A string of takeovers has given Cisco new security capabilities, and this week the company revealed how it’s putting the pieces together. The IT giant has added new analytics capabilities to its malware protection portfolio, bringing together firewall technology acquired from Sourcefire in 2013 and analytics abilities acquired last year from Threat Grid.
Security engineer Jason Brvenik, who came to Cisco from Sourcefire, explained that the integration of Threat Grid will allow Cisco to help companies learn from one another’s security mishaps.
[button link=”http://telecomcareers.net/JobseekerX/SearchJobs.asp?kwrd=programmer&kwdt=1&st=&btnSearch.x=-456&btnSearch.y=-372&btnSearch=Search” text_color=”#ffffff” color=”#1d1abe”]Hundreds of Programming career opportunities await. Find your perfect fit at TelecomCareers today![/button]
“The attacker benefits from attacking more than one company,” he said. “Company A – they learn something. Company B – they learn something. At Company C – they’ve benefitted from attacking A and B. The companies themselves learn nothing as a result of those attacks because they have no way to operationalize the data that they’ve obtained and to share it with their peers. Our threat intel engines allow that operationalized action to occur so that Company C is informed from the actions that took place at Company A and Company B.”
“At the point that we determine something is malicious we can reach back in time to the origin of that malicious behavior wherever it originally manifested and convict the entire chain of activity and tools associated, and not just for the one customer where we’ve seen it occur, but for all customers that have experienced or interacted with the same tool sets,” said Brvenik.
Cisco’s new solution can be run on-premise or from the cloud. Brvenik said that even when the software is on-premise it is still informed by Cisco’s global security intelligence.
The human factor
Companies may think of their data in the aggregate, but security is ultimately about individuals, and this is even more true now that personal mobile devices have infiltrated the workplace.
“The mobile devices are in the hands of the weakest link,” said James Mobley, former CEO of Neohapsis, which was acquired this year by Cisco. “Because of that, you have to begin to look at other technologies that could add a layer of control. You can’t expect some of the least-technical users to be a layer of defense for you beyond what you could do on your own.”
Cisco has launched a new firewall solution for midsize companies, recognizing that smaller businesses are often the most reliant on personal mobile devices, and are therefore especially vulnerable.
“If incidents occur they’re going to more and more often occur by way of jumping through mobile apps, intermixing personal apps with business apps, creating springboards, bypassing some of the controls,” said Mobley.
Mobley and his team of security experts bring to Cisco critical skill sets that are in short supply. Mobley said that the pool of qualified troubleshooters is not keeping pace with the demand for security expertise. Experts in mobile security are especially valuable.
“One of the top issues now for about the past two or three years has been specifically around the mobile apps and I think that the awareness of that … is very well known,” Mobley said. “I think most of the larger enterprises that we have worked with have moved from having a lot of their investments around traditional investment to focusing that on both mobile as well as the apps that run in the cloud including the APIs.”
Cisco’s recently announced purchase of Embrane should provide another brick in its security bunker. Embrane could help Cisco virtualize many of the services it already offers.
“With Embrane and its ecosystem of partners, IT managers benefit from increased agility and automation of a virtual infrastructure without the increased complexity and inflated costs. Deploying virtual network services from A10 Networks, Cisco, Citrix and Sourcefire (acquired by Cisco) becomes easier and more automated with Embrane,” said analyst Simon Leopold of Raymond James Equity Associates.
