SaaS-delivered Encrypted Traffic Analytics with Cisco Stealthwatch Cloud

We’ve reached an interesting turning point for encrypted traffic.

Gartner predicted that 80% of web traffic would be encrypted by 2019. Sure enough, this prediction came true. Last year, the team at Let’s Encrypt, an organization that helps enable encryption for websites, cited that 80% of web traffic they’ve seen is now encrypted. We have reached the point where the average volume of encrypted traffic on the internet has now surpassed the average volume of unencrypted traffic.

This is largely good news, as moving forward, encrypting internet traffic is now the new norm online and will continue to grow. This is good for data privacy and should let us sleep a bit easier knowing that as out information traverses the internet, it’ll be encrypted.

However, much like the adoption rate of encrypted traffic, encrypted threats are also on the rise. This year, Gartner has predicted that more than 70% of malware campaigns will use some type of encryption to conceal malware delivery, command-and-control activity, or data exfiltration. Complicating matters, it’s also predicted that 60% of organizations will fail to decrypt HTTPS efficiently, thereby missing critical encrypted threats.

Traditional threat inspection methods that rely on bulk decryption, analysis, and re-encryption are not always practical or feasible, for both performance and resource reasons. These methods also compromise privacy and data integrity. Unfortunately, many organizations do not have a way to detect malicious activity in encrypted traffic without the use of decryption. With the growing amount of encrypted traffic and the number of threats hiding within it, how should organizations ensure the encrypted traffic coming into their network is safe, without compromising the integrity of that data?

A better approach to analyzing encrypted traffic

Stealthwatch Cloud is a Software-as-a-Service (SaaS) solution that is easy to try, easy to buy, and simple to operate and maintain. Stealthwatch Cloud analyzes network behavior to detect advanced threats, even those hiding in encrypted traffic. Cisco’s proprietary Encrypted Traffic Analytics (ETA) technology uses attributes like Initial Data Packet (IDP) to detect malware in encrypted traffic, without decrypting the data.

Recently, Stealthwatch Cloud has added further integrations with Cognitive Intelligence, our amazing cloud-based machine learning and AI R&D team as well as its Confirmed Threat Service.

These integrations allow Stealthwatch Cloud to ingest ETA telemetry from supported Cisco networking devices and provide additional, enhanced fidelity of encrypted (as well as non-encrypted) traffic. From there, ETA will alert users of potential threats that might be hiding in encrypted traffic. These alerts include cryptomining, unpublished TOR, botnets, Ramnit, Sality, malicious file download, phishing and typosquatting and more.

In a performance study by Miercom, Cisco Encrypted Traffic Analytics showed as much as 36% faster rates of detection, finding 100% of threats in three hours. Furthermore, the study found that Cisco ETA detected 100% of malicious flows within three hours

How it Works

Cognitive Intelligence’s Confirmed Threat Service provides Stealthwatch Cloud with a list of high-confidence Indicators of Compromise (IOCs in the form of IPs and domains), a full description of the related global threat, and a write-up of recommended remediation steps. These IOCs are generated as a result of processing billions of connections from across the globe using a pipeline of analytical techniques which include the collection of Initial Data Packets. In essence, the Confirmed Threat Service is the outcome of multi-layered machine learning and encrypted traffic analytics that can convict known as well as unknown global threat campaigns. Cisco ETA can match field data extracted from the IDP against known IOCs which allows Stealthwatch Cloud to then correlate local customer telemetry to the global Confirmed Threat Service.

New alerts created via this threat intelligence will show up as “Confirmed Threat Watchlist Hit” alerts. These alerts can include named malware type families and also provide details on what they do (exfiltration, exploit, content distribution, botnets, ransomware, etc). Some of the threat intelligence provided by the Confirmed Threat Service is created in collaboration with Cisco Talos. Talos will seed intelligence (initial set of seed IOCs), title and description of a threat. Cognitive Intelligence will then expand this seed set of IOCs with new occurrences using information gathered from IDPs and machine learning – which in turn yields new IPs and domains that are also related to the given threat and appear in real customer telemetry.

Meeting Compliance Needs

In addition to being able to effectively monitor encrypted traffic coming into their network, organizations also have to consider how they use encryption on their own data. When using encryption for data privacy and protection, an organization should be able to answer major questions:

How much of the digital business uses strong encryption?

What is the quality of that encryption?

This information is critical to prevent threat actors from getting into the encrypted stream in the first place. Today, the only way to ensure that encrypted traffic is policy compliant is to perform periodic audits to look for any TLS violations. However, this method isn’t perfect due to the sheer number of devices and the amount of traffic flowing through most businesses.

Cisco Encrypted Traffic Analytics provides continuous monitoring without the cost and time overhead of decryption-based monitoring. Using the collected enhanced telemetry, Stealthwatch provides the ability to view and search on parameters such as encryption key exchange, encryption algorithm, key length, TLS/SSL version, etc. to help ensure cryptographic compliance.

Together, Cisco ETA and Stealthwatch Cloud can also identify encryption quality instantly from every network conversation, providing organizations with the visibility to ensure enterprise compliance with cryptographic protocols. These tools deliver the knowledge of what is being encrypted and what is not being encrypted on your network so you can confidently claim that your digital business is protected and compliant. This cryptographic assessment is displayed in Stealthwatch Cloud and can be exported via APIs to third-party tools for monitoring and auditing of encryption compliance.

Continue reading

Five Tips on Working from Home from a 20-Year Work from Home Veteran

In my work career, I’ve spent almost the last 20 years working from home and have learned a lot in the process. For the last 14 years, I have also been fortunate to work for Cisco, a company that embraced the remote work force way before many of our peers. Mobilizing our 73,000+ employees to work remotely has been a relatively seamless process given that we sell world class security, networking and video/voice collaboration technologies that our employees, partners and customers need to get their jobs done at home.

Many of us and our partners will be working from home for the foreseeable future. Here are my five best practices (and lessons learned) for making the most of your work situation.

1. It’s easy to work a 16-hour day from home – so don’t!  

Schedule your day. Establish some structure by knowing when you want to start and finish. It’s easy to keep working or return to work late in the evening, as you have everything you need right there. But it’s healthier to maintain set work hours. I often forget that point and pay a price (as does my family).

2. Avoid bringing work into the family environment. 

If you have deadlines, escalations and other intense (which is code for “stressful”) situations, be aware of the impact it can have on your family members. They may see or overhear you handling difficult issues and, as a result, they might internalize that stress or worry. Over the years, I’ve become more conscious about this, especially as I took on more senior positions with greater scope and responsibilities over multiple time zones. And candidly, I’ve not always managed this very well.

3. Manage your home time carefully.

Not having that commute can be fantastic. In fact, staying home makes it easier to engage in family time. But it’s important to manage it so you don’t get burned out by being home all day (and night). There have been times when I haven’t left the house and have let three days go by without crossing my front door. Don’t let that happen to you!

4. Be respectful and patient of other team members’ home office environments and that some people can’t work from home. 

Some folks will have home offices that are well established, with a professional look and configuration. Others, who are new to working from home, may not. Some may struggle to carve out a workspace in their homes or need to share that work environment with a spouse or significant other, which can cause background noise and distractions. If you hear a dog bark or a baby cry, please be patient with them. I will never forget when my 4-year-old son walked into my office naked in the middle of a Telepresence (video) call one morning, asking me to play with him. A very innocent mishap and thankfully everyone was understanding on the video call.

It is important to keep in mind not everyone has the benefit of working from home. Stay supportive and empathetic to everyone’s work situation. Also, be sure to help your local small businesses even when you are at home, whether picking up food for dinner from a local restaurant or buying a gift card that you can use later. Let’s all try and help keep the least amount of impact to businesses that we can!

5. Structure your day with breaks. Walk the block, smell the roses, or do a call from the backyard. If the walls start closing in, change your scenery:

◉ Schedule lunch and eat it away from your office. This was a huge lesson learned, as I would put in 12-hour days (or later) with back-to-back calls and forget to eat or eat poorly. You need both a mental and nutritional break, so take a lunch break. But do it away from your computer.

◉ Don’t forget to exercise. Some folks will squeeze in a quick run, hit the Peloton, or go to the gym for 30 minutes. Follow their leads – it’s a great way to clear out the mental cobwebs and re-energize your body.

◉ Starbucks can be your friend. A coffee break with Wi-Fi is a good thing for getting you out of the house (especially if you sit outside and manage the COVID-19 six-foot distance from other people rule).

◉ Schedule quick 15-minute calls with colleagues or friends. Under normal office circumstances, you might enjoy catching up with folks over the water cooler. While you are home, simulate that connection by scheduling WebEx calls with your buddies. Talking to them not only refreshes your brain but is great therapy.

Continue reading

Care and Quality When it Matters Most: IT preparedness for COVID-19

At Cisco, we have asked thousands of our employees around the world to work from home. Most of them came to the office every day. Other companies have also taken this step, and many more will do so soon. We are all motivated by the same things: care for the people we work with, a desire for everyone to stay healthy, and the hope that by preventing community transmission we can shorten this period of disruption.

While our teams are at home, we want to support them in every way we can, which includes helping them be productive in their jobs so they can continue to drive towards their goals. Although we have a strong culture that supports remote work when it makes sense, and amazing technology to enable it, this shift can still be daunting.  At Cisco, we’ve always had business continuity planning and even though the plan exists for shutting down corporate headquarters, it’s never too late to take one more look before everyone leaves the building.  Here are the questions we’ve been asking.  Maybe some of them may help you, too.

Thanks so much, stay healthy, and please let us know how we can help.

Is IT ready to handle a spike in support calls and tickets?

Some employees new to working from home will need help. In addition, regardless of planning, systems may glitch when exposed to multiples of their regular loads. We have to be ready for a spike in IT cases.

There is no easy way to dramatically staff up IT to the extent that might be called for, at least not quickly. Proactive advice to employees is critical. Send notes on how your remote work tools function, and how to set them up. If possible, encourage people to test work-from-home tools, like their VPN software, while they are still in the office.

And remember that people will pull together in a crisis. Your community is a powerful resource. Setting up employees to support each other, via online chat tools, wikis, forums, and email lists can reduce the load on IT.

Is your VPN ready for the load?

If your business has resources behind a corporate firewall, it’s likely that your users will connect to them using a virtual private network (VPN). The VPN concentrator that connects these users to your corporate network may not be configured for the new load of remote users.

It might be time to do a few things to increase your capability to handle an increased load. Obviously, you can acquire more VPN concentrators and get them installed

Check your IP pool. The new load of remote workers could outnumber the IP addresses in the pool reserved for external access. The pool can be increased by your staff.

Employees can be asked to not use their VPN-connected work computers for non-work tasks. During this crisis, it is fair to ask employees to be disciplined in their use of company resources.  You might be shocked at the amount of cat videos streamed through your corporate VPN.  Blocking entertainment sites like Netflix and Hulu could also be a part of this strategy, but honestly, for most of us, asking employees would probably be just as effective and with less conflict.

Companies whose VPNs are configured to handle all traffic from workers’ devices might want to look at enabling split tunneling, where traffic destined for work resources goes over the VPN link, while internet bound traffic does not.  AnyConnect can even selectively split tunnel by whitelisting only IP ranges of trusted sites.  Just a few ranges can have a dramatic effect.  Of course, this would have security ramifications and it’s up to your security team to weigh the risks here.

You can also leverage Cisco’s Umbrella infrastructure to secure your Internet bound traffic instead of pushing more traffic through your VPN and security stack.  It’s remarkably easy to setup and can be done remotely.

Do Call Center Employees have the Teleworker equipment they need?

While many workers get productive by just connecting the laptops to the home ISP and your company VPN, that may not be true for call center employees or anyone with direct communication needs. There are teleworker gateways (including our own products) that will let these workers put their dedicated communications devices online from their homes.

Do you have enough raw network capacity? Do your employees?

Under the work-from-home scenario, network loads shift. Now is a good time to make sure your business’ network links are configured for more traffic. Depending on the types of links you have, it may be a simple and straightforward call to upgrade your committed information rate (CIR). If not, using the tips above to reduce network load might be even more relevant.

At your employees’ homes, ISP capacity may come in to play as well. Many ISPs today are configured to support massive loads to handle video streaming traffic. ISP execs say this traffic peaks at about 8pm every day, so during the lighter workday, there should be ample capacity to handle business networking needs, even video calling. Also, several ISPs are working to eliminate data caps and bandwidth throttling.

It is still possible that the work-from-home transition will tax consumer networks. As one of our IT practitioners says, “As you get further out from the company’s network, things are outside your control.”

Should performance for remote workers suffer, employees should know how to take measures to improve their online experience, especially in collaboration tools like video conferencing. Employees can turn off video during a call (if the software doesn’t adapt automatically to network issues), or even route audio to their phone.

Have you trained your employees in best practices for working remotely?

The nature of work changes when your teams are no longer sitting together. Some employees may be able to get more done, while others will find working from home isolating. More critically, the role of managing changes. Everyone, including people not working from home, will have to allot extra time and energy to staying in touch with the co-workers.

We have a number of remote working tips, including regular community time for all teams as well as a block every day where there’s a video bridge everyone on the team connects to, and people can call in to talk as available, get small things resolved and just catch up. It can be a comfort and social leveling function for everyone in a time of flux.

How can we make sure our teams feel cared for?

Depending on your industry, up to 100% of your teams may soon be working from home, and due to the exponential nature of viral spreads, the situation is likely to outpace traditional planning methodologies. If you do not have a business continuity plan that encompasses this type of crisis, we recommend you quickly address your workers’ technology needs, your internal network, and management policies. Open communication with all constituencies is vital.

And whether it’s as-needed all-hands meetings with the CEO and medical experts, or ramped-up management one-on-ones, it’s important everyone feels cared for during this time. We hosted our first company-wide Q&A session with corporate medical doctors on Covid-19 with just two hours notice and nearly 20,000 attendees. It was an indication of everyone’s hunger for information and connection.

When so much is uncertain and worrisome, I think it’s that much more important to make it possible for people to continue working with their teammates, and still find wins together. With the right management and technology behind them, at least this part of life can remain familiar and comfortable.

Continue reading

Setting a simple standard: Using MQTT at the edge

I shared examples of how organizations can benefit from edge computing – from enabling autonomous vehicles in transportation and preventive maintenance in manufacturing to streamlining compliance for utilities. I also recently shared examples on where the edge really is in edge computing. For operational leaders, edge compute use cases offer compelling business advantages. For IT leaders, such use cases require reliable protocols for enabling processing and transfer of data between applications and a host of IoT sensors and other devices. In this post, I’d like to explore MQ Telemetry Transport (MQTT) and why it has emerged as the best protocol for IoT communications in edge computing.

What is MQTT?

MQTT is the dominant standard used in IoT communications. It allows assets/sensors to publish data, for example, a weather sensor can publish the current temperature, wind metrics, etc. MQTT also defines how consumers can receive that data. For example, an application can listen to the published weather information and take local actions, like starting a watering system.

Why is MQTT ideal for edge computing?

There are three primary reasons for using this lightweight, open-source protocol at the edge. Because of its simplicity, MQTT doesn’t require much processing or battery power from devices. With the ability to use very small message headers, MQTT doesn’t demand much bandwidth, either. MQTT also makes it possible to define different quality of service levels for messages – enabling control over how many times messages are sent and what kind of handshakes are required to complete them.

How does MQTT work?

The core of the MQTT protocol are clients and servers that send many-to-many communications between multiple clients using the following:

◉ Topics provide a way of categorizing the types of message that may be sent. As one example, if a sensor measures temperature, the topic might be defined as “TEMP” and the sensor sends messages labeled “TEMP.”

◉ Publishers include the sensors that are configured to send out messages containing data. In the “TEMP” example, the sensor would be considered the publisher.

◉ In addition to transmitting data, IoT devices can be configured as subscribers that receive data related to pre-defined topics. Devices can subscribe to multiple topics.

◉ The broker is the server at the center of it all, transmitting published messages to servers or clients that have subscribed to specific topics.

Why choose MQTT over other protocols?

HTTP, Advanced Message Queuing Protocol (AMQP) and Constrained Application Protocol (CoAP) are other potential options at the edge. Although I could write extensively on each, for the purposes of this blog, I would like to share some comparative highlights.

A decade ago, HTTP would have seemed the obvious choice. However, it is not well suited to IoT use cases, which are driven by trigger events or statuses. HTTP would need to poll a device continuously to check for those triggers – an approach that is inefficient and requires extra processing and battery power. With MQTT, the subscribed device merely “listens” for the message without the need for continuous polling.

The choice between AMQP and MQTT boils down to the requirements in a specific environment or implementation. AMQP offers greater scalability and flexibility but is more verbose; while MQTT provides simplicity, AMQP requires multiple steps to publish a message to a node. There are some cases where it will make sense to use AMQP at the edge. Even then, however, MQTT will likely be needed for areas demanding a lightweight, low-footprint option.

Finally, like MQTT, CoAP offers a low footprint. But unlike the many-to-many communication of MQTT, CoAP is a one-to-one protocol. What’s more, it’s best suited to a state transfer model – not the event-based model commonly required for IoT edge compute.

These are among the reasons Cisco has adopted MQTT as the standard protocol for one of our imminent product launches. Stay tuned for more information about the product – and the ways it enables effective computing at the IoT edge.

Continue reading

Okta Now Offering Free Single-Sign On and Provisioning for Cisco Webex

Okta Cloud Connect Integrates Webex with Active Directory/LDAP for Fast and Free Single Sign-On and Provisioning

Okta is a single platform for identity management – Cisco Webex is a single platform for all of your collaboration needs. And now we’re even better together.

Okta’s mission is to enable any organization to use any technology. Okta enables companies to easily provision applications, and then allow employees, customers, and partners to access applications and infrastructure in a secure and seamless way, other tools more smoothly and securely than ever before.

Okta is one of the most complete identity and access management platforms for workforces and customers, securing all critical resources from cloud to ground.

Born in the cloud, Okta provides an identity management cloud platform that enables customers to secure their users and connect them to the technologies and applications used by their IT department.

Okta and Cisco have worked together to make sure that we could deliver the most complete IDaaS solution for all Cisco Collaboration applications.

There were a couple of challenges to address:

Provisioning

Okta needed to provision users across a different cloud to Cisco Webex. Okta needed to push information in a secure way about users to the Cisco Webex platform and to achieve that, we used SCIM protocol.

It is an open standard for automating the exchange of user identity information between identity domains, or IT systems. It allows for provisioning and de-provisioning operations between different systems. In addition, it allows to systems to share information about user attributes, group membership, and attributes schema.

For customers that still use Webex Meetings with Identity Management user Site Admin, Okta uses the XML APIs from Webex meetings to be able to deliver provision functions for the solution.

Okta also supports just-in-time provisioning of SAML JIT, but the usage of it only allows for provisioning, which is insufficient for most of our customer needs.

Okta provisions users in Cisco on-premise products. Two possible solutions could be used:

◉ Both Okta and Cisco on-premise collaboration solutions get information about users from the same source such as an LDAP service like Active Directory

◉ For those customers that no longer have an on-premise LDAP service, Okta can provide LDAPS service for Cisco on-premise Collaboration solution

Authentication and Authorization

Okta supports many types of authentication mechanisms like Secure Web Authentication, SAML 2.0 or OpenID Connect. Typically, most customers have their applications supporting SAML 2.0 protocol, to deliver single sign-on and implementing a central authentication policy.

Cisco’s on-premise application requires support for multiple servers to act as a single SAML entity, and for that to work we require a SAML feature called Multiple Assertion Consumer Service URL’s. This allows for multiple nodes in a cluster to provide information to the IdP to which node to send the SAML assertion. Okta was the first IDaaS vendor to implement that feature, allowing the on-premise collaboration tools to work with it.

Better Together For our customers

Cisco and Okta provide unique value for our customers, allowing them to increase the security of their overall collaboration solution, but at the same time having a platform that would increase the overall security for all the IT applications in their portfolio.

Okta went one step further and offers the full feature IDaaS product only for Webex applications – allowing our join customers that don’t yet an Identity strategy to deploy the best in the market IDaaS solution and in the future extending the identity solution to all their other applications.

Get Okta Single-Sign On for Webex for Free

You can get Okta single-sign-on for Webex for free.

Continue reading

How to Defend Against Command-and-Control attacks: Don’t let your network turn into a Zombie

Your network is increasingly targeted by cybercriminals. One of the most clever and damaging way they strike is through command and control attacks – a technique often executed over DNS. A command-and-control (also referred to as C&C or C2) server is an endpoint compromised and controlled by an attacker. Devices on your network can be commandeered by a cybercriminal to become a command center or a bonet (a term coined by a combination of the words “robot” and “network”) with the intention of obtaining full network control. Establishing C&C communications via a Trojan horse is an important step for them to move laterally inside your network, infecting machines with the intent to exfiltrate data.

Going After the Command-and-Control Servers

What does your new investigation workflow look like? Today we take a closer look at how a C&C server attack can gain a foothold into your network, and how Cisco can identify, detect and block this type of threat using an integrated approach to security.

Imagine a security analyst whose enterprise has invested in network traffic analysis. Let’s call him Sam. He works for large financial services organization with over 10,000 employees and more than 80,000 user accounts. It’s 6:00 PM on a Friday evening and Sam is getting ready to catch the latest Zombie apocalypse movie with his buddies. A notification pops up on his Cisco Umbrella console telling him that Umbrella has blocked malware from communicating with a C&C channel.

Sam investigates this threat using the Cisco Security

Sam is tired. He spends copious amounts of time running down rabbit holes every time his SIEM registers an alert as suspicious. He is ready for a faster, more effective way to block threats and protect his environment. He is excited to see if Cisco Umbrella, a secure internet gateway, will make his life easier. Cisco Umbrella offers both real-time threat Intelligence, as well as the capabilities to mitigate attacks across an organization in a split second. It acts as the first line of defense against internet-borne threats like C&C communications attempting to exfiltrate data. Sam knows a DNS block on the Umbrella can simply be a symptom of persistent malware on your endpoints. He investigates further.

Sam identifies the malicious domain that is the epicenter of a C&C activity using Umbrella. Umbrella automatically proxies, decrypts, and inspects all subsequent requests with AMP for Endpoint to make a determination about the threat. Sam can also choose to block newly seen domains outright on the console. Now, while Sam knows that not all newly seen domains are bad, he knows this could be part of an emerging malware campaign or associated with another threat. In this case, Sam sees that Umbrella is working and has successfully blocked the threat.

Figure1: Identify the C&C Domain in Umbrella

But Sam is curious. He wants to know more. Sam decides to analyze the malicious code and try to identify samples in Threat Grid, Cisco’s dynamic file analysis solution that referenced this domain. Umbrella Investigate shows him samples in Threat Grid that referenced this domain. He drills down deeper.

Figure 2: Sightings in Threat Grid that referenced this domain

Using the Threat Grid console, Sam quickly realizes the file is malicious. He sees two internal targets that can be potentially compromised with this attack. If successful, this infected server could connect to another server, ready to receive commands and do the botnet owner’s bidding by compromising systems and exfiltrating your data.

Figure 3: The Aha! moment: The Malicious Verdict

Sam is close to the Aha moment! He drills down to understand the behavioral indicators in Threat Grid. He gets every scrap of detail about this threat artifact. And sure enough, there’s our C&C connection. Victory!

Figure 4: Discovery: There’s our C&C connection.

But Sam wants more. Threat Grid also shows him the internal target that might need further analysis. It analyzes the files and suspicious behavior across his environment to deliver context-rich malware analytics and threat intelligence. Now that he is armed with insights into what the file is doing, he is ready to explore how this threat has impacted the network. Sam kick starts a threat investigation for observed internal targets in Cisco Threat Response using the Browser Plugin. The Plugin enables Sam to research any observable (e.g. Domain, IP-address, File-Hash, URL, etc.), on any HTML-based webpage, in Chrome. Interested in what Sam is doing? 

Sam now knows which systems inside our network have seen the malicious file. This information is provided by AMP for Endpoint, our cloud-delivered endpoint protection, detection and response solution, that helps you simplify this investigations with a broader context from endpoint, web, email, and network data.

Figure 5: The Pivot to Threat Response

Figure 6: Getting the Full Picture – the Relations Graph in Threat Response

Upon investigation, Sam confirms that the malware is already correctly identified and blocked. With Cisco Threat Response, Sam can now achieve faster detections, simpler investigations, and immediate responses.

Figure 7: Malware Identified and Blocked

For all the Sam’s of the world, this analysis can be at your fingertips too. With Threat Grid, you can easily construct a query using the Orbital Advanced Search feature, a new advanced capability in Cisco AMP for Endpoints based on the behavior observed when the sample executed. This feature accelerates your hunt for threats and enables you to shrink the lifecycle of an incident– mitigating any or further damaging cost of the breach to your business.

Figure 8: Orbital Advanced Search Query in Threat Grid

This Orbital query enables you to gain deeper visibility so you may discern whether this is an isolated incident in your network, or there are other devices that may have seen this in your network. Additionally, Threat Grid can shine a light on other techniques like code injection that attackers might be using based on key behavioral indicators of malware. Security teams can save time by quickly prioritizing attacks with the biggest potential impact. In our investigation, we have discovered important details about this attack, as well as the malicious, forged documents that the attackers are using.

Figure 9: Orbital Query, Figure 10: Potential Code Injection Detected

Cisco Advanced Malware Protection (AMP) for Endpoints Prevents Fileless Attacks

AMP for Endpoints’ Exploit Prevention engine prevents all variants of fileless malware without needing any prior knowledge of the attacks. There are thousands of threats attempting to embed malicious code that can take over your workflows. Sam makes sure that the Exploit Prevention engine is enabled in AMP to catch any such activity.

Sounds too good to be true. No way?

Figure 11: File is quarantined

AMP’s Exploit Prevention Engine remaps the runtime environment and its components (such as libraries and DLL entry and exit points) and places a decoy or a facade of these resources in their original locations. It then only let’s legitimate applications know their newly randomized address spaces. The end result is that legitimate processes continue to run seamlessly without experiencing any performance penalty, but anything else that attempts to execute in-memory can’t find its target, and therefore, cannot execute. Exploit Prevention’s remapping of the runtime environment effectively protects you against all variants of in-memory attacks, whether they are pre-existing or undiscovered zero-days deterministically. With that done, Sam is on his way to the movies.

Cisco’s Security Platform

Can you imagine flying an Airbus A380 without an air traffic controller? Cisco’s vision for a security platform is built from a simple idea that security solutions should act as a team, learning from each other, listening and responding as a coordinated unit. Our platform, Cisco SecureX,connects the breadth of Cisco’s integrated security portfolio and your entire security infrastructure for a consistent experience that unifies visibility, enables automation, and strengthens your security across your network, endpoints, cloud, and applications.

Try AMP for Endpoint

You could test out AMP for Endpoints and decide whether it’s right for you in under an hour. Don’t let C&C servers sit dormant in your environment and turn your computers become someone else’s malicious botnet!

Continue reading

Is Your Company Still Experiencing Digital Transformation Challenges?

Digital transformation is essential for all businesses, from the smallest to the largest of enterprises. These businesses are striving to become more agile, innovate quickly, and respond to change faster – and they’re turning to modern applications to fuel that change. One of the first steps businesses need to take when commencing on a digital journey is to answer two critical questions: “What business outcomes do you want to achieve?” and “How will you overcome new demands digital transformation places on your IT teams?

There is a saying, “If you are not moving forward, you are falling behind.” This statement could not be any truer than it is in today’s complex and application centric environments.

The History of Digital Transformation

If we look back at Netflix’s journey to reshape markets through digital transformation, it’s easy to see how embracing digital transformation helped the company move forward. As most of us know, Netflix led the way for digital content when it started in 1997 by offering DVD rentals and sales via its website. Customers quickly saw the value in its data insights, called the “Personalized Recommendation System,” which used member ratings to accurately predict a user’s next movie choice. A decade later, in 2007, the company began offering streaming content for personal computers. Another decade passed and in 2017 Netflix won its first academy award for best documentary.

In its first 20 years, Netflix transformed its business model from mailing digital content to streaming digital content, and finally, creating digital content. Why did Netflix succeed when so many others didn’t? Because of its rapid adoption of digital transformation tools and apps. There were many companies that entered the space with Netflix, but those that didn’t embrace digital transformation not only couldn’t keep up, most are no longer in business.

In today’s application centric world, innovations need to happen in days or weeks, not decades. Is your company ensuring its application tools, operations, networking, and security features are working together to transform your business?

Application Challenges Landscape

All industries are making the shift to become more application centric, putting them into a place where they compete on application experience. But to compete effectively, they need to iterate quickly, learn with real-time telemetry, and get that feedback incorporated back into the business application. Changing the way companies monitor and maintain application availability, performance, and security means it’s imperative that they shift their operational model from siloed to collaborative teams. These collaborative teams then need to understand what’s going on from the business perspective to the user experience to the applications performance, the infrastructure, the network, and the security domain.

Enhance your day-to-day tools with a digital upgrade

Customers use many tools to monitor and alert when issues surface. Application Performance Monitoring (APM) and network performance monitoring tools give detailed insights within their silos. While those individual parts are important, what really matters is how those tools work together, as well as how they impact application performance and the end user experience.

Cisco is uniquely positioned with its broad product portfolio to provide the tools, insights, automations, and integrations that give users visibility across the entire stack, otherwise known as “full stack visibility.” This delivers insights into application-to-application dependencies, application-to-infrastructure dependencies, infrastructure performance and availability, infrastructure resources utilization (compute, storage, and memory), end-to-end visibility, and business outcomes. To improve performance and availabilty, protect the workload wherever it’s located, reach a faster MTTR, and maintain exceptional customer experience requires giving day-to-day tools a digital upgrade.

In order to ensure your company has the best digital journey possible, the following products offer additional insights and automation: 

Data Insight Tools

◉ AppDynamics (AppD). An application performance management (APM) tool that manages performance and availability of applications across cloud and DC. Appd baselines, monitors, and reports on the performance of all transactions that flow through your app.

◉ Cisco Workload Optimization Manager(CWOM). Software that continuously analyzes workload consumption, costs, and compliance constraints, while automatically allocating resources in real-time. It assures workload performance by giving workloads the resources they need, when they need them.

◉ Tetration. Hybrid-Cloud workload protection platform to secure workloads. Using machine learning, behavior analysis, and algorithmic approaches to offer holistic workload-protection strategy. This approach allows the implementation of true micro-segmentation, proactive identification of security incidents, and reduction of attack surface by identifying software vulnerabilities.

Automation Tools

◉ ACI anywhere. Technology that supports integrating virtual and physical workloads in a programmable, multi-hypervisor fabric to build a multiservice or cloud data center. The ACI fabric consists of discrete components that operate as routers and switches, but it is provisioned and monitored as a single entity.

◉ Intersight. A unified management platform that delivers intuitive management across data centers and remote locations from a single management platform. This platform offers an intelligent level of management that enables IT organizations to analyze, simplify, and automate their environments in ways that were not possible with prior generations of tools.

◉ Networks Assurance Engine (NAE). A comprehensive, intent-assurance solution that mathematically verifies the entire data center network for correctness, providing users with the confidence that the network is operating as intended.

◉ CloudCenter (CC). Multi-cloud management software that helps enterprises work with disparate environments. CC delivers workflow automation, ALM, cost optimization, and governance across multiple clouds.

It’s much easier to identify the root cause of an issue quickly and accurately with a tight integration of the above-mentioned products, third party applications, such as ServiceNow, InforBlox, Moogosoft, and more, along with end-to-end dependencies and the specific details of each layer. By doing this, your IT teams will work collaboratively and not in solitude.

A subset of the integrations and how the products collaborate to bring exceptional application experience

The diagram above shows how Cisco ACI, with AppD integration, identifies problems faster by correlating applications and network data. Cisco then provides the dynamic correlation between application and network constructs, and notes the problems with application services on a network fabric that can then be investigated by the application and networking teams, each with their own separate tools.

NAE will inform CWOM of any network anomalies so those issues are part of the recomendation process CWOM uses in its decision engine. NAE effectively makes CWOM “Network Aware,”  and CloudCenter will model an application and apply an AppD agent as part of that profile.  Deploying the AppD enabled profile using CC will allow the AppD controller to trigger action for CC based on metrics from AppD. Tetration and CWOM team up by using Tetration’s analytics.  CWOM can take Tetration’s application dependency mapping between endpoints by localizing chatty workloads that were across clusters, datacenters, and cloud to reduce latency.

Application Needs Rule the Day

It’s no longer adequate – or sustainable – to take a legacy approach to ensuring application experience, availability, and security are working properly in today’s technology environment. These modern day applications demand superior experience be delivered, whether they are executed on-prem, hybrid, or in cloud datacenters. Using a combination of tools from Cisco enables the scale, performance, visibility, and operational excellence needed for efficient deployment of all next-generation applications, helping companies overcome their greatest digital transformation challenges.

Continue reading