Payment Card Industry PCI Security Best Practices

PCI 1 Payment Card Industry PCI Security Best PracticesMany industries rely on revenue generated by sales and if credit is used, Payment Card Industry (PCI) compliance is mandated. This includes all industries that process, store or transmit credit card information. Like any compliancy standard, this is the minimal level of real security and should not be considered the goal to protect sensitive data. All compliance mandates that matter must go through various review and audit processes that take time and cause the results to be dated compared to the speed of new attacks you should expect against your network. This means meeting mandates such as PCI should just be part of your overall security strategy. Continue reading

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)

Cisco Midyear Security Report Highlights Weak Links in Increasingly Dynamic Threat Landscape

Cisco Security Report Cisco Midyear Security Report Highlights Weak Links in Increasingly Dynamic Threat Landscape

The Cisco 2014 Midyear Security Report found HERE examines threat intelligence and security trends for the first half of 2014. Cisco’s research helps to underscore just how many different types of weak links exist in the systems we use. These weak links – which could be outdated software, bad code, abandoned digital properties, or user errors – contribute to the adversary’s ability to exploit vulnerabilities with methods such as DNS queries, exploit kits, amplification attacks, point-of-sale (POS) system compromise, malvertising, ransomware, infiltration of encryption protocols, social engineering and “life event” spam. Continue reading

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)

Beating Telemarketers With Customized Automated Call Center Management

 Beating Telemarketers With Customized Automated Call Center Management

A buddy of mine at Cisco is truly a genius when it comes to thinking outside the box. He loves technology and hates annoying telemarketers. Over time, he developed a call management system that involves a combination of open source software and proprietary hardware. He took advantage of the numerous application programing interfaces (API’s) available to create a tightly integrated environment. Continue reading

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)

Russia offers over $100,000 to de-anonymize Tor

Russia1 Russia offers over $100,000 to de anonymize Tor

Patrick Howell O’Neill from the dailydot.com posted about how Russia is offering a reward for de-anonymizing Tor. The original post can be found HERE.

Here are the highlights: Continue reading

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)

Cisco ISE with VPN overview: ASA Version 9.2.1 with ISE 1.2 remediation without an IPN

remote access Cisco ISE with VPN overview: ASA Version 9.2.1 with ISE 1.2 remediation without an IPN

One common question I’ve been asked is what are the current requirements to perform authentication, authorization, and remediation when using VPN (usually Cisco ASA VPN) and Cisco Identity Services Engine ISE. This post will cover this subject however I suggest for those with Cisco ASA 9.2.1 and ISE should reference this really good configuration guide found HERE. Continue reading

VN:F [1.9.22_1171]
Rating: 2.0/5 (1 vote cast)

Cisco Security Manager CSM Overview – 4.6 SP1 Update Available

CSM 11 Cisco Security Manager CSM Overview   4.6 SP1 Update Available

This week’s product overview is Cisco Security Manager also known as CSM. For some people, hearing CSM makes them cringe as older versions from 4+ years ago had some issues. Personally, I consider the recent CSM release a completely different solution and I’m sure just by the screenshots, people familiar with the old version will not recognize anything as its been completely rebuilt.

Cisco Security Manager is used to manage multiple Cisco security products. Management includes centralizing configuration, quickly troubleshooting security events, unifying software versions, backing up configuration, enforcing policies for best practice, and reporting. Products that can be managed by CSM include ASAs, IPS modules / Appliances, Firewall Service Modules, ISR routers, Switches and VPN. Its installed as a software package but can also be purchased as a bundle with a UCS server for those looking for a appliance feel. Continue reading

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)

ASA CX 9.3.1.1 Out Now – New Features And Upgrade Overview

GUI 2 ASA CX 9.3.1.1 Out Now   New Features And Upgrade OverviewCisco has been in the firewall business since the mid 90s. They have built upon that platform by adding VPN and now various “next generation” security features such as IPS/IDS, Reputation blocking and Application Visibility and Controls all from a single solution. This is know as ASA CX (more on ASA CX found HERE and how to build a lab found HERE). The latest release just came out June 30th and available for download. The ASA 9.3 release notes can be found HERE.

Here is an overview of whats new with 9.3 Continue reading

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)

Using Lancope to identify Putter Panda, Heartbleed and other attacks

what is forensic locksmithing Using Lancope to identify Putter Panda, Heartbleed and other attacks Lancope is a NetFlow based tool that can turn your network into a gigantic sensor grid. This includes routers, switches, wireless access points, virtual systems aka servers in your data center and so on. So rather than having a handful of security tools looking for threats, your entire network takes part in your security defense against cyber attacks. I’ve wrote about Lancope HERE as well as how to build your own Lancope lab HERE. Lancope Infographic option2 Using Lancope to identify Putter Panda, Heartbleed and other attacks The Lancope team runs a blog found HERE that has provided posts about using their solution to identify the latest cyber attacks. Some interesting articles recently posted focus on threats like Heartbleed, Putter Panda and Saffron Rose. Continue reading

VN:F [1.9.22_1171]
Rating: 5.0/5 (3 votes cast)

Interview with Aamir Lakhani Co-Author of Web Penetration Testing with Kali Linux

SecurityOrb2 Interview with Aamir Lakhani Co Author of Web Penetration Testing with Kali Linux

Here is the other SecurityOrb Interview with my good buddy Aamir Lakhani. Kellep Charles interviewed both of us regarding our book and other general security topics. You can find the Aamir Lakhani interview HERE or on the Security ORB website. Continue reading

VN:F [1.9.22_1171]
Rating: 5.0/5 (1 vote cast)