Archiv für die Kategorie: News

By John Dominguez If you’re still juggling a lot of cyber security tools, you’re not alone. Even as businesses make headway on trimming point-solutions, the recently released Cisco CISO Benchmark Report found that 14% of security leaders are managing more than 20 vendors. And 3% are dealing with over 50.
It’s easy for this to get out of hand. Customers tell us they acquired product A to solve problem A, product B to solve problem B, and so on. Before long, they’re overloaded with point-products that work independently and create tons of siloed data points. The products don’t draw connections between the data to help network administrators understand event context.
It’s almost like having alarm sensors from different security companies on every door to your home. It’s not better, simpler, or easier to manage.
Cisco is helping customers simplify their security ecosystems with powerful tools that work together to automatically thwart cyber attacks. The Cisco Integrated Security Portfolio includes Cisco Next-Generation Firewalls (NGFW) and Cisco Advanced Malware Protection (AMP) for Endpoints. These two tools automatically work together to provide comprehensive threat protection from the network edge to the endpoint. And using the Cisco Threat Response management console, you can take corrective action directly from a single interface.
The power of coordination
This powerful partnership starts with breach prevention. Stopping cyberattacks before they can embed themselves in your extended network is crucial. The Cisco NGFW and AMP for Endpoints both draw threat intelligence from the Cisco Talos Security Intelligence and Research Group to actively block threats in real time. Cisco NGFW monitors and blocks malicious traffic and files at the network perimeter, while Cisco AMP for Endpoints blocks malicious files at the endpoint point-of-inspection.
But what if an attacker or extremely sophisticated malware manages to creep inside? It can happen—cybercriminals are persistent, and malware gets smarter every day. This is where the coordination of Cisco NGFW and AMP can really make a difference. If NGFW sees a threat on the network, it’s contained there and blocked access to the endpoint. If AMP for Endpoints sees trouble on the endpoint, it is automatically quarantined there and blocked from traversing the network. Threat information and event data is shared amongst all Cisco security tools. The system works together so that if a threat is seen once, it is stopped everywhere. This provides continuous visibility across multiple attack vectors for rapid, automatic detection and response.
And the best part? This network and endpoint information is all aggregated in one place – the Cisco Threat Response management console. You can see all of this information in intuitive, configurable graphs for better situational awareness and quick conclusions. You can take corrective action and make decisions across your entire network from one management plane. You can block suspicious files, domains, and more—without having to log in to another product first. Want to see even more network or endpoint detail? One click and you’re inside Cisco AMP for Endpoints or the Cisco NGFW native console.
One proven, efficient system
We work with businesses every day to help them defend their networks and keep security management simple so their teams can be as efficient as possible. Cisco Next-Generation Firewalls and Cisco AMP for Endpoints, along with the Cisco Threat Response management console, offer breach prevention, continuous visibility, rapid detection, automated response, and efficient management from one console.
To learn more about Cisco NGFW and Cisco AMP for Endpoints, click here.

Source:: Cisco Security Notice

By Talos Group
Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between June 21 and June 28. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.
Read More at Talosintelligence.com

ReferenceTRU06282019 – This is a JSON file that includes the IOCs referenced in this post, as well as all hashes associated with the cluster. The list is limited to 25 hashes in this blog post. As always, please remember that all IOCs contained in this document are indicators, and that one single IOC does not indicate maliciousness. See the Read More link above for more details.

Source:: Cisco Security Notice

By Talos Group
Nick Biasini authored this post with contributions from Caitlyn Hammond.
Executive summary
Exploit kits are an ever-present and often forgotten threat on the landscape today. Their popularity seemed to peak several years ago with the success and eventual downfall of some of the best compromise platforms ever created, including the Angler Exploit Kit. These kits generated millions of dollars from their victims and they are still effective. One of their biggest appeals today is the removal of reliance on user assistance. Increasingly, on the crimeware landscape today, user assistance is required, whether it’s through blatant social engineering attacks like ongoing sextortion campaigns or through the countless malspam messages traversing the globe daily, users are required to help achieve infection. That is where exploit kits stand alone as an effective web-based platform for compromise that only requires users to surf the internet.
Today, Cisco Talos is unveiling the details of a new exploit kit campaign that proves exploit kits are still a threat and should be taken seriously by defenders: Spelevo. This recent campaign leveraged a compromised business-to-business site to deliver Spelevo, one of the first new kits we’ve seen in months.
Read More >>

Source:: Cisco Security Notice

By Steve Benvenuto Known as a leader in cybersecurity and technology insights for the channel, Canalys released their Cybersecurity Leadership Matrix for 2019. For this matrix, 15 cybersecurity companies were graded on momentum and channel performance over the past 12 months. Unique feedback from channel partners and Canalys analyst insights were used to rank the list of cybersecurity vendors. Of the 15 companies, five of the companies were named in the upper-right quadrant labeled “Champions.” As a team, we are excited to announce that Cisco was recognized as the company with the highest combination of momentum and rating.

Canalys cybersecurity analysis leverages route-to-market, end-user and technology deployment insights to determine top cybersecurity vendors. Their analysis focuses on five security segments: endpoint security, network security, data security, vulnerability and security analytics, and web and email security.
Based off these criteria, Canalys labeled Cisco as a champion due to “not only its leading market share, but its ongoing investment in partner profitability, offering higher front-end margins to encourage cross-product integration sales.” Canalys offers two great insights: Cisco’s ongoing investment in partners, and Cisco’s cross-production integrations.
As Canalys mentions, Cisco Security is a leader in market share, and with the investments in partners and products, Cisco Security continues to show market leader in momentum. Of the fifteen vendors, Cisco Security places second in momentum behind Juniper, but Juniper is not in the top quadrant for rating. Cisco received the highest rating out of all 15 vendors. No company can combine the momentum Cisco is experiencing with the high product rating. As Canalys mentions, much of this can be attribute to a strong investment in partners who are able to deliver personalized security solutions to end-consumers at scale.
Second, Canalys highlights Cisco’s cross-product integration sales. No cybersecurity company offers an extensive, integrated security portfolio like Cisco. In reality, security solutions require strong solutions covering the entire breadth of the five segments Canalys focuses on. Fragmenting your security portfolio with average solutions in each segment leads to an average solution. Deploying market-leading solutions in each segment that integrate seamlessly together however, results in a market-leading, holistic cybersecurity posture like Cisco Security’s.
Canalys further mentions that software security solutions will continue to increasingly dominate the market. As this trend increases, Cisco integrations become more valuable with unifying tools like Cisco Threat Response, or with cloud-based firewall management tools like Cisco Defense Orchestrator. Both solutions empower IT departments by providing the tools to automate policy enforcement, threat detection, and threat response.
Overall, this is exciting news for the entire Cisco Security team. We are dedicated to our partners‘ success and profitability, and these results from Canalys further prove that Cisco Security is a growth driver for our partners. See all of the latest promotionsand incentiveswe have available here. Stay in the know on all things Cisco Security by checking out our Security Hub or Selling Security for Partners site.
For more on Canalys’s Cybersecurity Leadership Matrix 2019, find their report here.

Source:: Cisco Security Notice