Primer on the Common Vulnerability Scoring System CVSS
What is CVSS - (the Common Vulnerability Scoring System)? How can it help me manage risk - and why is it an important step forward in security research? In this short video Gavin Reid CVSS Program...
View ArticleCisco’s Global WSA deployment – Update
This is an update for our original video/blog post (http://blogs.cisco.com/security/cisco-ironport-web-security-appliance-deployment/) on Cisco's CSIRT deployment of the Web Security Appliance.
View ArticleCSIRT Monitoring for Cisco House at the London 2012 Olympic Games
As part of CSIRT’s mobile monitoring offering for special events, we undertook monitoring of the corporate and customer traffic of [...]
View ArticleCisco Hosting Amsterdam 2013 FIRST Technical Colloquium
There is still time to register for the upcoming FIRST Technical Colloquium April 2-3 2013. The event has a very exciting program covering, [...]
View ArticleThoughts on DarkSeoul: Data Sharing and Targeted Attackers
The attacks against South Korean media and banking organizations last week severely disrupted a handful of organizations with a coordinated [...]
View ArticleChronology of a DDoS: SpamHaus
Around 12:00 GMT March 16, 2013, a distributed denial of service (DDoS) attack took offline both the spamhaus.org website and [...]
View ArticleApache Darkleech Compromises
Dan Goodin, editor at Ars Technica, has been tracking and compiling info on an elusive series of website compromises that could be impacting tens of thousands of otherwise perfectly legitimate sites....
View ArticleMassive Spam and Malware Campaign Following the Boston Tragedy
Summary On April 16th at 11:00pm GMT, the first of two botnets began a massive spam campaign to take advantage [...]
View ArticleYesterday Boston, Today Waco, Tomorrow Malware
At 10:30 UTC one of the botnet spam campaigns we discussed yesterday took a shift to focus on the recent explosion in Texas. The miscreants responded to the tragic events in Texas almost immediately....
View ArticleCustomized WordPress, Joomla Brute Force Login Attempts
In recent weeks, the occurrence of brute force login attempts targeting WordPress and Joomla installations have significantly increased in volume, [...]
View ArticlePossible Exploit Vector for DarkLeech Compromises
Often it is quite surprising how long old, well-known vulnerabilities continue to be exploited. Recently, a friend sent me an example of [...]
View ArticleLinux/CDorked FAQs
Last Friday (April 26), ESET and Sucuri simultaneously blogged about the discovery of Linux/CDorked , a backdoor impacting Apache servers running cPanel. Since [...]
View ArticleCoordinated Attacks Against the U.S. Government and Banking Infrastructure
Prologue On April 10, 2013, a collective of politically motivated hacktivists announced a round of planned attacks called #OPUSA . These attacks, [...]
View ArticleSTOPhausDDoS: Suspect in Custody
Back in March, Seth Hanford wrote about a distributed denial of service (DDoS) attack aimed at the SpamHaus organization . Since then, there have been some new developments in the aftermath of the...
View ArticleSecurity Logging in an Enterprise, Part 1 of 2
Logging is probably both one of the most useful and least used of all security forensic capabilities. In large enterprises many security teams rely on their IT counterparts to do the logging and then...
View ArticleDepartment of Labor Watering Hole Attack Confirmed to be 0-Day with Possible...
At the end of April a Watering Hole–style attack was launched from a United States Department of Labor website. Many [...]
View ArticleSecurity Logging in an Enterprise, Part 2 of 2
We first logged IDS, some syslog from some UNIX hosts, and firewall logs (circa 1999). We went from there to dropping firewall logging as it introduced some overhead and we didn’t have any really good...
View ArticleWatering Hole Attacks an Attractive Alternative to Spear Phishing
“Watering Hole” attacks, as evidenced by the recent attack involving the U.S. Department of Labor , are becoming increasingly popular as alternatives to attacks such as Spear Phishing. [...]
View ArticleThe Effects of #OpUSA
In the days leading up to #OpUSA, security professionals were busy making preparations for the supposed flood of new attacks [...]
View ArticleCisco Sizzle – April Edition
Welcome to the Cisco Sizzle! Each month, we’re rounding up the best of the best from across our social media [...]
View Article
