Book Review: Securing the Borderless Network

Book: Securing the Borderless Network
Published By: Cisco Press
Author: Tom Gillis

"Today’s new Web 2.0, virtualization, mobility, telepresence, and collaborative applications offer immense potential for enhancing productivity and competitive advantage. However, they also introduce daunting new security issues, many of which are already being exploited by cybercriminals. Securing the Borderless Network is the first book entirely focused on helping senior IT decision-makers understand, manage, and mitigate the security risks of these new collaborative technologies."

Honestly when this book arrived, I was very sceptical.

Written by Tom Gillis, Vice president and General Manager of the Security Technology Business Unit at Cisco, and only 150 pages, I was not expecting anything special.

The book I would say is aimed at the IT Manager and senior IT decision makers, ie, no CCIE or CCNA material, but it is good read for the IT Professional.

Gillis obviously knows his stuff, and clearly defines what the current Web 2.0 threats and challenges are to todays businesses and beyond.

The book evolves from discussing yesterdays technologies, right up to the current day, with smartphones, malware, DLP issues etc, and what challenges this evolution has now presented us with, regarding the "Borderless Network"

All a quick and enjoyable read, I'd recommend it.

Cisco MARS 6.0.7 Now Available

Cisco have released MARS version 6.0.7

You can read the release notes HERE

Changes and Enhancements

The following enhancement exists in Cisco Security MARS, Release 6.0.7:

•Support for Windows 2008—Cisco Security MARS provides agent based, native log support for Windows 2008 server hosts. Users can send syslog to CS-MARS by installing a Snare agent on their Windows 2008 server hosts.

•Support for Windows IIS 7—Cisco Security MARS provides support for IIS 7 on Windows 2008 servers.

Enjoy :-)

Cisco ASA Secure Logging and MARS

Doug McKillip, a Global Knowledge Instructor, has created a white paper, "Using Syslog Effectively for Security Troubleshooting".

Part of this whitepaper, details using The Cisco ASA Secure Logging feature, over TCP to Cisco MARS.

You can get access to this whitepaper HERE.

Further info on secure logging and the ASA, can be found here, in the  Cisco ASA 8.2 CLI Guide.

MARS Support for SNMP V3

Rather than re-invent the wheel, there is a good write up on the new SNMP v3 feature, in MARS 6.0.6 on the Global Knowledge Blog.

Fancy a new Job?

I have been busy recently on a couple of new demos on making the most of MARS, by interfacing with some 3rd party products, unfortunately these are not finished yet.

But in the meantime I thought i would let you know about some jobs that are going at the United Health Group.

Recession -what recession? !!!

Network Manager – United Health Group

UHG has multiple network operations positions open within our corporate departments and various business segments. These positions offer tremendous growth possibility, a range of variety and responsibility, a high level of visibility and interaction with senior leaders.

Requirements (Skills, Technologies, etc) –

· 2+ Years of experience in a contracting or provider relations role working for a healthcare payor.

· BS degree in Business, or equivalent experience; MBA strongly preferred for some positions

· Ability to supervise staff including related personnel and development issues (i.e. appraisals, career planning, coaching, etc.) required for some positions.

· Advanced analytical skills

· Excellent verbal and written communication skills; ability to speak clearly and concisely, conveying complex or technical information in a manner that others can understand, as well as ability to understand and interpret complex information from others.

You can see more info and apply for these postions HERE


If I find out about any more tech related jobs, I`ll let ya know!

Cisco MARS 6.0.6 Now Available

Release Notes for 6.0.6 are available HERE

Miscellaneous Changes and Enhancements

The following changes and enhancements exist in MARS, Release 6.0.6:

•SNMP v. 3.0 Support—Leveraging a secure communication protocol between MARS and Cisco security enforcement devices, customers can be assured that they are securely mitigating attacks and configuring and managing devices. SNMPv3 support enables the following features:

–Per-device SNMPv3 credentials are used for manual discovery and layer 2 mitigation.

–Support for SNMPv3 credentials for an entire network or range of IP addresses. The MARS autodiscovery feature clones the credentials for an autodiscovered device on that network.

–Monitor the health of supported devices via SNMPv3 via the resource utilization charts that you can add to the Summary > My Reports subtab.

See the Release notes for a matrix of SNMP3 support for different Cisco Devices.

Internet Explorer 8 Support—MARS supports Microsoft Internet Explorer 8 without requiring compatibility mode. Due to the nature of security revisions in Internet Explorer, you may find that you must authenticate more frequently to the MARS appliance.

•Improved Device Support—MARS now includes backward compatible support for ASA 8.0.5 and IOS 15.0(1)M. Backward compatible support means that any events that MARS parsed for ASA 8.0.4 or IOS 12.4 (11) T2 have been verified to parse in the corresponding newer release.

There have also been vendor signature updates for some Cisco and some non Cisco devices.

CVE-2009-2977

Thanks to an eagle eyed reader, (though it is a couple of months old now), if you are running 6.0.4 and earlier, there is an Vulnerability when MARS is configured to pull Windows Event Logs.

"The Cisco Security Monitoring, Analysis and Response System (CS-MARS) 6.0.4 and earlier stores cleartext passwords in log/sysbacktrace.## files within error-logs.tar.gz archives, which allows context-dependent attackers to obtain sensitive information by reading these files."

You can view the CVE Here.

This was covered by Cisco Bug: CSCtb52450 , which mentioned it was only a bug when MARS was configured to PULL events rather than using Snare (or Honeycomb, and similar products)

Its was also mentioned , the issue can be mitigated if log files are not exported out of the CS-MARS device. (Only CS-MARS administrators can export log files)

BTW this was resolved in MARS release 6.0.5

No Updates for Non Cisco Devices?

There has been plenty of rumours recently regarding MARS, and its support for Non Cisco Devices, more so, over the last couple of days...

Whether its Gartner a few days ago, or MARS competitors, like Nitro putting out releases yesterday, (and I`d fully expect the others to follow)

I noticed an official Business Unit response, in the Netpro Forums......

"October 30, 2009

Cisco response to Gartner Research Memo entitled “Cisco MARS Is Becoming Less Viable as a General SIEM Solution”
Summary
• Gartner has alerted its customers that as Cisco continues to focus its security management efforts on Cisco devices, MARS appliances may become less viable for the broad set of “general” SIEM use cases.
• Gartner concludes that Cisco’s focus on native management capabilities for our devices is a positive direction.
• For customers with primarily Cisco event sources on their network, Gartner recommends that MARS still provides a strong platform for security threat management (STM) and network behavior analysis (NBA) capabilities.
Details
On October 29th, 2009, Gartner released a research note titled “Cisco MARS Is Becoming Less Viable as a General SIEM Solution.” This note is in response to Cisco’s stated direction to focus CS-MARS development on supporting Cisco-built network security devices and critical host operating systems. Non-Cisco network device data and signature updates continue to be supported in CS-MARS for the current versions of these 3rd-party systems.
In the memo, Gartner concludes that “Cisco will focus its efforts on improving Cisco's native security management capabilities,” which they note as a positive direction for Cisco’s overall Security portfolio.

In the past, we have encouraged Gartner to break up this crowded space as it encompasses a vast array of use cases spanning compliance reporting, log aggregation, threat identification, and mitigation. While MARS has been placed in the SIEM market, it has never fully covered all aspects of the Gartner-defined space. Over the last year, as we have focused on the core Security Threat Management use cases for Cisco products, Cisco has de-emphasized compliance reporting and non-Cisco devices.

In particular for Cisco customers, it is important to note Gartner’s recommendation that MARS continues to provide strong STM and NBA capabilities for Cisco event sources. "

Stinky......

Book Review: Cisco Routers for the Desperate, 2nd Ed

"Cisco Routers for the Desperate, 2nd Edition is designed to be read once and left alone until something breaks. When it does, you'll have everything you need to know in one easy-to-follow guidebook."

Cisco Routers for the Desperate, 2nd Edition, by Michael W.Lucas, condenses all you need to know about Cisco routers, and some switching down to a mere 125 pages.

Now your not going to pass your CCIE, or CCNA for that matter, with just this book. The sections covered are quite basic and to the point, but there are many people in the market place, who just have never had any official training on Cisco kit, and this book is for them.

How to navigate an IOS interface, configure interfaces, time, back up configs etc, are covered with a quirky writing style, then a redundancy chapter on BGP and HSRP will start to wet your cisco appetite.

All in all, a good read for anyone new to Cisco kit, or for the plenty of people out there, who did the CCNA course years ago, never did the exam, and now finally get your "hands on", and cant remember the basics!

MARS 6.0.5 FIPS PCI Card Notes

As you may of read in the release notes for MARS 6.0.5, a FIPS PCI Card is available for the MARS 110R

You can read details here