Moving Towards The Zero Trust Cybersecurity Framework?

The first step should be an investigation and analysis of what your sensitive data is, where it lives, and who accesses it. Then analyze the three Foundational Pillars (see below) to see where you are with the necessary people, process, and technology basics. Most organizations should leverage the resources and technologies they already have in place, and understand where the gaps are so they can address them over the next one to three years. Cisco Advanced Security Services can help you with this analysis, strategy, and implementation work.

The three foundational Pillars are:

1. Zero Trust Platform
2. Security Automation and Orchestration
3. Security Visibility and Analytics

These Zero Trust Foundational Pillars work great whether you leverage the CIS 20, NIST 800, or the ISO 27000 family cybersecurity frameworks. A few key things you need for all of them include:

◈ Segmentation, Priviledge Escalation Monitoring, and Multi Factor Authentication
◈ Inventory of your hardware and software plus application flows
◈ What are your key risks (threats, brand image, fines, and compliance)
◈ Understand what your top 50 pieces of sensitive data are
◈ Understand where your top 50 pieces of sensitive data presently resides
◈ Who is after this information?   What are their capabilities

A quick high level overview of the 3 foundataional pillars based on the information from Forrester Research: :

1. Zero Trust Platform
• Data security, which is ultimately a technology solution
• Managing the data, categorizing and developing data classification schemas, and encrypting data both at rest and in transit
2. Security Automation, Orchestration Security, and Risk leadership to leverage and use tools and technologies that enable automation and orchestration across the enterprise.
• The ability to have positive command and control of the many components that are used as part of the Zero Trust strategy.
3. Security Visibility and Analytics
• You can’t combat a threat you can’t see or understand. Tools such as traditional security information management (SIM), more-advanced security analytics platforms, security user behavior analytics (SUBA), and other analytics systems enable security professionals to know and comprehend what’s taking place in the network.
• This focus area of the extended Zero Trust ecosystem helps with the ability of a tool, platform, or system to empower the security analyst to accurately observe threats that are present and orient defenses more intelligently.

Do a workshop with Cisco Advanced Services so you understand what the gaps are, how to best address them, and prioritize your work.  This end to end approach will help you address your key use cases to get the outcomes you need addressed.

Be sure to take into consideration the Core principles that make up Zero Trust:

1. Identify and Catalog your Sensitive Data
2. Map the data flows of your sensitive data
3. Architect your Zero Trust network
4. Create your automated rule base
5. Continuously monitor your trusted ecosystem

We have the product and services experience to help you determine a practical systems approach to Zero Trust  Reach out to your Cisco Security Services team so we can help guide your through this.

Continue reading

How Antifragile Systems of Trust Can Strengthen Blockchain Initiatives

What doesn’t kill us makes us stronger. We resist gravity, and our muscles become stronger. We negotiate conflicts, and our emotional intelligence increases. But what if this also applied to IT systems? The next generation of networked systems could autonomously improve themselves as outside forces threaten them.

I and the rest of the Cisco Innovation team already believe blockchain is going to play an important role in securing data, but blockchain could also help entire networks learn to better protect themselves and intervene more quickly.

“Antifragility is beyond resilience or robustness. The resilient resists shocks and stays the same; the antifragile gets better. … The antifragile loves randomness and uncertainty, which also means — crucially — a love of errors, a certain class of errors. Antifragility has a singular property of allowing us to deal with the unknown, to do things without understanding them — and do them well. Let me be more aggressive: We are largely better at doing than we are at thinking, thanks to antifragility. I’d rather be dumb and antifragile than extremely smart and fragile, any time.”

We could take a lesson from this idea to design decentralized antifragile systems — whether they are business networks, applications or infrastructure — that become stronger the more people or machines try to break them. Blockchain technology offers specific advantages that all enterprise networks require — one single version of the truth, data immutability and automated processes among them. Combining blockchain technology with machine learning algorithms would allow multi-stakeholder systems to continually improve themselves, better react to challenges in the future and perhaps even anticipate potential problems.

I wrote an article last year about FCAPS, blockchain and trust that is relevant here. Anyone who works in telecommunications is at least tangentially familiar with the ISO/OSI and ITU network management models that shape our processes for fault, configuration, account, performance and security management — FCAPS.

My theory is that setting up machine learning algorithms to constantly measure specific parameters and adjust themselves accordingly could allow those systems to learn new solutions to preserve their operation levels. You would break systems of trust down into key components and use tight feedback loops to record and respond to specific parameters. Those tightly defined parameters could evolve over time. In a multi-stakeholder ecosystem, each stakeholder would extend insights to the collective. So in essence, there is no one system of trust but a series of trusted domains, each independently serving a specific, special function.

Let’s say your system is designed to move data from one point to another point with some certain level of efficiency. Then a configuration change happens — perhaps it’s a simple user error or a malicious configuration change. The system could learn from that instance so that the next time such a change happens, the system can automatically correct it or alert an admin to the issue that would cause it to move out of spec. Now imagine these changes as a collection of events across multiple enterprise domains.

Extremely few environments today have only one vendor as the source of their technology. Just one data center will have multiple vendors involved, and you have to be sure that this heterogeneous system runs efficiently across all providers. Let’s say your business application spans multiple clouds — how do you ensure your product delivers the quality your customers expect if something happens to one of your service providers?

Some of these issues can be learned and prevented in the future to create more robust, responsive systems. This article proposing a manifesto for antifragile software from the University of Bologna is also interesting. Inspired by the Agile Manifesto, the researchers have laid out a common framework for making software that is antifragile; the principles could also be applied to making antifragile networks. The Antifragile Software Manifesto is all about building networks of trust and continuous improvement. Here are some highlights:

◈ Our highest priority is to satisfy the customer by building a non-linear, proactive, and self-adaptive system.
◈ All stakeholders, and the broader environment, lead the antifragile organization.
◈ Continuous exposure to faults and automatic fixing is the primary measure.
◈ An antifragile organization promotes a context aware environment. The stakeholders should be able to maintain a system indefinitely.

Sounds like enterprise blockchain, right? We are striving to create networks that are decentralized and self-adapting, with many stakeholders and built-in redundancy, where all participants have skin in the game but no one actor can sabotage it. Adding machine-learning algorithms that constantly improve these enterprise blockchain networks will even better protect the data and stakeholders involved.

For our enterprise clients, confidence and privacy of data are understandably very important matters. Sustaining these states can be accomplished using selective disclosure. You define who gets to see what information as you write data to a blockchain network. Policies should be set up in the network so data being posted is always compliant with the governance models all parties have agreed upon. Your users’ roles and responsibilities within the network will grant them the according degrees of access to information. So an auditor could be granted access to all information, but a data entry specialist would have only access to certain areas.

The next level would be creating a data overlay specifically for the purpose of providing algorithms access to ecosystem-attested data — data that is compliant, shared correctly and of high value. In theory, machine-learning algorithms may produce higher quality insights for antifragility as ecosystem-wide observations are shared. Infrastructure is a perfect example of a complicated system with many stakeholders and massive amounts of high-quality data for a machine-learning algorithm to munch on. Putting the blockchain in between infrastructure and machine learning would potentially give us the ability to increase quality for all users while maintaining control of data access and preventing tampering.

If you’d like to read more about Cisco’s take on blockchain, you will enjoy our whitepaper. And feel free to leave a comment if you have any thoughts to add on how blockchain could be integrated with machine learning to create smarter systems.

Continue reading

The Five Focus Areas for 5G Security Innovation and Thought Leadership

5G brings the promise of new revenue opportunities for service providers. Service providers will be able to offer new differentiated services and capabilities, connecting customers to multi-cloud services and applications with specific KPIs.

To help service providers in the delivery of 5G, Cisco’s Cloud-to-Client approach unifies multi-vendor solutions into a single, standards-based architecture and spans across multi-cloud, IP routing, 5G core, service edge, access networks, Internet of Things (IoT), and security.

New revenue opportunities are infinite, so are security threats. Many IoT services will utilize new 5G air interfaces. Networks will be more distributed leading to a surge in entry points for more destructive threats, and new transient or moving threat boundaries.

To prepare service providers for these looming security challenges, Cisco offers a comprehensive security approach for the optimal deployment and consumption of 5G services, revealed in detail in our 5G security innovation with Cisco white paper.

5G Security Risks

5G will increase in wireless capacity by 1,000 times and connect 7 billion people and 7 trillion “things”, estimates a joint initiative between EU Commission and European ICT.

This massive throughput connectivity and capabilities in 5G require a major network architectural change, from radio access to the core. It bridges wireless and wireline networks through an evolving architecture which can involve network slicing, Control and User Plane Separation (CUPS), Mobile Edge Computing (MEC), just to name a few of the changes to the network. As the network changes at the same time, new challenges and threats will come about.

As we move into the 5G era we are also seeing more sophisticated attacks. Gartner believes half of the malware next year will use some encryption to hide malware and organizations today do not have a solution for this.

In my view, 5G’s evolving architectural nature and an expanding threat surface call for an integrated end-to-end approach to cybersecurity. Our security innovations based on visibility (even in encrypted traffic) and control for the entire 5G network, up to all applications, can provide a secure delivery of new cases with service assurance.

Intrinsic Security is Key

In the world of 5G, traditional siloed security and add-on edge appliances have limitations, are complicated and costly. Security today does not interoperate enough with the network and there will be gaps if we follow the same approach with 5G.

Cisco’s security innovation is holistic and intrinsic to the network. Leveraging the network functions themselves for visibility and fast threat identification, segmentation to reduce the attack surface and the impact of an attack; threat protection to stop a breach across multiple points of the network; and support from our threat intelligence Talos team.

5G Security Innovation with Cisco

5G security needs an integrated approach to deal with close to 20 billion threats per day. With visibility and control from end-to-end, Cisco’s full suite of 5G solutions and end-to-end security architecture can help service providers in the Asia-Pacific region stop threats at the edge, protect users wherever they work, control who gets on the network, simplify network segmentation, and find and contain problems fast.

Continue reading

Containers in Production: Accelerate the Learning Curve

There is a learning curve associated with scheduling containers in production on Kubernetes. But if your cloud architect or platform engineering team can integrate and configure the set of tools needed for deploying and managing containerized workloads, then Developers, Application Ops, and Cluster Ops teams can move up the curve and accelerate time to value for your business.

But before we discuss how one can move up the learning curve, let’s first get a little context on why containers are a forcing function for change.

Historical Context

When virtual machines (VMs) were new, the technology learning curve primarily affected Ops teams who had to learn about the management, snapshotting, and migration of this new abstraction. The primary unit of management was the VM, not the physical server. Development practices didn’t change much in order to get the most value out of the technology.

But the transition to containerized workloads, as well as the deployment of containers in production on Kubernetes, have a big impact on both Dev and Ops. Containers change how applications are architected and written, and also change how applications are managed, monitored, and supported in production.

So, now both Dev and Ops have a new technology learning curve.

Developers Learning Curve

Rewriting your application for containers is not as simple as taking an application running on a physical machine or a virtual machine and just packaging it in a container. Rather, developers need to do some things differently with containers. This includes:

◈ Packaging – consider packaging with build instructions stacked in layers.
◈ Service discovery and catalog – since you’ll be running services across multiple containers, find and bind to dependent services.
◈ Key management – managing authentication and rotate keys across services.
◈ Logging and monitoring – obtaining data about the application, container, and node levels, as well as dependent services.

Ops Learning Curve

Ops arguably has an even bigger learning curve. Virtual Machines introduced a lot of dynamic things within an infrastructure environment, but containers make an order of magnitude worse because now you can spin up workloads within milliseconds, kill it, and start it somewhere else. This learning curve involves:

◈ Compute capacity planning – planning CPU and memory at a different level that includes multiple containers on a single machine (physical or virtual).

◈ Networking –. managing networking within and between Kubernetes clusters, especially since more containers means more east-west network traffic. These clusters may include both private infrastructure and public cloud.

◈ Persistent Storage – requires higher service levels than ephemeral applications.

◈ Logging and monitoring – there are usually more containers than an equivalent number of VMs for a monolithic application. And they may move if Kubernetes health check replicates pods on a different host.

◈ Data – a VM or virtual disk might include 10 different containers, so you need to shift thinking about snapshotting data at a container level.

◈ Namespaces – coding to namespaces as a variable, or mapping and managing namespaces across your various environments.

◈ Tracking changes – IT remaining responsible for Service Levels and tracking the history of simple changes. This is especially crucial with the ephemeral nature of containers and Kubernetes’ replication across nodes.

Overall, many of the Dev and Ops tools and processes that were optimized for VMs, now need to be updated and re-optimized for containers.

Don’t Get Bogged Down in the Stack

To make this work, you will likely need someone assigned to an AppOps role that works in production to support containerized applications. Also, you’ll likely need a specialized IT Ops role, call it ClusterOps, to manage Kubernetes and field requests for namespace resources or cluster lifecycle management.

But if you run Kubernetes on premises as part of a hybrid cloud solution, you’ll also need a cloud archteicture or platform engineering role to build the Kubernetes tool stack and connect to and secure the cloud. They can deploy and integrate all the tools needed to lifecycle manage your Kubernetes clusters, including underlying compute, network, and storage on private infrastructure.

Building and maintaining this type of integrated on and off-premises solution takes work — both upfront systems integration and configuration work, and the ongoing management and testing of individual tools and platforms through their upgrade cycles.

If all the tools you need to deploy containerized workloads on premises or in the cloud are integrated and tested working together such as the Cisco Hybrid Cloud Platform for Google Cloud – then it will be faster and easier for developers, as well as Application Ops and Cluster Ops counterparts, to move up the learning curve and accelerate time to value for your business.

Continue reading

Introducing the new Webex Meetings in DevNet

At Cisco, we’re dedicated to providing the best experience for our customers as well as for the people who make technology work at its fullest potential—our developers. If you were at Cisco Live, you heard the incredible momentum that our DevNet community has had in the recent timeframe, reaching 500K members. While the network is certainly one of the leading focuses of DevNet, Cisco is also making it easier for developers to get access to all the resources they need to develop for Collaboration.

What’s New

The new Webex Meetings page brings you updated XML API schemas so you can easily develop for Webex Meetings. We’ve included easy access to quick links to help you get ramped up, as well as community support if you want to chat with experts.

Get Started

The Webex Meetings page on DevNet now has a brand-new interface complete with all the tools you need to get started. You can watch video tutorials, access learning labs, and read through release notes to stay up to date on all the newest features.

Community and Support

Need to talk to an expert? Check the links under our “Community & Support” section to talk to Webex Meetings experts at Cisco as well as within the developer community. Check the knowledge base to see if other people have addressed your questions already. You can also send email support for direct assistance and send in feedback.

Explore API Reference Documents

We’ve added a repository of all reference documents that you can access at your leisure, from Data Management to Site Services. You can review the full XML API reference guide to help you as you’re working through your development process.

Webex Meetings APIs Sandbox

Our DevNet Sandboxes are provided by Cisco as a cloud service to help provide guidance for customers, partners, and developers as they integrate their solutions with Cisco technology. The sandboxes are a great way to have a personalized space to design, develop, and test customized integrations using Webex APIs.

Let us know how we’re doing!

We’re constantly looking to improve the experience for our developers to make it easier and faster to implement integrations. You can send us your feedback on how your experience is with our APIs in our developer forum to help us make improvements for the future.

Our redesigned navigation allows easier access to your core Webex Meetings functions, including (but not limited to): scheduling meetings; managing attendees, viewing meeting lists, cross-launching meetings, pulling usage reports, retrieving recordings, and more. With these tools, you’ll be able to seamlessly integrate Webex Meetings into your applications. In addition, we will be using this same portal to introduce new capabilities and new APIs going forward, so be sure to check back regularly for updates.

Continue reading

Promote Cloud Adoption in Education without Exposing Students to Risk

Cloud based collaboration is being adopted rapidly by organizations in all verticals, and education is no exception. Access to collaborative tools can’t be as simple as an on/off switch. School administrators need visibility to prevent the loss of sensitive data and to ensure that students aren’t engaging in inappropriate communication. On-premise policies must be equally enforced as students leverage cloud-based tools.

Allowing Only the Correct External Communications

Schools are quick to welcome collaborative platforms like Google Drive, Microsoft’s Office 365, and Dropbox. Cloudlock, an important piece of the Cisco Security portfolio, enables educators to enforce policies across these platforms to ensure that only the appropriate personnel are logging in. Cloudlock can detect logins from questionable locations and report on multiple failed logins to applications.

Umbrella, a cloud-based extra layer of security, can recognize requests made from an organization to dangerous domains. Policies can block security categories like malware, cryptomining, and command and control. Behavior policies can be leverage to prevent requests to inappropriate sites like gambling, alcohol, and adult themes.

Addressing Behaviors and Communications

Once students and personnel log in, policies can be enabled and enforced around communication. These pre-defined policies include categories like aggressive behavior, discrimination and cyberbullying. If students are engaging in these behaviors on collaboration platforms, administrators can be warned about incidents that violate these policies.

Additionally, pre-defined policies include language associated with self-harm, which would be present in shows like Netflix’s TV series 13 Reasons Why. School systems reacted to this show in varying ways including banning it, recommending that parents watch it with their children, and providing lists of resources designed to identify depression. The self-harm template provides an additional degree of visibility for educators and counselors into students’ interactions.

Protecting Access to Data for Compliance

School systems have compliance requirements also. One example is data included under the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99). This data is related to the transfer of students and access to it is restricted to the school systems involved, accrediting organizations and judicial parties overseeing these cases. Cloudlock contains templates that look for the sensitive “directory” information.

Finally, educational organizations look to ensure that only sanctioned cloud-based applications are installed and used on devices. Umbrella provides a cloud services report to identify applications that are requesting access to cloud services. This report can provide visibility into unsanctioned applications, allowing admins to restrict access to only applications sanctioned by the organization.

Continue reading

Meeting enterprise demands with dual rate 10/25G Ethernet

Enterprise networks are now being stressed by video conferencing and other demanding video applications that push beyond the speed limits of traditional 10G infrastructure.  Whether it’s IEEE802.11ax WiFi Access Points, that require 1G/2.5G/5G/10G backhaul interfaces or 1G/2.5G/5G/10G direct copper/fiber Ethernet to the desktop, new enterprises are being built for high speed that now requires 25G interfaces.

Using Cisco’s new enterprise Catalyst 9000 Family Switches and Cisco’s new SFP-10/25G-CSR-S transceivers, customers can connect Wiring Closet Switches to Aggregation Switches with 25G over MultiMode Fiber (MMF).

What is “CSR”?

“CSR” stands for Cisco Short Reach.  Using advanced optical technology, Cisco is able to provide 25Gbps bandwidth at distances up to 300/400m* over OM3/4 MMF. While providing these extended reaches, the new SFP-10/25G-CSR-S transceiver is fully interoperable with traditional IEEE 802.3by 25G transceivers that only provide 25Gbps at distances up to 70/100m over OM3/4 MMF.

Why is 300/400m over OM3/4 MMF important?

Traditional 10G networks are being built (or have been built) based upon IEEE802.3 specifications (10GBASE-SR) that allow 300/400m distances over OM3/4 MMF.   These distances are well established by network installers which has resulted in Wiring Closets being located up 300 (or 400m) from Computer Rooms/Data Centers.

Cisco’s new SFP-10/25G-CSR transceiver enables 25G over MMF at the same distance as 10GBASE-SR, which means that if the fiber infrastructure worked at 10G, it will also work with SFP-10/25G-CSR. This is not the case with IEEE 25GBASE-SR because its reach is shorter.

Interoperability with 10G

The new SFP-10/25G-CSR transceiver has dual rate capability that allows interoperability with both 25GBASE-SR and 10GBASE-SR MMF transceivers**. This allows the network to be incrementally upgraded at either the end of the fiber.

Interoperability with 40G and 100G

The new SFP-10/25G-CSR can also interoperate with 100GBASE-SR4 and 40GBASE-SR4 transceivers using 3rd party MMF breakout cables. For 100G interoperability, 25G requires the use of RS-FEC (Forward Error Correction), which is available on Cisco’s 100G ports.

See this video for further information

Continue reading