Security

Cloud applications are now commonplace in enterprises. From productivity applications to storage, employees and IT departments are realizing the benefits of offloading documents and data into the cloud. But as data, identities, and applications move to the cloud, security teams must manage the risk…

Fast, good, and cheap. Or: Time, resources and budget. The Project Management Triangle. The Iron Triangle.  The Triple Constraint. There are many names for the program management challenge of balancing three constraints, but it all comes down to this: you can’t have all three. You can do something…

In the recently released Cisco 2018 Annual Cybersecurity Report, 2017 saw growth in malware targeted at ransom or profit motives, but also the destruction of systems and data. Malware continues to get more sophisticated and is now able to elude sophisticated sandboxing environments.  Encryption cont…

Gozi ISFB is a well-known and widely distributed banking trojan, and has been in the threat landscape for the past several years. Banking trojans are a widely distributed type of malware that attackers leverage in an attempt to obtain banking credentials from customers of various financial instituti…

Detecting User Interaction Evasion Techniques Malware sometimes checks for user interaction as a form of evasion to avoid being detected by antiviruses and other security software, especially sandbox analysis environments. Threat Grid, Cisco’s advanced sandbox analysis environment, has recently adde…

Investigators given a no-cost Threat Grid account to fight cybercrime I received my first computer forensic training at the Federal Law Enforcement Training Center’s (FLETC) Seized Computer Evidence Recovery Specialist (SCERS) course in Glynco, GA; while a Special Agent for the US Army Criminal Inve…

Overview Talos is disclosing several vulnerabilities identified in Simple DirectMedia Layer’s SDL2_Image library that could allow code execution. Simple DirectMedia Layer is a cross-platform development library designed to provide low level access to audio, keyboard, mouse, joystick, and graph…

Overview Today, Cisco Talos is disclosing a single out-of-bounds read vulnerability in the Dovecot IMAP server. Dovecot is a popular internet message access protocol, or IMAP, server with performance and security-oriented design. It is a popular choice for robust email servers. In accordance with ou…

For years, we’ve been pioneering the use of DNS to enforce security. We recognized that DNS was often a blind spot for organizations and that using DNS to enforce security was both practical and effective. Why? Because DNS isn’t optional. It’s foundational to how the internet works and and is used b…