextualization: SIEM’s strength lies in its ability to correlate disparate events and provide context, such as flagging simultaneous login failures across different systems. Without SIEM, the organization may not connect related events that could indicate a coordinated attack.
• Inefficient Incident Management: SIEM platforms often serve as the hub for incident management, providing tools for tracking, investigating, and documenting security incidents. Without it, the organization may struggle with managing incidents effectively, potentially leading to slower response times and less organized remediation efforts.
• Difficulty in Compliance Reporting: Many organizations rely on SIEM for compliance reporting and audit trails. Without SIEM, they may find it more challenging to demonstrate compliance with various regulations, potentially leading to legal and financial consequences.

Removing XDR

• Reduced Endpoint and Network Visibility: XDR provides a detailed view of activities on endpoints and across the network. Removing XDR would leave a blind spot in detecting malicious actions occurring on individual devices, which are often the entry points for credential-stuffing attacks.
• Weakened Real-time Detection: XDR platforms are designed for real-time detection and response. Without XDR, the organization might not be able to detect and respond to threats as quickly, allowing attackers more time to exploit compromised credentials.
• Limited Automated Response: XDR can automate immediate response actions, such as isolating a compromised endpoint or terminating a malicious process. Without XDR, the organization would have to rely more heavily on manual intervention, potentially allowing the attack to spread further.
• Loss of Integrated Response Capabilities: XDR often integrates with other security tools to provide a coordinated response to detected threats. Without XDR, the organization may find it more difficult to execute a synchronized response across different security layers.

The Case for an Integrated Approach

The conversation should not be framed as “XDR vs. SIEM & SOAR” but rather as “XDR, SIEM and SOAR.” These three technologies are not mutually exclusive anymore; instead, they complement each other and serve to strengthen an organization’s security posture when integrated effectively.

In essence, the integration of XDR, SIEM, and SOAR technologies is not a competition but a collaboration that brings together the best features of all three worlds.

Source: cisco.com

Continue reading

Cisco at NAB 2024: Committed to Delivering Next-Level Experiences That ‘Wow’

We are less than two weeks away from the National Association of Broadcasters (NAB) 101st Show happening once again in Las Vegas, Nevada. As a decade-long returning attendee, I am always excited to be with customers, partners, and colleagues, shaking hands and engaging in stimulating conversations about the next wave of innovation hitting the media and entertainment industry. With new technology features, expanded partnerships, and growing customer momentum, I am looking forward to highlighting Cisco’s cutting-edge solutions and services to our booth visitors this year.

Our leadership in this space continues to grow as we innovate across our portfolio to transform the way broadcasters, content providers, venues, sports teams and leagues are harnessing the power of AI and other emerging technologies and taking audience experiences to the next level.

This year, we will showcase our comprehensive portfolio and demonstrate Cisco’s strategy and innovation across three key areas:

• Enabling dynamic IP production and workflows   
• Transforming content delivery, devices, and network assurance   
• Operationalizing the fan experience with cutting-edge, technology-centric venues

Enabling Dynamic IP Production  

The broadcast industry’s evolution to IP requires sustainable technology to provide great multicast visibility and flexibility to allow integration of multiple multicast and/or unicast, on-premises and cloud domains. Visitors to the Cisco booth can expect to see our flagship solution, Cisco IP Fabric for Media (IPFM), on display at the Cloud Native Media Production- Anywhere demo to show how we are enabling these transitions to IP aligned with SMPTE 2110. With several hundred deployments across the globe, Cisco IP Fabric for Media continues to serve as the foundation to address broadcaster’s audio and video requirements. 

Cisco IPFM includes features for Non-Blocking Multicast (NBM), Network Address Translation (NAT), and now, Protocol Independent Multicast flooding mechanism with Source Discovery (PFM-SD). These components provide end-to-end multicast, live traffic visibility, simplified and flexible deployment at scale, innovations in NBM active, and both PTP and RTP flow monitoring. With our simplified network management and operations tool for provisioning IP-based media fabrics, Cisco Nexus Dashboard Fabric Controller (NDFC), users can now take advantage of an expansive view of the network with 2022-7 visibility and enhanced Events UI Tab to capture critical fault notifications. 

Together with Intel, we will be highlighting our innovative solution for Cloud Native Media Production which uses cloud-native architectures with open standards and open-source software to power new media workflows and help speed digital transformation. 

Transforming Content Delivery, Devices, and Network Assurance 

Together with our partner Qwilt, we will be showcasing Global Edge Cloud for Content Delivery, highlighting how together we are creating a more efficient way to deliver highly distributed live and on-demand content. Our joint solution, serving over one billion unique subscribers globally, provides Quality-as-a-Service by pushing content caching and delivery out to the embedded edge of the carrier network. 

Comprised of Cisco’s edge infrastructure and Qwilt’s Open Edge platform, the solution based on open caching is helping meet the ever-increasing demand for content delivery and edge cloud services and improving re-buffering time, time to first frame (TTFF), average bitrate (ABR) and error rate for live-streamed content delivery.  

We’ve seen a growing need for trusted collaboration tools and devices to help drive engaging virtual and hybrid entertainment experiences, and to connect teams across the globe. In the Cisco Devices: Be there, from Anywhere demo, we will highlight intuitive and interoperable device experiences that are designed to make remote and hybrid collaboration seamless and distraction-free, on any meeting platform. The native Microsoft Teams experience on certified Cisco collaboration devices is designed for frictionless employee experiences. 

Accedian will take center stage in our Cisco Critical Network Assurance demo, highlighting how the most recent addition to Cisco’s observability portfolio is providing industry-leading network performance monitoring and assurance to help enable seamless operations for content providers, service providers, and more.  

Operationalizing the Fan Experience 

One of my personal favorites, and arguably the cornerstone of our Sports, Media and Entertainment portfolio, is our best-in-class VisionEDGE solution for IPTV & Dynamic Digital Signage in partnership with Wipro. A solution that truly “wow’s”, VisionEDGE provides dynamic content management solutions and high quality experiences to every fan, in every seat at venues all over the world including (but not limited to) Allegiant Stadium here in Las Vegas, CITYPARK in St. Louis, Santiago Bernabéu Stadium in Madrid, GEODIS Park in Nashville, and SoFi Stadium and Hollywood Park in Los Angeles (host of Super Bowl LVI). 

As you make your way across the show floor at the Las Vegas Convention Center during NAB be sure to check out the Cisco Booth, #W2743 in the West Hall, and see for yourself how Cisco and our impressive ecosystem of partners are forging a path of innovative new experiences for the media and entertainment industry. 

Source: cisco.com

Continue reading

The AI Revolution and Critical Infrastructure

Artificial intelligence was a central theme at Cisco Live US 2024, and it’s clear AI has already made significant strides in reshaping our world. Cisco’s AI-powered innovations build digital resilience by uniquely combining the power of the network with industry-leading security, observability, and data. They simplify adoption and offer visibility and insight across the entire digital footprint, and for those overseeing critical infrastructure, the potential benefits are clear. Undoubtedly, the latest technology offers the promise of enhanced operations. However, the unpredictability of AI’s outcomes can understandably give pause.

Different Kinds of AI 

There are multiple kinds of AI, and each plays a role in different operational situations. Some AI models produce consistent and predictable results, while others are well suited to identifying relevant information within huge mountains of unstructured data. Choosing the right AI model to address each operational need can be challenging. Cisco’s acquisition of Splunk provides an increasing number of security AI tools to address operational security needs. The vast ecosystem of Cisco’s partners enables a selection of AI tools for various operational use cases.  

Cisco’s Role in AI Solutions

At the heart of every AI solution is data movement and processing. This is where Cisco excels. Cisco’s infrastructure is designed to receive data from sensors and ensure its secure and reliable transport to the applications that require it, making it a key player in the AI landscape. Examples of AI solutions in critical infrastructure include failure detection, failure prediction, pothole detection, process optimization, and analysis queries. The video below of Roland Plett’s Cisco Live Session takes a deeper look at each of these examples.  

Summary

AI is changing the way we engage data in industrial operations. There are multiple kinds of AI models, and the combination of models you need depends on the problem you’re trying to solve. It’s essential to recognize that deep learning AI models, like generative AI, are based on probabilities and don’t have deterministic or repeatable outcomes. This is why choosing the right model for your desired result is critically important.

Source: cisco.com

Continue reading

Mastering Nutanix Hyperconverged Infrastructure on Cisco’s Black Belt Academy

The digital landscape witnessed a significant milestone on August 28, 2023, when Cisco and Nutanix unveiled a global strategic partnership that promises to be a game-changer in the realm of hybrid multi-cloud computing. This alliance is set to fast-track and streamline the hybrid multi-cloud expedition for customers, all while redefining the core principles of data center modernization. With the integration of Nutanix’s premier software platform and Cisco’s cutting-edge server portfolio, this collaboration has produced what is arguably the industry’s most robust and comprehensive hyperconverged infrastructure solution to date.

When Cisco announced the End-of-Life for Cisco HyperFlex Data Platform (HXDP) on September 12, 2023; it left our customers and partners equally overwhelmed. So, when Cisco proposed that the Nutanix Software, running on Cisco’s Hardware will be a direct replacement of HyperFlex; we at Cisco Black Belt Academy made sure that our partners get prompt guidance on the new solution with thorough details on its enhanced HCI capabilities topped with a direction on transitioning or migrating from HyperFlex to Cisco’s HCI Solution with Nutanix.

The ”Chronicle” of Nutanix on Cisco Black Belt Academy

The Nutanix Stage 1 & 2 tracks on Cisco Black Belt Academy are launched for both Presales and Deployment roles. These tracks cover:

1. Cisco’s Hyperconverged Strategy

Explains how the partnership of Cisco and Nutanix is forged on their combined edge on application, data and infrastructure management.

2. Introduction to the Hyper Converged Infrastructure

Makes our partners acquainted with Next Generation HCI, Benefits of HCI, Sustained innovations and HCI Vendor Landscape.

3. Solution Overview

Details Cisco Compute Hyperconverged solution with Nutanix and covers it’s cloud infrastructure, broad Data Services portfolio, Nutanix Cloud Manager, Nutanix Unified Storage and Prism, the Cloud Management interface.

4. Architecture Deep Dive

Elucidates why Nutanix Architecture is different from other HCI solutions; Shows how Cisco servers, storage, networking, and SaaS operations are combined with the Nutanix Cloud Platform; explains how the controller VM’s are working to get a high performance structure; introduces resiliency and functioning of the storage layer.

5. Configuration & Deployment

In-depth demonstrations and techniques surrounding Nutanix Deployment, covering:

• Initial Configurations/Guide to getting started
• Deploying the Nutanix Foundation installer VM to a VMware ESX 7 cluster.
• Deploying a Nutanix cluster on UCS servers managed by UCS Manager and adding those hosts to vCenter.
• Expanding a Nutanix cluster with a node that has been previously provisioned.
• Deploying Prism Central from Prism Element and registering the cluster with the newly created Prism Central.
• Updating the UCS Server Firmware with Nutanix Life Cycle Manager (LCM) without disrupting overall cluster operations.

6. Migration from HyperFlex

Learn the various options to migrate existing HyperFlex platforms to the new Nutanix Platform. Gain an understanding of how Migrations of virtual machines between clusters of VMware ESXi servers is most easily accomplished via “shared nothing” vMotion. In addition, learn about the a free software tool called Move that Nutanix offers, which acts as an intermediary agent and coordinator to move VMs between two systems.

7. Sizing Cisco HCI with Nutanix

Discusses the Cisco HCI with Nutanix sizing based on:

• Output files from RVTools and Nutanix Collector tools
• Existing HyperFlex and Nutanix Bill Of Materials (BOM)
• VM-based and Capacity-based sizing of the Cisco HCI with Nutanix using Nutanix Sizer tool.

8. Winning with Nutanix

Acquire a knowledge of Nutanix differentiators in the market, Insights on the competitive environment and edge over VMware, HPE & Lenovo whilst covering the ways to successfully navigate CI and HCI customer conversations.

9. Dcloud/Capture the Flag (CTF)

Hands on demo with access to a simple Nutanix deployment on Cisco UCS, with Cisco Intersight, Nutanix Prism Element, Nutanix AHV, Prism Central and Cisco UCS Manager. The Capture the Flag (CTF) missions provide a gamified way of understanding what the new Cisco & Nutanix Partnership brings to the table.

Where to learn more?

With the modern business challenges and the ever-changing Market Dynamics, applications have become the center for every customer and these applications are growing at a fast pace. IT teams are required to deploy these applications faster and that too with a cloud operating model in place. Hence, it becomes vital to learn and understand how the partnership of Cisco and Nutanix can help deliver the infrastructure and applications globally while using the best-in-class cloud operating models, that too with added resiliency and flexibility. The curriculum of “Cisco HCI solution with Nutanix” on Cisco Black Belt Academy, can instill confidence to handle customer conversations and perform a successful PoC/PoV as a Presales SE or navigate thorough deployments of the Nutanix Solution as a field engineer while migrating from the older HyperFlex base.

Source: cisco.com

Continue reading