Archiv für das Jahr: 2020

By Sana Yousuf 29.3 billion – that’s the approximate number of devices and network connections estimated globally by 2023, according to the latest Cisco Annual Internet Report. As we get more connected, we can expect to see a massive rise in cybersecurity threats – a trend that is predicted to double from 9 million in 2018 to 15.4 million by 2023 globally. The increasing consumerization of IT and growing distributed network of users who access business critical applications are posing a real and serious challenge for security teams.
You need a platform that can meet your evolving enterprise needs to securely connect trusted users to the right applications on the network fast. You need a solution that is continuously nourished with contextual insights from your network to make access control decisions. But the real question is: How do you continually verify trust for both users and devices at scale when massive data and device proliferation is part of today’s reality?
Unifying User and Device Protection with Cisco Endpoint Security and Duo
We are beyond excited to announce that the integration between Cisco® Advanced Malware Protection (AMP) for Endpoints with Duo is now available. This powerful tandem unifies secure user access and device protection, empowering your zero-trust security platform for all users, devices and applications. This means endpoints that deemed infected or compromised will be blocked from accessing Duo-protected applications. With AMP for endpoint you get a comprehensive cloud-delivered next-generation antivirus endpoint protection platform (EPP), and advanced endpoint detection and response (EDR). It’s the endpoint security you need to stop breaches and block malware; then rapidly detect, contain, and remediates advanced threats that evade front-line defenses. On the other hand, Duo enables unified access security and multi-factor authentication (MFA) and contextual user access policies that can verify a user’s identity to ensure they are who they say they are and add more checks on the trustworthiness of devices through security health inspections.

“It’s not about getting rid of the perimeter – but rather tightening security on the inside. The new perimeter is less about the edge of the network, and now more about any place you make an access control decision.”
Wendy Nather, Head of Advisory CISOs, Cisco Duo, Summarized from Zero Trust: Going Beyond the Perimeter
Trust is neither Binary nor Permanent
Duo’s Trusted Endpoints feature lets you define and manage trusted endpoints and grant secure access to your organization’s applications with device certificate verification policies. Every time a user logs into an application using Duo, it reaches out to its cloud service that applies the Trusted Endpoints policy setting to the access attempt. The Duo prompt checks for the Duo device certificate in the user’s personal store. If present. Duo reports the endpoint as trusted. If the Duo certificate isn’t present, we report that the endpoint does not have a certificate (and is therefore not a managed endpoint). Application access may be blocked from that device. This helps you distinguish between unmanaged endpoints and managed endpoints that access your browser-based applications and enable you to set create newer policies within AMP. These new endpoints policies that we create would then tracks whether users accessing the applications have the Duo device certificate present or can block access to various applications from systems without the Duo certificate. The platform enables us to create synergy and harness integration touchpoints between technologies to basically see once and block everywhere.

Establishing Device Trust to Secure the Workforce: Visibility that informs Policy
AMP for Endpoint continuously monitoring and can quickly detect a threat, identify it’s point of origin, track its rate of progression, show you where else it’s been, see exactly what it is doing, and if it has infected any other endpoints on the network. When Duo and Cisco AMP for Endpoints have shared visibility into a Windows or macOS endpoint, Duo can block user access to applications protected by Duo from endpoints deemed compromised by AMP.

With zero-trust security from Duo, Cisco protects access to 3,000 applications for 120,000 users and 400,000 devices worldwide. Check out the ‘Duo + Cisco: Workforce Zero Trust‘ to learn more.
A Platform Approach to Security
Cisco’s vision for a security platform is built from a simple idea that we mentioned earlier -security solutions should act as a team, learning from each other, listening and responding as a coordinated unit. Our platform, Cisco SecureX, connects the breadth of Cisco’s integrated security portfolio and your entire security infrastructure for a consistent experience that unifies visibility, enables automation, and strengthens your security across your network, endpoints, cloud, and applications. We’re committed to creating a platform that delivers a better security experience at every point in your network. The seamless integration with other security technologies, backed by Talos threat intelligence, helps you block, detect, investigate, and respond to threats across your entire environment–not just at your endpoints.
Leverage Cisco Threat Response to accelerate threat investigations, Adaptive Multi-Factor Authentication (MFA) to enable zero trust and Cisco’s robust API to integrate with technology partners and get more value from your Cisco Security investment. With the AMP for Endpoint and Duo integration, we can ensure business agility by providing a secure, frictionless access to any application, from anywhere, while significantly reducing the attack surface.
If you are joining us this week at RSAC2020 come check out Endpoint Security and Duo to experience a demo within the Security area. Start securing your applications with a free trial of Duo and AMP for Endpoint today.
The post ‘Never Trust, Always Verify‘: Duo joins forces with AMP for Endpoint appeared first on Cisco Blogs.

Source:: Cisco Security Notice

By Ben Munroe There are so many companies each year at the RSA Conference, it would be useful to have some analytics to help guide your time there; which of the 700 plus vendors should you try and spend time with to solve your current problems? Similarly, customers are trying to keep up with the growing list of tools from all these companies that they can use to protect their environments.
With today’s constant deluge of attacks and complex enterprise infrastructure, a successful security program requires the right mix of ingredients. The CISOs I talk to are more likely to ask, “How many more ingredients do I have to add to the mix? I am already struggling to manage and respond to the alerts I am receiving from my current technologies. Where does it end?”

In my last blog post, I discussed the criticality of security analytics for dealing with this challenge. Without analytics, our security professionals would be even more overwhelmed than they already are, trying to make sense of non-stop alerts from various technologies. Through the use of analytics, intelligence, and automation, Cisco is helping security teams take back control of their environments and their schedules through more proactive defenses.
According to our newly released 2020 CISO Benchmark Report, a majority (77%) of respondents are planning to increase automation to simplify and speed up response in their security ecosystems over the next year. We can’t fix the current state of security overnight, but it’s a goal that Cisco is continually striving for as we expand and evolve our portfolio.
Introducing Cisco SecureX – The broadest, most integrated security platform
This week at the RSA Conference, we are announcing our new security platform, called Cisco SecureX. As the broadest, most integrated platform on the market, SecureX brings Cisco and other security products and capabilities together to work as a team. It connects the breadth of Cisco’s integrated security portfolio and customers‘ entire security infrastructure for a consistent experience that unifies visibility, enables automation, and strengthens protection.

Cisco SecureX makes it easy to establish coverage across every threat vector and access point, and evolve security to meet the needs of tomorrow. It leverages all parts of your infrastructure to enable better decision making based on comprehensive threat detection and meaningful security analytics.
You’ve probably heard others talk about security platforms before. Here’s the thing: their platforms don’t cover all the threat vectors. They don’t work with an ecosystem of third-party technologies. And they don’t integrate with core business technologies like the network.
Cisco SecureX does all of this to bring enhanced integration, visibility, and automation to security teams. This results in more streamlined, efficient, and collaborative protection across your entire infrastructure. And analytics play a key role in connecting these dots and extracting maximum value from an integrated security platform.
Precise Analytics Across the Platform
My previous blog post focused on the valuable security analytics delivered by our Network Traffic Analysis technology, Cisco Stealthwatch. While crucial, it’s important to note that Stealthwatch is just one component of our analytics capabilities, which span our entire platform and portfolio – from the network and cloud to endpoints and applications. There are now seemingly infinite avenues for attackers to infiltrate our environments, so each one must be equipped with strong security fortified by analytics and intelligence.
On the network…
Cisco Stealthwatch leverages behavioral modeling and machine learning to process billions of network transactions, detect anomalies, and reduce them to critical alerts for enhanced threat detection – even in encrypted traffic. Meanwhile, Cisco Web Security uses URL filtering, reputation analysis, and other techniques to automatically detect and block web-based threats.
In the cloud…
Cisco Umbrella uses statistical models to automatically score and classify data processed by our global network to detect anomalies, identify attacker infrastructure, and uncover known and emergent threats. This helps users remain safe while on the Internet – anytime, and from anywhere. Additionally, Stealthwatch threat detection can also be extended into the public cloud via Stealthwatch Cloud.

On the endpoints…
Our AMP for Endpoints product is trained by algorithms to “learn” to identify malicious files and activity based on the attributes of known malware. Machine learning capabilities in AMP for Endpoints can help detect never-before-seen malware at the point of entry. Additionally, Cisco Endpoint Security Analytics Built on Splunk uses behavioral analysis to obtain insight and shorten investigation time for potential threats on the endpoints, whether they are on or off the network.
Within applications…
Duo Security develops a baseline of normal access within an organization, and then analyzes each new access attempt to highlight anomalous behavior. This way, unauthorized users can be prevented from accessing sensitive applications and data. Additionally, Cisco Tetration uses security analytics to understand application behaviors for faster threat detection and consistent microsegmentation.
For More Information
Security analytics can help detect unknown threats and policy violations, and also reduce alert fatigue within security teams. The best part is, through our platform approach, these multiple analytics engines will not work in silos. Our products are being strategically integrated to exchange information, share context, increase automation, and more comprehensively protect your environment.
For more information on our Cisco SecureX platform, go to: cisco.com/go/securex. To learn more about our security analytics capabilities, go to cisco.com/go/security-analytics.
The post A Platform Approach + Precise Analytics = Better Equation appeared first on Cisco Blogs.

Source:: Cisco Security Notice

By Ben Nahorney Everyone has a spam folder. It’s often disregarded as a dark, bottomless pit for fake emails from FedEx, pharmacy offers, and introductory emails from women far too amorous to be anything but fantastical. You’d be right to largely ignore this folder.
Yet each day new emails end up in it. Most of us have learned to leave it well enough alone. Still, few would admit to having no curiosity as to what’s in there. To satisfy this curiosity, we’ve dug into spam folders to explore the current types of messages being sent and find out what happens if you click the links and open the attachments. In essence, we’re opening these spam messages so you don’t have to.
Do not try this at home
This exploration is meant to inform, showcasing some of the scams and threats currently out there. However, in all of the spam messages we’ve examined, the links were clicked and attachments opened within a secure, sandbox environment.
In this case we used Cisco Threat Grid, which is an advanced sandboxing tool that can analyze threats against millions of other samples to fully understand its behaviors in a historical and global context, and then provide context-rich analytics and threat intelligence. We’ve also coupled this with Cisco Umbrella Investigate, which provides an excellent view of the relationships and history of particular internet domains and IP.
While most of the spam we looked at was prosaic, many were not. It’s mostly the latter that we’re showcasing here. Opening these emails on your own computer or device is very risky and can end up compromising it. In short, do not try this at home.
Snake oil sales
Let’s start off with the more mundane spam emails—the ones that more often than not simply attempt to part a fool from their money.
If there were a unified theory of spam it would be that it plays to both our aspirations and our insecurities: get in shape, lose weight, get a great night’s sleep, get the girl/guy, protect your family, improve your credit score, etc. There’s a wide variety of these emails that play to these desires—far too many to cover in any detail. Consider these as a smattering of what’s currently out in the spam landscape.

In this type of spam messages, many of the message bodies share similar characteristics. This points to the use of email spam kits that leverage templates for crafting emails. These kits go far beyond the email bodies too, allowing all sorts of customization. For instance, some of the examples above were marked as “high importance” and flagged for follow-up before they even hit the spam folder.

Text only spam
Sometimes saying nothing is more effective than saying anything at all. That’s certainly the case with spam, as bare-bones spam messages are very popular. For instance, some emails just put the recipient’s name in the body, along with a link. The link leads to a get-rich-quick scheme in the guise of a fake news report about a Bitcoin investment platform. A “Try Now” link on the page leads to a second site that gives the user an option to register.

Spam promising romance or intimate encounters with strangers is also very common. Many are clearly advertisements, while others are attempts to begin a rapport before asking the victim for money. In this case, the site that you are directed to depends on the country you’re visiting it from. In general, these links guide users to lesser-known dating and meet-up sites, where it’s likely the scammers are generating ad revenue through click-through programs.

Social networking spam
Likes, comments, and profile views are the lifeblood of social networking, and the networks often entice users to return to their sites by sending emails on the user’s profile activity. In this particular example, the scammers have lifted the look of a LinkedIn email notifying the user that their profile had appeared in searches. If any of the links in the email are clicked, the page that loads isn’t LinkedIn. Instead, the user is notified that they are the “5-billionth search.” As a result, they can claim prizes ranging from gift cards to hardware devices. However, before receiving their prize, the user is required to fill out a survey and provide some personal details. More than likely the gift card never materializes.

Are they safe?
In each of the examples shown so far, there were indications that some sort of suspicious activity could be taking place. However, there was no smoking gun. Some sites and IP addresses appeared to have participated in past phishing campaigns or other malicious activity. So while these scams may not be performing malicious activity today, there’s nothing to say they won’t be tomorrow.

So now that we’ve covered the suspicious, let’s move on to the obviously malicious.
Log in to view
In the following example, the email appears to hint at an upcoming disbursement. While the details are sparse, the idea of unexpected money could lead a curious individual to click. After all, the email simultaneously warns the user that the email is from outside their organization and that it comes from a “trusted sender,” hoping that the recipient will let their guard down.

While it looks like the document is attached, the email only contains an image of an attachment. Clicking it does take the recipient to an actual Word doc, hosted on a SharePoint subdomain.

This document contains a link to what appears to be another document. Clicking that link opens another window containing what looks like an Office 365 login page:

Clicking the first link will take the user to another page that requests the user use their Office login details:

When they click the “Sign in” button, the user is redirected to a legitimate Office 365 page that presents an error message:

However, login details entered into the previous page have been logged on the malicious site, successfully stealing them from the user.

This type of spam isn’t exclusive to Office 365. There are plenty of instances where the bad actors go after other valuable login details, such as those from other webmail accounts, subscription services, or social media accounts.
Package delivery spam
This popular type of spam has proven to be effective enough that it’s used for a variety of objectives. The shipping companies impersonated vary widely and the spam emails are often modeled directly after email notifications you would receive from the actual company.

In other cases, the emails are a little more toned down, arriving as plaintext and including attachments rather than links.

The attached document, if opened, doesn’t show the user the promised contact form. In fact, it doesn’t appear to do anything at all. However, behind the scenes the attachment has compromised the computer with a trojan called “Hawkeye.” This threat is an infostealer that is often used to extract passwords from email and web browser applications, as well as log keystrokes, harvest stored credentials, screenshots, and network activity.

The worst of the worst
The bad actors behind Emotet are one of the largest malicious spam email peddlers these days. We’ve discussed this threat our Defending against today’s critical threats report, and Talos Intelligence has published multiple blogs on the threat. The folks behind Emotet have a few tricks up their sleeves when it comes to email distribution. Their spam campaigns often leverage news headlines and regularly utilize package delivery spam as described above.

Emotet also often pulls a trick that’s less likely to end up in your spam folder with ordinary email filters applied. These emails often arrive as replies to email conversations you may already be having with someone you know, usually an acquaintance, a co-worker, or an associate in another organization you do business with.

The attachments in these cases, if opened, generally download a copy of Emotet, effectively compromising the system.

How to protect yourself
The simplest way to protect yourself from spam emails such as these is to simply leave them in your spam folder. However, not all spam filtering applications are created equal and sometimes such messages can end up in your inbox—in particular some of the latter examples showcased here. The best thing you can do to identify spam is check for anomalies in the email messages you receive:
Multiple spelling and grammar errors in emails that appear to come from legitimate organizations should raise a red flag.
Move your mouse over URLs without clicking them. If the URL that appears at the bottom of the browser window looks at all suspicious, don’t click it.
Check the From: address. Does the name align with the email address? If not, disregard it.
Beyond the user-based aspects of identifying spam, a layered approach to security is critical in defending an organization from such threats.
Spam filtering software for email is critical. Deploying a robust email threat defense like Cisco Email Security that utilizes URL blocking capabilities and Advanced Phishing Protection’s machine learning to understand and authenticate email identities and behavioral relationships filter out spam emails and prevent attacks.
Endpoint protection software can also assist in detecting and quarantining malicious attachments. Cisco AMP for Email Security defends your business against such threats. Not only that, but AMP analyzes emails for threats such as zero-day exploits hidden in malicious attachments. It gives you advanced protection against spear phishing, ransomware, and other sophisticated attacks.
Tools for dynamically sandboxing threats, such as Cisco Threat Grid, can be used to analyze threats in a safe environment. Even better, integrate sandboxing so that it happens automatically in the background for new files and URLs arriving in email to quickly understand if they are malicious.
Finally, solutions such as Cisco Umbrella can not only block access to malicious sites, stopping many threats in their tracks, but additional tools like Umbrella Investigate provide further threat intelligence around a URL, domain, or IP address to better understand the sites your organization comes in contact with.
Enjoyed reading this Threat of the Month? Subscribe to the Threat of the Month blog series and get alerted when new blogs are published.
The post Explorations in the spam folder appeared first on Cisco Blogs.

Source:: Cisco Security Notice

By Jeff Reed Making Security an Enabler, so Your Business Can Take an Exponential Leap
I joined the Cisco Security team the week after the RSA Conference in 2017. At that time there was a lot of discussion around the journey Cisco Security was on, particularly around our efforts to deliver an integrated architecture. For the previous years we had been integrating threat intelligence, context sharing and our anti-malware engine across our portfolio and were seeing dramatic improvements in key metrics such as time to detection.
But from the perspective of a security practitioner’s daily experience with our portfolio, we were failing. The user experience was siloed, it took too long to stitch our products (and third-party products) together, and even the navigation and look and feel of our products varied dramatically.
Shortly after that RSA we made the decision to focus our attention on the operational experience of our Security products, realizing that the usability component was equally as important as the underlying architecture. We stood up a team to lead us on that journey and began laying the foundation for what would become a huge leap forward for Cisco Security and for our customers.

Today we are introducing Cisco SecureX – a new way for users to experience Cisco’s Security portfolio. Cisco SecureX streamlines our customers‘ operations with increased visibility across their security portfolio and provides out-of-box integrations, powerful security analytics, and automated workflows to speed threat detection and response. SecureX is an open, cloud-native platform that connects Cisco’s integrated security portfolio and customers‘ security portfolios for a simpler, more consistent experience across endpoints, cloud, network, and applications.
The foundational capabilities of SecureX
SecureX builds on the foundational work we’ve been doing over the past 2.5 years, including Cisco Threat Response, common user experience, single sign on, secure data sharing between on-prem and the cloud and more. But it does a whole lot more. The best way to experience SecureX is to visit us at the RSA conference. For those of you who can’t make it, here are some of the most important capabilities of the platform:
Unified visibility
SecureX provides unified visibility across all parts of your security portfolio – Cisco or third-party solutions – delivering metrics, activity feed and the latest threat intelligence. I am particularly excited about the operational metrics capabilities of SecureX: Mean Time to Detection, Mean Time to Remediation, and Incident burndown times. These metrics are derived from full case management capabilities native to the SecureX platform. Case management enables SecureX customers to assign cases, track them to closure, and add relevant artifacts captured during investigation.
Automation
SecureX brings full multi-domain orchestration and automation capabilities to our customers using a no/low-code approach and intuitive drag-and-drop interface to deliver high-performance and scalable playbook capability. The SecureX orchestration and automation capabilities use an adapter model that allows users to quickly and easily orchestrate across Security, Networking, IoT, Cloud, Collaboration, and Data Centers. SecureX already has 50+ adaptors across these domains and will continue to develop more.
Playbooks
SecureX will deliver pre-built playbooks, and customers can also develop their own playbooks tailored to their own environment of Cisco and non-Cisco products. With our phishing playbook for example, end users can submit suspicious email to SecureX to get a recommendation of whether it is malicious or not. If the submitted email is malicious, the end user will be notified of recommended next steps, and an event will be generated in SecureX alerting the security team. To deliver this capability, the playbook pre-processes email to extract observables, determines the verdict for observables, hunts for targets involved and takes mitigation and/or preventative actions such as isolating the targets involved, blocking the malicious domain as necessary, etc.
Managed threat hunting
Only Cisco can bring multi-domain managed threat hunting capability across endpoint, cloud, email, etc. because of the breath and scope of our product portfolio. Multi-domain managed threat hunting detects threats leveraging a combination of intel and data techniques to surface activity that might have slipped past traditional threat, behavioral, and ML-based techniques. High fidelity threats confirmed by our Talos and Research teams are then communicated to customers through the SecureX activity panel as well as via emails with detail artifacts, targets involved, and remediation recommendations.
Fast time to value
Unlike other security platforms in the market, SecureX helps customers get value quickly. Getting started is simple – if you have a CCO account, login and add products to SecureX by providing API keys and adding on-prem devices (for Firewall and on-prem Email solutions). If you don’t have a CCO account, create a SecureX account on the homepage, add products to SecureX by providing an API key and adding on-prem devices (for Firewall and on-prem Email solutions). You are ready to go in minutes vs. hours and days.
Learn More about SecureX
These are just some examples of what you’ll be able to do with the first release of SecureX. The platform will continue to evolve so your security can keep up with the speed of business, and your business can keep taking new leaps.

Be one of the first to experience how we’re redefining
and simplifying security with our new platform —
Sign up for our SecureX Waitlist

Or, join us to learn more about SecureX at the RSA Conference.

The post Introducing SecureX appeared first on Cisco Blogs.

Source:: Cisco Security Notice