Archiv für das Monat: März, 2020

By Dr. Gee Rittenhouse Helping employees, customers and partners in a time of need is one of Cisco’s core values. Right now, COVID-19 is forcing many people around the world to work remotely. This is putting a sudden strain on both IT and security teams who are being tasked with providing support for an unprecedented number of offsite workers and their devices.
Recently, Cisco Webex expanded its free offerings to allow employees to stay connected to their teams and continue their business operations. Today, Cisco is broadening this offer to include security for remote employees by providing extended free licenses and expanded usage counts at no extra charge for three of our key security technologies that are designed to protect remote workers anywhere, anytime and on any device.
Cisco Umbrella protects users from malicious Internet destinations whether they are on or off the network. Because it is delivered from the cloud, Umbrella makes it easy to protect users everywhere in minutes. With this offer, existing customers can exceed their user limit to support an increase in remote workers, and new customers can access a free license.
Duo Security enables organizations to verify users‘ identities and establish device trust before granting access to applications. By employing a zero-trust model, it decreases the attack surface and reduces risk. With this offer, existing customers can exceed their user limit to support an increase in remote workers, and new customers can access a free license.
Cisco AnyConnect Secure Mobility Client empowers employees to work from anywhere on company laptops or personal mobile devices. It also provides the visibility and control security teams need to identify who and which devices are accessing their infrastructure. Existing AnyConnect customers can exceed their user limit to support an increase in remote workers, and new customers can access a free license. To get started, existing and new customers should talk with a Cisco representative or partner to get the requested usage counts.
These offers will be available from now until July 1, 2020. Supporting our customers and partners remains a top priority, and we hope these proactive steps help companies manage the business impact and keep employees safe during this evolving situation.
The post As the Number of Remote Workers Rises, Cisco Supports Customers with Expansion of Free Security Offerings appeared first on Cisco Blogs .

Source:: Cisco Security Notice

By Paul Burdette Last week, for the fourth time in the last five years, Cisco Identity Services Engine (ISE) was recognized as the top solution in the Trust Awards category for Best NAC Solution at the 2020 SC Awards. The announcement was made on Tuesday, February 25, 2020 during the 24th annual SC Awards gala in San Francisco, presented by SC Media, a CyberRisk Alliance company.

Receiving this award during the RSA Conference, where the world goes to talk security, is a great achievement and a testament to our team, which has been pushing innovation within ISE and leading the network access control (NAC) market for almost ten years. We thank SC Media for this honor, and we see this award as further validation that Cisco ISE is the linchpin solution for zero trust in the workplace, in both IT and OT environments.
How did we do it?
Winning this award is no small feat. SC Media has been arming cybersecurity professionals with unbiased information and analysis for over thirty years. They are respected in the industry, and here at Cisco.
When asked why Cisco, and why ISE, Illena Armstrong, VP, editorial, SC Media said – “Our judges considered many strong candidates this year for the Trust Awards category, but a select few stood out, excelling in key areas such as functionality, innovation, scalability, ease of use, cost of ownership, return on investment, and customer friendliness. Cisco (and Identity Services Engine) truly emerged as a heavy hitter in a crowded field of players.”
Garnering these accolades from the market and your peers is always great. But at Cisco, when we win, our customers win, because we know we are solving their top security challenges, and that is awesome! Cisco ISE has been helping customers gain the visibility they need to enable secure access and control since 2011. This level of continual innovation only furthers the endorsement of our more than 30,000 customers around the globe.
According to Shannon Cranko, Principal Engineer with Dimension Data, Cisco ISE “is the most comprehensive and complete NAC product that exists, with the ability to scale without buying additional products and licensing.”
What makes ISE so cool?
SC Media attributed this award in part to Cisco ISE’s extensive ecosystem for automated solution integration – with technologies such as Cisco Stealthwatch as well as third-party solutions. Through our standards-based integration platform, called pxGrid, ISE adds an actionable arm of policy enforcement to passive security solutions, accelerating their value and enabling an unprecedented level of dynamic threat containment to limit the lateral movement of threats like ransomware.
According to SC Media, “Cisco ISE users can expect a positive impact on economics and an impressive return on investment.” It cites a Forrester report, which found that organizations using ISE have seen savings of about $1.9 million, and that some have achieved 120 percent ROI with a payback period of just 12 months.
Protecting the future with ISE
As with most Cisco Security solutions, ISE is highly scalable, supporting a staggering 2 million concurrent endpoint sessions. Achieving scale is critical as our customers take on IoT and are bringing more and more connected devices into both their IT and OT environments.
Also, ISE is not just enabling zero trust in the workplace with secure access and control for today’s network. As our customers migrate to embrace the ease of automation and management within Cisco’s DNA Center, ISE is the centerpiece for policy enforcement within SD-Access. So, when customers choose ISE for network visibility and segmentation, and to contain threats, they are also choosing to add future value and simplify their secure network operations. And this is why ISE is so well positioned to continue dominating the market well into the future.
For more information
The ISE age is far from over! We are looking ahead and aim to be a trusted partner for years to come, offering an integral solution from one of the world’s top security companies. More exciting announcements for ISE and Cisco Security are coming in the months ahead. Visit our Cisco ISE page for more information. We would love to give you a demo of this award-winning solution.
The post Cisco Identity Services Engine wins…again! appeared first on Cisco Blogs .

Source:: Cisco Security Notice

By Ganesh Umapathy Cisco’s recently released their 2020 CISO Benchmark Report that makes several key recommendations for security professionals to achieve a zero trust vision. The following are a couple of recommendations that are relevant to the discussion in this blog regarding device trust:
More than half (52%) of the respondents said that mobile devices are now very or extremely challenging to defend. Solution: Have an up-to-date asset inventory that distinguishes between managed and unmanaged devices, providing a hygienic check on them as part of an integrated IT and security function.
Forty-six percent of organizations (up from 30% in last year’s report) had a security incident caused by an unpatched vulnerability. Solution: Organizations should maintain an up-to-date inventory of all devices in their environment and perform a risk analysis for any missing patches
Enterprise IT networks have changed significantly in the last few years. Businesses are leveraging cloud and mobile technologies to enable faster digital transformation. At the same time, IT teams need to optimize for cost and productivity.
From a cybersecurity standpoint, this means enabling secure and direct access to business applications for a diverse set of users – remote workers, vendors and contractors; and their devices that typically reside outside of the control of corporate EMM (enterprise mobility management) and MDM (mobile device management) solutions.
Enforcing security policy compliance seamlessly across managed, BYOD and 3rd-party devices poses a significant challenge for the security team. In most cases, IT security teams lack the insights and an enforcement mechanism when making an access decision on endpoints, particularly among the unmanaged devices. There’s a few key checks that organizations should perform before granting access in order to attest whether a device is trustworthy:
Is the device managed?
Is the operating system (OS) version and the patch level up to date?
Is the enterprise antivirus (AV) agent installed and running?
Is disk encryption turned ON?
Does the device have a password set?
How Duo Verifies Device Trust
Duo enables organizations to verify the trustworthiness of any device – managed or unmanaged – by providing the following three key capabilities:
Complete Visibility: Visibility is important to verify and enforce device trust policies. Duo provides in-depth device visibility across all major operating systems, and helps administrators differentiate between corporate-managed devices and BYOD, based on the enrollment status in device management systems.

Duo’s extensive logging and reporting enables organizations to maintain inventory of all devices accessing corporate resources. A comprehensive dashboard helps administrators understand the overall organizational security posture, and a quick drill-down with a few clicks allows them to identify users that are using risky devices running out-of-date operating systems (OS), browsers, Flash and Java versions. And all of this data can be easily exported to popular log management and analysis tools.
Assess Device Posture: Duo makes it easy for organizations to gain just the right level of visibility needed to verify the trust of any device that requires access to corporate data. Administrators can enforce corporate security policy compliance and block non-compliant devices at the time of authentication. Duo becomes a critical enforcement point to ensure that users maintain an acceptable level of device hygiene, whether it is updating the OS patch level or enabling security features such as enterprise AV agents and disk encryption, before granting application access.

Duo’s novel approach to assessing device health posture is geared to address the diverse population of managed and unmanaged devices that access enterprise networks. Duo helps administrators ensure that their endpoint fleet is in compliance with corporate security policies and empowers end users with self-remediation, which reduces the number of IT tickets raised or calls to a support help desk.
Continuous Inspection: Organizations have limited IT resources (staff and tools), and find it tough to effectively respond to endpoint security events, especially when those devices are outside the network. By integrating Cisco AMP for endpoints with Duo, organizations can set a policy to automatically block malware-infected devices from accessing applications. Duo blocks only the device and the user can log in from any other device that is policy-compliant in order to be productive.

Learn more about Duo’s Device Trust.
Use Cases For Duo Device Trust
Use Case
Duo Feature
Implementation Option
Maintain inventory of all devices accessing protected applications
Device Insight
Agentless / Browser-based
Enforce risk-based access controls for managed and unmanaged devices (BYOD)
Device Insight

Agentless / Browser-based

Device Health App
(MacOS, Windows);
Duo Mobile App
(iOS, Android)
Application-based (offers granular control)
Protect your environment and limit access to corporate-managed devices
Trusted Endpoints
(Works with JAMF Pro, AirWatch/ Workspace ONE, MobileIron, Microsoft Intune, etc….)

Certificate-based
Three Reasons To Choose Duo
Duo offers the most comprehensive user trust and device trust capabilities in the market today that cater to a wide variety of use cases and a diverse population of workforce devices (managed and unmanaged).
Duo helps organizations to improve security in a manner that is user friendly and enables productivity. Users are empowered with self-remediation for out-of-policy devices, so security does not interrupt daily tasks.
Duo is focused on integrating across the Cisco Security portfolio so that customers can reduce their total cost of ownership (TCO) by consolidating security vendors, streamlining security operations and enabling automation.
For organizations, all this translates to reducing cyber risk and enforcing cyber hygiene. Try it for free by signing up for a 30-day trial.
The post Enforce Endpoint Compliance and Cyber Hygiene With Duo Device Trust appeared first on Cisco Blogs .

Source:: Cisco Security Notice

By Talos Group Bisonal is a remote access trojan (RAT) that’s part of the Tonto Team arsenal. The peculiarity of the RAT is that it’s been in use for more than 10 years — this is an uncommon and long period for malware. Over the years, it has evolved and adapted mechanisms to avoid detection while keeping the core of its RAT the same. We identified specific functions here for more than six years.
This is an extremely experienced group likely to keep their activities even after exposure, even if we identified mistakes and bad copy/paste, they are doing this job for more than 10 years. We think that exposing this malware, explaining the behavior and the campaigns where Bisonal was used is important to protect the potential future targets. The targets to this point are located in the public and private sectors with a focus on Russia, Japan and South Korea. We recommend the entities located in this area to prepare for this malware and actor and implement detections based on the technical details provided in this article.
More >>
The post Bisonal: 10 years of play appeared first on Cisco Blogs .

Source:: Cisco Security Notice