Why We Must Get Data Privacy Right

By Robert Waitman As consumers the world over gear up for the holiday shopping season, and with Black Friday and Cyber Monday soon upon us here in the US, global consumers will be purchasing online more than ever before. In fact, global e-commerce sales are projected to be more than $140 billion over the holidays, up 15 percent from last year’s record. With all this online commerce, consumers will be knowingly – or unknowingly – sharing their personal information with companies and websites when they make purchases. A common belief is that consumers have lost the ability and will to control how their personal information is used online. But that appears to be changing.
According to the Cisco 2019 Consumer Privacy Survey released today, a significant group of consumers cares so deeply about data privacy that they are already acting to protect their data – even by changing providers when necessary. Our study draws on survey responses from more than 2600 adult respondents in 12 countries worldwide. It explores consumer attitudes and actions regarding their personal data, the products and services they use, their comfort level with potential new business models, and the impact of data privacy regulations. By surveying consumers, our study also adds an end-user perspective to Cisco research on the corporate impact of changes in the data privacy industry.
What consumers tell us about privacy
Overall, our findings reveal a new landscape in which privacy has become a critical business imperative and an important driver of consumer behavior. Specifically, we cover four areas of insights in the study:
People care about privacy and many have already taken actions to protect it. We’ve identified a group of consumers (32%), which we call “Privacy Actives”, who say they care about privacy, are willing to act to protect it, and have already acted by switching companies or providers based on their data-sharing practices. The Privacy Active group is sizable and is an attractive demographic for companies because its members skew younger and do more shopping online. Perhaps most importantly, this group sees respect for privacy as core to the customer experience.
Privacy regulations and policies provide “guardrails” for innovation and help build trust. Our research looked at several potential new business models where personal data might be used in unexpected ways but could enhance personal safety and security. One example would be sharing personal information from home or a car in exchange for health or safety warnings. Overall, consumers were generally uncomfortable with these models, but those respondents who were aware of privacy regulations (for example, the EU General Data Protection Regulation – or GDPR) were much more comfortable than respondents who were unaware.
Consumers value government’s role in regulating the use of data, and they view the GDPR very favorably. Survey respondents want the government to play a role in providing oversight and to make sure companies are complying with the law and their stated policies. Perhaps for this reason, GDPR is perceived very positively around the world (55% favorable vs. 5% unfavorable). In addition, consumers felt that GDPR has given them more control over their data and has enhanced their trust in companies using their data.
Many consumers (43%) say they still cannot effectively protect their data today. While there are many reasons for this, by far the biggest reason stated is that it’s too hard to figure out what companies are actually doing with their data.
A new way to understand the value of privacy to companies
Our research also suggests a new framework for measuring the benefits and return on privacy investment beyond regulatory and compliance requirements. Specifically, the areas of benefit include:
Attracting and retaining customers who care about privacy and are willing to act
Improving business agility and innovation
Reducing sales friction
Enhancing the overall attractiveness of the company.
As more consumers place a premium on proper protection of their data, companies have a significant opportunity to meet regulatory requirements while they realize business benefits and build trust with their customers.
For most organizations, privacy has become a critical business imperative. Cisco recognizes this imperative, and we prioritize being clear and transparent with our customers. Some of the tangible ways we do this include providing information on our Trust Portal and with our privacy data sheets and data maps that clearly describe how our products and services use data.

More Information
Cisco 2019 Consumer Privacy Survey
Cisco 2019 Data Privacy Benchmark Study
Cisco Data Privacy
Cisco Trust Portal
The post Why We Must Get Data Privacy Right appeared first on Cisco Blogs.

Source:: Cisco Security Notice

/von

IP-Telefone für Einsteiger

,

Sie suchen ein IP-Einsteigertelefon und möchten trotzdem nicht auf beste Sprachqualität und moderne Sicherheitsprotokolle verzichten? Unser Partner innovaphone produziert in Deutschland die beiden Modelle IP101 und IP102. Diese eignen sich bestens dafür, sind zudem ideal im Einsatz für klassische Telefonie und unterscheiden sich lediglich durch eine USB-Schnittstelle für Headsets und einen Gigabit- bzw. Fast-Ethernet-Anschluss.

Die Daten hierzu finden Sie bei innovaphone unter folgenden Links:

Daten zum IP 101

Daten zum IP 102

Oberberg-Online ist seit 16 Jahren zertifizierter innovaphone-Partner und bietet IP-Kommunikationslösungen für jede Unternehmensgröße an. Sprechen Sie mit uns, wenn Sie auf Qualität und Sicherheit aus Deutschland setzen wollen:

DSC_2022 klein
Jörg Wegner
02261 9155052
wegner@oberberg.net
Dirk Zurawski
02261 9155051
zurawski@oberberg.net
Daniel Wenzlau
02261 9155054
wenzlau@oberberg.net
/von

The Importance of the Network in Detecting Incidents in Critical Infrastructure

By Simon Finn As we saw in my last blog, the network plays a key role in defending critical infrastructure and IoT. The devices that we are connecting drive our business, enabling us to make smarter decisions and gain greater efficiency through digitization. But how do we ensure those connected devices are acting as intended? From an industrial operations perspective, we need to know that plant operations are nominal, irrespective of cyber threat. The network is well positioned to assist us in detecting misbehaving devices.

Network telemetry for visibility
In order to have assurance of business operations, it is critical to have visibility and awareness into what is occurring on the network at any given time. Network telemetry offers extensive and useful detection capabilities which can be coupled with dedicated analysis systems to collect, trend and correlate observed activity. In the security world we can infer much from network telemetry, from malware behaviour and reconnaissance, to data exfiltration. It is even possible to infer to some extent what is contained in encrypted traffic. Not only can we use this traffic for detection, but also for investigation. Having a historical record of communication also assists with investigating incidents. We can see, for example, what other hosts may have talked to a command and control server, or we can look at any lateral movement from a host.
The first step is to collect Netflow, which is a unidirectional sequence of packets with some common properties that pass through a network device. These collected flows are exported to an external device, the NetFlow collector. Network flows are highly granular; for example, flow records include details such as IP addresses, packet and byte counts, timestamps, Type of Service (ToS), application ports, input and output interfaces.
Exported NetFlow data is used for a variety of purposes, including enterprise accounting and departmental chargebacks, ISP billing, data warehousing, network monitoring, capacity planning, application monitoring and profiling, user monitoring and profiling, security analysis, and data mining for marketing purposes.
For most network devices (including many ruggedized devices used in OT environments), Netflow is simply an option you can turn on sending this data to a Netflow collector. Lower-end switches may not have this option; however, a span port can send traffic to a Netflow Sensor to accomplish this task. Gathering network telemetry visibility is the first step for organisations. The next steps are to utilise tools that can analyse the traffic and look for behavioural anomalies. For more advanced use cases, Encrypted Traffic Analytics (ETA) offers insights into encrypted traffic as well.

Accelerating detection through smarter tooling
The problem of scale in IoT, is also evidenced in security incident detection and response, where we have more traffic to review, and accordingly, more events. We need tools to help us, and Machine Learning (ML) and Artificial Intelligence (AI) based tooling are important technologies, particularly when it comes to network behaviour. Devices, as opposed to humans, tend to have very defined behaviour, so leveraging ML and AI to observe and baseline this behaviour offers high fidelity alert sources.
Machine Learning in Network Security

Leveraging context for better results
To really accelerate detection and lower our median time to detect, we need all our tools to work together. In the previous post we discussed network context and understanding what a device policy should be, at scale. What if we could leverage that same information to assist with detection? Understanding contextual information and what a device’s policy should be, can help increase fidelity of behavioural alerts. Investigators also benefit from having this information integrated into their tools, which helps speed investigations.
Stay tuned for the next blog post in the series which will explain the last key issue – The network’s key role in how we respond to incidents. November is Critical Infrastructure Security and Resiliency Month, so head over to our Trust Center to learn more about critical infrastructure protection.

The post The Importance of the Network in Detecting Incidents in Critical Infrastructure appeared first on Cisco Blogs.

Source:: Cisco Security Notice

/von

Finding the malicious needles in your endpoint haystacks

By Samuel Brown Accelerate Threat Hunts and Investigations with Pre-Curated Complex Queries
Security teams often lack the ability to gain deep visibility into the state of all their endpoints in real time. Even with a bevy of tools at their fingertips, once an incident occurs, conducting investigations can be likened to searching for a needle in a haystack. Teams struggle to make well informed remediation decisions fast enough, finding themselves asking questions like, what should I be searching for? Where specifically in my environment should I zero-in? Which datasets matter? Which are irrelevant? The struggle is real. As we all know, the longer a threat runs wild, the more havoc it stands to wreak on your environment. Between the intense time-pressure, endless datasets to sift through, and ambiguity associated with not knowing where or how to start, incident investigations can feel like frenzied wild goose chases.
Many teams have adopted threat hunting to take a more proactive and preventative (rather than purely reactive) approach to managing their security hygiene. With 43% of organizations performing continuous threat hunting operations in 2018, versus just 35% in 2017, the practice is undoubtedly growing in scope and popularity. However, this begs the question: what’s holding back the remaining majority – the other 57% – of organizations? The reality is that although many teams want to threat hunt, they simply don’t know how to get started, or erroneously believe that they don’t have the personnel, time, and resources to dedicate to the endeavor. But fortunately, that’s no longer the case…
Know everything. About every endpoint. Right now.
Cisco recently rolled out a powerful new advanced threat hunting and investigation capability in Cisco® AdvancedMalware Protection (AMP) for Endpoints called Advanced Search that gives users the ability to search across all endpoints for forensic information and malware artifacts. Think of this as the ultimate search engine for all your endpoints – with over a hundred pre-canned queries provided, Advanced Search makes security investigations and threat hunting simple by allowing you to quickly run complex queries on hundreds of attributes in near real-time on any or all endpoints. For example, it allows you to type in queries like:
Show me all computers that are listening on certain ports – something that certain variants of malware will do when they are waiting on instructions from a C&C on what to do.
Show me all processes that are running in memory but do not have a file on disk – something that is rarely seen with innocuous processes, and thus strongly indicates the possible presence of fileless malware trying to escape scanning and analysis hiding out in your environment.
Show me all the users logged in – if a user is logged into systems in a department that the user doesn’t belong in, or if the user is logged into multiple machines at one time, this could indicate a breach.
Advanced Search gives you deep visibility into what’s happening on any endpoint at any time by taking a snapshot of its current state, and the search options are limitless; users can immediately perform advanced searches via the 100+ curated queries that come with the tool or create their own custom queries. Whether you’re threat hunting, conducting an incident investigation, IT operations, or vulnerability and compliance assessments, Advanced Search gets you the answers you need about your endpoints fast.

How does it work?
Whether you are investigating an incident or proactively hunting for threats Advanced Search can help you simplify and accelerate these tedious processes in the following ways:
Forensics snapshots. We can capture snapshots of data from endpoints such as running processes, open network ports and a lot more at the time of detection or on demand. It’s like “freeze framing” activity on an endpoint right to the moment. This allows you to know exactly what was happening on your endpoint at that point in time.
Live search. Run complex queries on your endpoints for threat indicators on demand or on a schedule, capturing the information you need about your endpoints in near real time.
Predefined and customizable queries. We provide over a hundred predefined queries that you can quickly run as they are or customize them as needed. These queries are simply organized in a catalog of common use cases and mapped to the MITRE ATT&CK.
Storage options. The results of your queries can be stored in the cloud or sent to other applications such as Cisco Threat Response for further or future investigations.

Common use cases
Advanced Search can help you do the following important tasks better, faster:
Advanced Threat Hunting: Search for malicious artifacts across any or all your endpoints in near real-time to accelerate threat hunts.
Mature organizations – Streamline workflows for seasoned teams that already perform continuous threat hunting operations and get beyond atomic and computed IOCs and into the really interesting stuff, like registry keys, process PID exploits, and all kinds of attacker TTPs cataloged with Threat Grid and the MITRE ATT&CK.
Novice Threat Hunters – Empowers teams that don’t have threat hunting programs in place to begin to threat hunt without requiring them to hire additional staff or rip and replace their security stack.

Incident Investigation: Get to the root cause of incidents faster to accelerate incident investigation and remediation efforts.
IT Operations: Track software inventory, disk space, memory, computer utilization, and other IT operations artifacts quickly and expediently – good threat hunting tools can also be used to enhance IT operations.
Vulnerability and Compliance: Easily check the status of Operating Systems for things like software version levels to validate patch management to ensure that your endpoints are in compliance with current policies.
Threat Hunting Versus Incident Response
An additional bonus to threat hunting is that it breeds familiarity with tools and techniques that come into play when an incident or breach does occur, effectively training teams to be better incident responders. Since both disciplines deal directly with threats in your environment, the skills exercised when threat hunting are arguably one and the same as those associated with incident response. The only difference is that whereas incident response is reactive and involves known evidence of a threat in your environment, threat hunting is a proactive practice that is carried out without evidence. Since practicing threat hunting sharpens investigative skills and response times, teams that threat hunt are naturally better equipped to react like pros when faced with real incidents. The ‘Hunting for hidden threats‘ whitepaper in Cisco’s Cybersecurity Report Series covers this topic in more detail and is a great place to learn even more.
Whether you’re new to threat hunting, are a seasoned veteran who wants to streamline operations and take your threat hunting program to the next level, or merely want to accelerate incident remediation, the solution to your woes has arrived. Test drive Advanced Search today with a free trial of Cisco AMP for Endpoints, or register for one of our Threat Hunting Workshops to get hands-on experience threat hunting, investigating, and responding to threats so that you can become a pro at finding the malicious needles in your digital haystacks.
The post Finding the malicious needles in your endpoint haystacks appeared first on Cisco Blogs.

Source:: Cisco Security Notice

/von

Welcome to the New Zero Trust

By Thu T. Pham Complexity, opacity and the gatekeeping of knowledge are tactics often used to appear sophisticated or intelligent. They can also be used to intimidate.
In security and technology, complexity can lead to critical gaps in visibility and an extended attack surface – with too many vendors and solutions to interconnect and manage. Additionally, many enterprises are operating with limited budgets, too many projects with conflicting priorities, projects creating disparity between different technology teams; all supported by a limited security team (or an IT or networking team doing double duty). As a result, complexity creep has risen to counteract our best security efforts.
At Cisco, we’re seeking to eliminate that complexity and close knowledge gaps with simplicity in how we execute and deliver security, as well as transparency in how we talk about it. The security industry is often guilty of using buzzwords and jargon that can add to the growing complexity and shifting priorities as enterprises attempt to follow best security practices defined by the industry.
Zero Trust: The Concept, Defined
To that end, let’s start with defining and simplifying the most popular buzzword, ‘zero trust‘ – it’s about never implicitly trusting, but always verifying someone or something that is requesting access to work resources.
It’s not about getting rid of the perimeter – but rather tightening security on the inside.The new perimeter is less about the edge of the network, and now more about any place you make an access control decision.
–Wendy Nather, Head of Advisory CISOs, Summarized from Zero Trust: Going Beyond the Perimeter
Historically:
Users, devices and applications were located behind a firewall, on the corporate network
All endpoints accessing resources were managed by the enterprise
Systems managed by enterprises could all inherently trust one another, and trust was often based on network location
The new zero trust is about:
Gaining visibility to intelligently inform policy, and enabling BYOD (bring your own device) or IoT (Internet of Things) devices for business agility
Continual reestablishment of user, device and application trust
Continuous monitoring and threat containment
Protecting the Workforce, Workloads & Workplace
With all of that in mind, what exactly are you trying to protect?
Enterprises are complex by nature. They have vast IT ecosystems, with many different vendors, software and infrastructure spread across the multi-cloud and on-premises. They have many different types of users – employees, contractors, customers, etc. – everywhere across the world – often using their own personal devices to work. They have applications that talk to each other via APIs, microservices and containers. And they still have enterprise networks that devices regularly access, including IoT.
That’s why we’ve simplified things – by classifying each area of your enterprise IT as equally important to protect using a zero-trust security approach.
Zero Trust for the Workforce – Ensure only the right users (employees, contractors, partners, etc.) and their secure devices (BYOD) can access applications (regardless of location).
Zero Trust for Workloads – Secure all connections within your applications (when an API, micro-service or container is accessing an application’s database), across the multi-cloud (cloud, data centers and other virtualized environments).
Zero Trust for the Workplace – Secure all user and device connections across your enterprise network, including IoT (types of devices may include: servers, printers, cameras, HVAC systems, infusion pumps, industrial control systems, etc.).
For complete zero-trust security, you need to address each area of your IT ecosystem – securing access across all environments, in a consistent and automated way.
Enter the Cisco Approach to Zero Trust
Cisco’s approach does not implicitly trust a request – but rather establishes trust for every access request, regardless of where the request is coming from. It secures access across your applications and network, while extending trust to support modern enterprises with BYOD, cloud apps and hybrid environments.
Cisco implements zero trust with a three-step methodology across the workforce, workloads and workplace by:
Establishing trust of a user, device, application, etc. – before granting access or allowing connections or communications.
Enforcing trust-based access policies with granular controls based on changing context – such as the security posture of devices and the behavior of applications
Continuously verifying trust by monitoring for risky devices, policy noncompliance, behavior deviations and software vulnerabilities
For the workforce, Duo Security protects against phishing, compromised credentials or other identity-based attacks with multi-factor authentication (MFA) to verify user identities and establish device trust before granting access to applications.
For workloads, Tetration secures hybrid, multi-cloud workloads and contains lateral movement with application segmentation. Identify vulnerabilities in software versions and block communication to reduce your overall attack surface.
For the workplace, Software-Defined Access (SD-Access) provides insight into users and devices, identify threats and provides control over all connections across the enterprise network, including IoT devices.
Extending Trust
While this is a good starting place, other solutions in the Cisco Security portfolio can extend the zero-trust security model further. Cisco’s framework is built to integrate seamlessly with your existing infrastructure and investments using an open API model, standards-based platform and strong technology partnerships to ensure that everything across your environment is protected – securing your enterprise as you scale.
Those strong partnerships include major players in the industry, including Microsoft, Amazon Web Services (AWS), Google and many more.Extending trust to integrate with third parties for better visibility and consistent policy enforcement is key to making a zero-trust approach practical and effective for modern enterprises.
Benefits of a Zero-Trust Security Approach
Overall – this framework provides the benefits of a comprehensive zero-trust approach:
Increased visibility – Get insight into the contextual data behind access requests, including users, user endpoints and IoT devices connecting and talking to your applications and network
Reduced attack surface – Mitigate risks related to identity attacks (stolen or compromised passwords, phishing) and lateral attacker movement within your network (in the event of a breach – contain the impact of the initial breach)
Broad coverage – Zero-trust security for not just the workforce, but across workloads and the workplace for complete coverage and a consistent approach to securing access and enforcing policies, regardless of where data or applications are located

Learn more about Cisco Zero Trust. Or, sign up for a free trial of Duo, demo Tetration and learn more about SD-Access to start your zero-trust journey today.
Did you hear? Cisco was named a leader in The Forrester Wave: Zero Trust eXtended Ecosystem Platform Providers, Q4 2019 – read the report.

The post Welcome to the New Zero Trust appeared first on Cisco Blogs.

Source:: Cisco Security Notice

/von

Consolidate your Security in the Cloud with Cisco Umbrella

By Meg Diaz
What makes a great partnership? Open communication and a passion for constant advancement are two important elements. Our customers have helped us continuously innovate, and together, we’re transforming how security is delivered. Over the past 12+ months, we embarked on a journey to take Cisco Umbrella to a new level.
DNS has always been at our core — starting as a recursive DNS service (OpenDNS) in 2006, then moving into the enterprise security space in 2012 with the release of Umbrella. Enforcing security at the DNS layer was something brand new at the time. People started to see how valuable it was to have a single view of all internet activity across every location, and it was an incredibly effective way to block threats at the earliest possible point (and who doesn’t love fewer alerts to investigate!?). Add in the fact that it’s delivered from the cloud and can be deployed enterprise-wide in minutes…you can start to see the appeal it has.
As we saw more applications and infrastructure move to the cloud, more people working off-network (and “forgetting” to turn on that pesky VPN), and the move to more direct internet access at remote offices, we heard more from our customers about what they needed from a security service. It wasn’t just about DNS-layer security — they often needed more. We’re excited to share that we’re now delivering more. Much more.
Now, Umbrella offers secure web gateway, cloud-delivered firewall, and cloud access security broker (CASB) functionality — in addition to the DNS-layer security and threat intelligence from Investigate — all in a single, integrated cloud console. All of this is available in a new Umbrella package: Secure Internet Gateway Essentials.
By unifying multiple security services in the cloud, we are now able to offer our customers greater flexibility, sharper visibility, and consistent enforcement, everywhere your users work. The goal is simple ­– if we can simplify your security operations and reduce complexity, then you can reduce risk and accelerate secure cloud adoption.
Here are a few examples of innovations that we’re introducing as part of this:
Bye Security Silos, Hello Consolidation
It can be an overwhelming endeavor to help your organization transition to the cloud and secure direct internet access. It takes skill and a considerable amount of resources. How many office locations are you tasked with securing? We’ve heard loud and clear that it’s not sustainable for you to build a separate security stack in each location. By moving those core security services to a single cloud solution, you’ll be able to deploy the right level of security consistently across your organization. And you have the flexibility to deploy it as needed — you’re not forced to proxy everything or deploy in a specific way. For example, you could start with DNS for fast protection everywhere and leverage additional security services (secure web gateway, firewall, CASB, etc.) wherever you need them.

“I like the simplicity of Cisco Umbrella from a management perspective, but I also enjoy the complexity of the advanced layers of protection that Cisco Umbrella provides. This one product has truly transformed our ability to protect our entire workforce, regardless of location.” – Ryan Deppe, Network Operation Supervisor, Cianbro Corporation

Well-known Technology, Brand New Approach
IPSec tunnels have been around forever. But, we set out to do something different based on what we’ve heard from you. Cisco developed a new technology for IPSec tunnels that minimizes downtime and eliminates the need to build secondary tunnels with a patent-pending approach using Anycast technology for automated failover. A single IPsec tunnel can be deployed to send traffic to Umbrella from any network device, including SD-WAN. This integrated approach combined with Anycast routing can efficiently protect branch users, connected devices, and application usage from all internet breakouts with 100% business uptime.
Real-time Detection of DNS Tunneling
Even though we’ve been a leader in DNS-layer security for years, we won’t rest on our laurels. We’re watching attacker tactics and quickly adjusting ours — DNS Tunneling is one example. DNS tunneling utilizes the DNS protocol to communicate non-DNS traffic (i.e. HTTP) over port 53. There are legitimate reasons why you would use DNS tunneling, but attackers have been using it for data exfiltration and command and control callbacks. To better identify and stop this, we’ve added advanced detection capabilities, real-time heuristics, signature, and encoded data detection to Umbrella.
Deeper Web Control, Retrospective Alerts on Malicious Files
Our new secure web gateway (full proxy) provides complete web traffic visibility, control, and protection — with capabilities such as content filtering at the URL-level, blocking applications or app functions, HTTPS decryption (either for select sites or all), file inspection with Cisco Advanced Malware Protection and antivirus, sandboxing unknown files with Cisco Threat Grid, and retrospective alerts on files that subsequently display malicious behavior. Think about it — file behavior can change over time or could put mechanisms in place to evade initial detection. If a file is initially determined to be safe by Threat Grid and downloaded from the web, but later is deemed to be malicious, you can now see that in Umbrella.
All of these Umbrella enhancements are designed to help your organization accelerate cloud adoption with confidence — you need assurance that your users will be secure wherever they connect to the internet and that’s exactly what we’re focused on delivering for you. If you want to learn more, join our Security Virtual Summit on November 12th and check out Jeff Reed’s blog to hear about other Cisco Security innovations.
The post Consolidate your Security in the Cloud with Cisco Umbrella appeared first on Cisco Blogs.

Source:: Cisco Security Notice

/von

The death of the network perimeter and the firewall? Not so fast.

By Don Meyer Welcome to The Future of Firewalling, Part 1…
For over two decades, the firewall has been the de-facto tool that facilitated secure connectivity between different networks. Firewalls were traditionally designed around the idea that internal traffic and users were inherently trustworthy and external traffic wasn’t. Thus, the firewall was deployed to create a trust boundary – or perimeter – between networks. This network perimeter became the logical security control point to protect an organization’s network, data, users, and devices. What’s more, all network traffic (whether originating from the corporate headquarters, its data center, or remote workers) was funneled through this single control point, making it easy to maintain that trust boundary and establish consistent control. Life was good.
Then the world went digital
And when it did, the way we worked, consumed data, and exchanged ideas transformed. The introduction of the “cloud” further compounded things: many of our business-critical applications started moving from our data centers and premises-based networks to places we no longer owned or controlled. At the same time, our branch offices started directly connecting to the Internet to consume services that are now more frequently hosted outside our data centers. And users began accessing more and more resources from their personal devices everywhere but in the office.
As our networks have become far more interconnected, the notion of a single perimeter or control point no longer exists. The industry has been abuzz for some time about the “dissolving perimeter” and whether the firewall is even necessary anymore. I would argue that not only is the firewall more relevant than ever, we now need more firewalls everywhere – on our premises networks, at branch offices, at the gateway and within our data center, in the cloud, on devices, and even within our application workloads.
From macro to micro
Instead of a single perimeter we now have multiple “micro-perimeters” across a variety of networks, devices, users, and data. Typically, each of these new “perimeters” is secured by adding different point technologies, which require a lot of manual intervention just to get going. Couple that with the significant shortage of available talent to manage all these new devices and we’ve got an even bigger challenge. As a result, organizations are struggling to operationalize their disparate security solutions to maintain consistent policies and uniform threat visibility. Network complexity? Check. Network security complexity? Check. Misconfigurations and inconsistencies leading to exposures and breaches? Check mate!
And while we’re struggling to get a handle on all this complexity, our adversaries continue to unleash more sophisticated threats more frequently across more threat vectors. In fact, the average reported rate of data breaches was 46% in 2018, up from 24% in 2017, according to the 2018 Global Threat Report. This steep climb in reported breaches is a testament to the increasingly sophisticated methods bad actors are using to infiltrate our networks; the growing rate of their success shows just how ineffective the status quo is against modern threats.
And here we are
It has become painfully obvious that we’ve lost visibility and control. We no longer have a good understanding of where our users and data go nor how exposed our businesses are. It’s hard to determine what’s communicating with what, or if we’ve even been breached, until it’s too late. And the pace of change is accelerating as more businesses embrace digital transformation, creating a perfect storm of opportunity for motivated hackers. And a perfect headache for those of us tasked with security. Where do we start to get a handle on it all?
It’s time to rethink the firewall
The importance of the firewall hasn’t diminished – in fact it’s more relevant than ever – but we need to think differently about it. We must go beyond form factors and physical or virtual appliances to embrace firewalling as a functionality. Firewalling needs to be about delivering world-class security controls – the key elements for preventing, detecting, and stopping attacks faster and more accurately – with common policy and threat visibility delivered where you need it: in the data center, in the cloud, at the branch office. So you’re protected everywhere.
At Cisco, we’ve been hard at work bringing that vision into reality, so you can build your strongest security posture for today and tomorrow. Stay tuned to The Future of Firewalling blog series to hear about it. And visit cisco.com/go/ngfw to learn more about Cisco Next-Generation Firewalls.
Coming soon:
The Future of Firewalling, Part 2: Don’t let complexity ruin your security
The post The death of the network perimeter and the firewall? Not so fast. appeared first on Cisco Blogs.

Source:: Cisco Security Notice

/von

Relentless Breach Defense Endpoint Protection Platform + Endpoint Detection and Response

By Gedeon Hombrebueno As evasive and complex as today’s threats have become, it’s no wonder security professionals in organizations of all sizes are ripping out their legacy antivirus completely in favor of Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) technologies. Endpoint Protection Platform (EPP) delivers next generation antivirus that stops today’s complex attacks. Endpoint Detection and Response (EDR) offers more advanced capabilities like detecting and investigating security incidents, and the ability to remediate endpoints quickly. The question then becomes, which should you choose? And why can’t you have both?
We believe you can AND we believe it should simplify your security operations. That’s why we’ve brought EPP and EDR capabilities together in a single cloud-delivered solution called Cisco® Advanced Malware Protection (AMP) for Endpoints. It is relentless at stopping breaches and blocking malware, then rapidly detects, contains, and remediates advanced threats that evade front-line defenses. Moreover, it’s easy to deploy, easy to use and leverages your existing security investments to help you address threats beyond the endpoint. That’s what we call relentless breach defense and here’s three ways Cisco AMP for Endpoints does this.
#1. Block threats. Before they target you.
How effective you are at protecting your endpoints really depends on how good the threat intelligence you’re acting on. That’s why at Cisco, we employ machine learning and automation to spot malware activity fast, malware attack prevention to block ransomware, exploit prevention to stop fileless malware and a variety of other protection engines fueled by Cisco Talos, the largest non-governmental threat intelligence group on the planet. We find more vulnerabilities than other vendors and push out protection before the bad guys can exploit them, giving you an advantage. And because we’re Cisco, Talos sees more network traffic than anyone else. Whether a threat begins on the Internet, in an email, or on someone else’s network. Our cloud-based global telemetry sees a threat once, anywhere in the world, and blocks it everywhere, across our endpoint ecosystem and our entire security platform.
#2. Know everything. About every endpoint.
We simplify threat hunting and investigation with our newly announced endpoint detection and response (EDR)capabilities that automate advanced investigative queries across any or all of your endpoints. Whether you are doing an investigation as part of incident response, threat hunting, IT operations, or vulnerability and compliance, we get you the answers you need. We have preloaded scripts so you can leverage the expertise of our Talos threat hunters or even customize your own. These queries are organized in a catalog of common use cases, even aligning with the Mitre ATT&CK. We provide deeper visibility on what happened to any endpoint at any given time by taking a snapshot of its current state – you can think about this as a “freeze-framing” activity on a device right to the moment when something malicious was seen. And we continuously monitor and analyze the behavior of your endpoints, giving you the information you need to investigate and respond to the riskiest threats quickly and confidently. If a file that appeared clean upon initial inspection ever becomes a problem, we can provide a full history of the threat’s activity to catch, isolate, contain, and remediate at the first sign of malicious behavior.
#3. Respond completely. With security that works together.
Threats are not one dimensional and neither should your defenses be. That’s why we built our endpoint security with out-of-the-box integrations with the rest of the Cisco security platform to block, detect, investigate and respond to threats across your entire environment – not just your endpoints. With security that works together, we help you streamline your security operations, making security investigations faster and easier. You will get to the root cause fast, and automate actions to stop a threat in its tracks. We empower you to respond to attacks at the first sign of malicious behavior using one-click isolation of any endpoint, everywhere. Importantly, we have broader control beyond just the endpoint. We instrument our endpoint security to leverage threat intelligence from web, email, cloud and network security solutions; and multi-factor authentication integration for Zero-Trust, creating security defenses that work together for more effective protection and response against the most challenging threats with less time, effort, and cost to do so.
Channel your inner threat hunter: register for one of our Threat Hunting Workshops. You’ll get hands on experience threat hunting, investigating and responding to threats so you and be relentless at breach defense too.

The post Relentless Breach Defense Endpoint Protection Platform + Endpoint Detection and Response appeared first on Cisco Blogs.

Source:: Cisco Security Notice

/von

Establishing Device Trust to Secure the Workforce

By Amanda Rogerson Challenges of Protecting Endpoints
With an estimated 70% of breaches starting on endpoints – laptops, workstations, servers, and mobile devices – organizations need visibility into the devices connecting to applications both on the network and in the cloud. Organizations need the ability to establish trust in the devices connecting to resources containing sensitive information.
Curious how you can determine if you can trust the endpoints that are connecting to your business resources? Ask yourself a few quick questions:
Are you able to automatically notify users of out-of-date software to reduce your help desk tickets or block devices that have been compromised? Or automatically quarantine malicious files from infecting your entire network?
Can you enforce endpoint controls for risky devices or corporate-owned devices? What about contractor devices or external third parties connecting to your network?
Can you enforce access policies based on the application risk or whether the device is a known healthy device that meets security guidelines?

Establishing Trust in Endpoints
In order to effectively establish trust in user devices, organizations should have device-based policies in place to prevent access by any risky or unknown devices. By validating the device is both healthy and meets security policies, you can ensure they’re trustworthy – key components of the Cisco Zero Trust security approach for the workforce.
Cisco implements zero trust with a three-step methodology across the workforce, workloads and workplace by:
Establishing trust of a user, device, application, etc. – before granting access or allowing connections or communications.
Enforcing trust-based policies with granular controls based on changing context – such as the security posture of devices and the behavior of applications
Continuously verifying trust by monitoring for risky devices, policy noncompliance, behavior deviations and software vulnerabilities
With Duo and Cisco® Advanced Malware Protection (AMP) for Endpoints, organizations have the tools in place to effectively establish trust in users‘ devices connecting to protected applications. The ability to prevent, detect and respond are key elements when considering device trust in a zero-trust security approach for the workforce.
Trust Through Protection and Detection
Establishing trust extends beyond managing the status of the device to include inspecting the device and controlling access based on risk evaluations to ensure only devices that are healthy and meet your security controls are able to gain access to your corporate systems. With Duo Trusted Endpoints, you can enforce controls and policies to keep risky endpoints from accessing your applications. This includes devices that are unmanaged; don’t meet OS requirements; status of enabled security features (configured or disabled); full disk encryption.
AMP for Endpoints offers endpoint protection, advanced endpoint detection and response capabilities and a holistic view of your endpoints, regardless of operating system. AMP continuously monitors and analyzes all file and process activity within your network to find and automatically block threats that other solutions miss. It has more than 15 built-in protection and detection mechanisms to prevent threats from compromising your business. With a few clicks in AMP’s browser-based management console, the file can be blocked from running on all endpoints. AMP knows every other endpoint the file has reached, so it can quarantine the file for all users.
Available Soon – Integration between Duo Security and AMP for Endpoints
Adding AMP for Endpoints as a Trusted Endpoint in Duo provides the ability to protect applications from devices that have been flagged by AMP as an infected endpoint containing malware. This prevents access to any application that contains sensitive data reducing the risk of data loss.
Duo’s access policies will allow admins to entirely block access to devices flagged by AMP without blocking the user entirely, permitting them to access applications from an alternate device to ensure continued productivity.
The automatic isolation and blocking of compromised devices provides organizations the ability to quickly remediate potential threats, reducing their risk surface without completely interrupting user productivity.

Duo and AMP provide organizations with comprehensive tools to prevent, detect and respond to potential threats from endpoint devices, helping to establish trust in those devices.
Learn more about Cisco Zero Trust, and get started with a free trial of Duo and Cisco AMP for Endpoints to start establishing trust in your endpoints today.

The post Establishing Device Trust to Secure the Workforce appeared first on Cisco Blogs.

Source:: Cisco Security Notice

/von

Securing Your Future by Innovating Today

By Jeff Reed At a time when cybercrime costs three times more than natural disasters globally1, the demands on security are constantly growing. Whether you’re asked to protect a workforce that roams anywhere, a workplace that is digitized, or workloads that run wherever, your disparate security solutions are creating discord and an untenable level of complexity.
At Cisco, we’ve been on a quest to change that, and we believe we’re uniquely positioned to redefine security. As you’re innovating to build your future, we’re innovating to keep it secure — by creating a comprehensive platform approach and continuously evolving our security technologies.
That’s why I’m excited today to share some of the recent innovations across our security portfolio. With a cloud-powered platform approach in mind, these enhancements are designed to break down silos between SecOps, NetOps, and ITOps and free up your time by:
Simplifying your firewalling experience with more consistent policy management with cloud-native environments and cloud-based logging.
Accelerating your cloud adoption with new secure web gateway and firewall services in the cloud, deployed through a single IPsec tunnel.
Future-proofing your security with an industry-validated zero-trust approach for your workforce, workloads, and workplace, while integrating threat context.
Simplifying your breach defense experience with more visibility and actions for threat response, plus new services delivered by Cisco experts to help augment your team.

Experience the future of firewalling
As you’re moving applications into the cloud, the NetOps‘ job is expanding to include cloud-native firewalls. Securing all control points across this multicloud environment should not feel like reinventing the wheel. We’re simplifying the experience and enabling NetOps to maintain consistent policies across firewalls, and into the cloud, starting with support for AWS, with more cloud providers roadmapped. Additionally, to help you easily maintain consistent policies as you’re adopting SD-WAN, we’ve simplified policy management for Meraki MX, one of our SD-WAN solutions. Just a few clicks, that’s all it takes to seamlessly harmonize policies across your hybrid environment.
We’re also improving visibility and making compliance easier with cloud-based logging for our NGFWs. This new capability aggregates and centralizes the on-prem and cloud logs so you can search, filter, and sort them, accelerating investigations while ensuring your organization complies with industry regulations.
The increased user connectivity to the cloud creates new demands for faster speeds, so we’re raising the bar with our appliances as well. The latest models of our NGFWs offer a 3X performance boost over previous appliances and optimize the performance-to-price ratio to keep your network — and business — running smoothly and securely.
Accelerate cloud adoption securely
To help you transition to the cloud successfully— and protect any user, anywhere they connect to the internet — while saving a considerable amount of resources, we’ve consolidated a broad range of security services into a single, cloud-delivered security solution and dashboard. Alongside DNS-layer security, CASB, and interactive threat intelligence services, we’ve added secure web gateway and firewall services to our cloud security solution to deliver deeper visibility and control over all ports and protocols, even encrypted web traffic.
The secure web gateway (full proxy) provides complete web traffic visibility, control, and protection — with capabilities like decrypting and scanning files on any site, filtering out inappropriate or malicious URLs, sandboxing unknown files, and blocking applications or app functions.
With this comprehensive set of functionalities, you can rely on us for the full security stack at smaller branches as you adopt SD-WAN. A single configuration in our networking product dashboards deploys DNS-layer security across hundreds of network devices, including SD-WAN. Additionally, a single IPsec tunnel deploys secure web gateway and firewall from any network device, including SD-WAN. Our integrated approach and Anycast routing can efficiently protect your branch users, connected devices, and application usage from all internet breakouts with 100% business uptime.
Secure access with a zero-trust approach
We have been working over the past year to create a more comprehensive zero-trust framework. Based on customer feedback, we focused on securing three key pillars: workforce, workloads, and workplace. We are thrilled that Forrester recognized our strides and named Cisco a leader in the recently released Forrester Wave among Zero Trust eXtended Ecosystem Platform Providers. As the analyst report noted, “Cisco excels in zero trust with a renewed and targeted focus … and is well-positioned as a prominent zero-trust player.”
We continue to innovate in this space and are reducing risks based on device trust by integrating our threat-detection capabilities with multi-factor authentication. The majority of breaches originate on the endpoint, but what if ITOps could establish trust in a user device before it’s allowed any access to sensitive resources? By safeguarding against vulnerable or compromised endpoints and blocking their access, you’ll be able to better detect and respond to malware threats as well as prevent data breaches.
Adopt breach defense everywhere
Taking endpoint defense one step farther, we added the ability to isolate an endpoint, which stops malware from spreading while giving SecOps time to remediate without losing forensics data, or simply giving ITOps time to troubleshoot an unknown issue. Making breach defense less overwhelming, endpoint isolation empowers incident investigators to uncover endpoint data that wasn’t available before — using advanced search with more than 300 query parameters, such as listing applications with high memory utilization.
Malware is also a growing problem at the network level because adversaries have learned to hide behind encrypted traffic. We’ve extended the capability to analyze encrypted traffic behavior into the cloud, providing higher fidelity of threat protection and enabling cryptographic compliance. At the same time, we’re simplifying investigations, giving you deeper visibility at multiple layers, and helping you respond quicker across different vectors by integrating network security analytics with our unified threat response application.
If you need help preparing for and responding to attacks, you can augment your team with our incident response services, now part of Talos. You know Talos as the team who’s constantly researching new threats on your behalf, and now they can integrate that intel even faster across our entire portfolio — benefitting not only retainer customers but everyone. For even leaner teams that need next-level support, we’re adding managed threat detection and response services to help you leverage your Cisco Security investments 24x7x365.
Several of these innovations are industry firsts, and we’re excited to offer customers new ways to better manage their growing business demands. I encourage you to take a closer look at these enhancements and discover how they can make your security an enabler rather than a barrier.
Get Started
Ready to experience for yourself how Cisco can simplify your experience, accelerate your success, and secure your future?
Simplify security and respond to threats with a few clicks using the free Cisco Threat Response application, available for all our solutions as part of our platform approach.
Experience the future of firewalling — see how easy it is to harmonize firewall policies with a free trial to Cisco Defense Orchestrator and learn more about the new Firepower Next-Generation Firewall.
Accelerate your cloud adoption, starting with a free trial of Umbrella, our comprehensive cloud-security solution.
Start with securing your workforce with a zero-trust approach using a Duo free trial.
Enable SecOps to detect, investigate, and respond to threats more efficiently with a free trial to Advanced Malware Protection (AMP) for Endpoints, and get better visibility into encrypted traffic with a free trial to Stealthwatch, our network traffic security analytics solution.
Augment your team and improve your readiness for attacks with Talos Incident Response and our managed security

Source:
1Allianz Risk Barometer, 2019

The post Securing Your Future by Innovating Today appeared first on Cisco Blogs.

Source:: Cisco Security Notice

/von