Cisco Security Manager CSM Overview – 4.6 SP1 Update Available

Posted on July 18, 2014 by admin

This week’s product overview is Cisco Security Manager also known as CSM. For some people, hearing CSM makes them cringe as older versions from 4+ years ago had some issues. Personally, I consider the recent CSM release a completely different solution and I’m sure just by the screenshots, people familiar with the old version will not recognize anything as its been completely rebuilt.

Cisco Security Manager is used to manage multiple Cisco security products. Management includes centralizing configuration, quickly troubleshooting security events, unifying software versions, backing up configuration, enforcing policies for best practice, and reporting. Products that can be managed by CSM include ASAs, IPS modules / Appliances, Firewall Service Modules, ISR routers, Switches and VPN. Its installed as a software package but can also be purchased as a bundle with a UCS server for those looking for a appliance feel. Continue reading →

Rating: 0.0/5 (0 votes cast)

Splunk + Other YouTube Channels

Posted on July 15, 2014 by admin

Centralizing alerting from multiple devices and speeding up incident response are just some of the critical issues solved by investing in SIEM technology (more on choosing the best SIEM for your environment HERE).

There are many SIEM vendors however I continue to be impressed by what Splunk is doing in regards to their open source APPs developed by customers and Splunk engineering. I wrote a blog post HERE that showcases a Cisco management APP that can correlate events from various security products such as Cisco ISE, WSA, Firewalls, Sourcefire and so on. There isn’t a Cisco manager of managers so doing things like running a report on high level events against any security product for a particular IP address can only be accomplish by a SIEM solution. Continue reading →

Rating: 5.0/5 (1 vote cast)

ASA CX 9.3.1.1 Out Now – New Features And Upgrade Overview

Posted on July 8, 2014 by admin

Cisco has been in the firewall business since the mid 90s. They have built upon that platform by adding VPN and now various “next generation” security features such as IPS/IDS, Reputation blocking and Application Visibility and Controls all from a single solution. This is know as ASA CX (more on ASA CX found HERE and how to build a lab found HERE). The latest release just came out June 30th and available for download. The ASA 9.3 release notes can be found HERE.

Here is an overview of whats new with 9.3 Continue reading →

Rating: 0.0/5 (0 votes cast)

Using Lancope to identify Putter Panda, Heartbleed and other attacks

Posted on July 7, 2014 by admin

Lancope is a NetFlow based tool that can turn your network into a gigantic sensor grid. This includes routers, switches, wireless access points, virtual systems aka servers in your data center and so on. So rather than having a handful of security tools looking for threats, your entire network takes part in your security defense against cyber attacks. I’ve wrote about Lancope HERE as well as how to build your own Lancope lab HERE. The Lancope team runs a blog found HERE that has provided posts about using their solution to identify the latest cyber attacks. Some interesting articles recently posted focus on threats like Heartbleed, Putter Panda and Saffron Rose. Continue reading →

Rating: 5.0/5 (2 votes cast)

Duo Security Researchers Uncover Bypass of PayPal’s Two-Factor Authentication

Posted on July 1, 2014 by admin

Researchers at Duo Labs, the advanced research team at Duo Security, discovered that it is possible to bypass PayPal’s two-factor authentication (the Security Key mechanism, in PayPal nomenclature). The vulnerability lies primarily in the authentication flow for the PayPal API web service (api.paypal.com) — an API used by PayPal’s official mobile applications, as well as numerous third-party merchants and apps — but also partially in the official mobile apps themselves. Continue reading →

Rating: 0.0/5 (0 votes cast)

Interview with Aamir Lakhani Co-Author of Web Penetration Testing with Kali Linux

Posted on June 25, 2014 by admin

Here is the other SecurityOrb Interview with my good buddy Aamir Lakhani. Kellep Charles interviewed both of us regarding our book and other general security topics. You can find the Aamir Lakhani interview HERE or on the Security ORB website. Continue reading →

Rating: 5.0/5 (1 vote cast)

2014 Cisco Live Talk: Splunk Analytics and Cisco for Security and BYOD

Posted on June 23, 2014 by admin

The Splunk and Cisco team delivered a great talk at this past Cisco Live event in San Francisco. The talk covered the value of integrating Splunk with Cisco Cloud and Managed Security services. Continue reading →

Rating: 4.7/5 (3 votes cast)

Interview with Joseph Muniz Co-Author : SecurityOrb Podcast

Posted on June 18, 2014 by admin

Kellep Charles from SecurityOrb interviewed me a few weeks back about my book as well as other general security topics. You can find the recording HERE or on the SecurityORB website. I was fighting a cold so my apologies for the raspy voice.

For those interested in the book, below is a discount code you can use provided by SecurityORB. The link to the book is on the right side of this blog. Continue reading →

Rating: 0.0/5 (0 votes cast)

Sourcefire Defense Center Overview

Posted on June 16, 2014 by admin

Cisco acquired Sourcefire in 2013 as part of a strategic move to enhance Cisco’s security portfolio. Sourcefire’s catalog covers IPS/IDS, Application Security and Control, Firewalling, Malware Detection and a slew of open source tools such as SNORT, ClamAV, and Razorback.

One key piece to the Sourcefire puzzle is the management of the various solutions. This is done through Defense Center, which is the centralized management tool used for visibility of security and network events across the entire network. This post will provide a overview of using Defense Center from a administrative viewpoint.

Sourcefire login screen Continue reading →

Rating: 3.7/5 (3 votes cast)