Logo

 

Attacks Risk Report
Prepared for Cisco dCloud
Wednesday, September 21, 2016
Prepared by Scott Barasch
Contact: sbarasch@cisco.com

Logo

I. Executive Summary

Cisco has determined that Cisco dCloud is at a high risk due to the observation of attacks on the network targetting hosts that may be vulnerable. These attacks and hosts require further investigation to help lower the risk.

Assessment Period: Wed Sep 14 2016 15:14:53 to Wed Sep 21 2016 15:14:53
Total Attacks
14,660
Total Attacks
Relevant Attacks
74
Relevant Attacks
Hosts Targeted
10
Hosts Targeted
Irrelevant Attacks
99.5%
Irrelevant Attacks
Events Requiring Attention
0.5%
Events Requiring Attention
Hosts Connected to CnC Servers
0
Hosts Connected to CnC Servers

Relevant Attacks Carry the Following Risks

ClassificationCount
Unknown Traffic7,683
Attempted Information Leak4,291
Potentially Bad Traffic1,270
Misc Activity482
Information Leak479
Cisco recommends that Cisco dCloud deploy Cisco Firepower Appliances to:
  1. Establish continual visibility into its network attack risks
  2. Implement automated protections in order to mitigate this risk going forward

Logo

II. Assessment Results

Identifying Critical Attacks Using Impact Analysis

Of the 14,660 total attacks on your network, 74 (0.5%) of them were considered high impact. That means they targeted machines that were likely vulnerable to these attacks. These events are the most critical to investigate, and Cisco automatically identifies them for you. Cisco identifies high impact events automatically by correlating attacks with target risk, which is determined by passively profiling your network devices and their vulnerabilities in real time. This saves time and money over traditional solutions, which require you to qualify all events manually or import scan data from other systems. If a staff member's time is worth $75 per hour and each attack takes 10 seconds to qualify, then each attack costs $0.21 to manually qualify. The difference in qualification time and cost between Cisco and traditional solutions is substantial.
Pie Chart
Attacks to Qualify / YearCost to QualifyCost to Qualify All Attacks
764,414
estimated total attacks		$0.21$160,527.00
3,859
estimated high impact attacks		$0.21$810.30
Year #1 Cost Savings: $159,716.70
Year #5 Cost Savings: $798,583.50

High Impact Attacks

The following attacks are very important to investigate because they directly target machines that have been identified as potentially vulnerable. The target machine's operating system version, running services, and potential vulnerabilities all match what the threat is designed to attack.
Event TypeDetailsPotentially Vulnerable Hosts
Attempted Administrator Privilege GainOS-WINDOWS DCERPC NCACN-IP-TCP mqqm QMDeleteObject overflow attempt (1:3590:23)3
Attempted Information LeakPROTOCOL-SNMP request udp (1:1417:17)3
Attempted Information LeakPROTOCOL-SNMP trap udp (1:1419:17)3
Attempted Information LeakPROTOCOL-SNMP AgentX/tcp request (1:1421:18)2
Attempted User Privilege GainPROTOCOL-TELNET Microsoft Telnet Server buffer overflow attempt (1:33050:1)1

Hosts at High Risk

0.21, 8.76% of your monitored hosts have been targeted with high impact attacks during the assessment period. They are at high risk of infection. The attacks should be investigated and the machines assessed to ensure proper controls are in place. An additional {2}% of the machines discovered on your network were targeted with some form of attack.
Pie Chart

Automating the Tuning Effort

During the assessment period, the following changes to your network were observed.
Network Change TypeNumber of Changes
A new operating system was found2,548
A new host was added to the network4,725
A device started using a new transport protocol4,996
A device started using a new network protocol5,360
As network changes are made, Cisco solutions automatically adjust policy so new operating systems, hosts, and protocols are protected. Cisco automates the tuning process by monitoring networks in real time and observing changes, and then making appropriate policy changes as a result. For example, if Windows 2000 hosts running IIS appear on the network, Cisco ensures that rules protecting against Windows 2000 and IIS vulnerabilities, and not irrelevant rules that may cause false positives, protect these hosts.

Applications Associated with Attacks

The following applications have been identified as associated with attacks. You should identify applications in this list that have low business relevance and evaluate whether it would be helpful to control them on your network.
Apps Associated with High Impact EventsCount
SNMP client51
DCE/RPC client3
  
  
  
Apps Associated with Lower Impact EventsCount
SNMP client3,522
Web browser297
Chrome126
SSL client93
Internet Explorer80

Top Attackers and Targets

The top attackers and target machines observed in the attack attempts on your network are listed below. For high impact attacks in particular, you should ensure that targets are well protected from potential attackers by patching these machines and blocking potentially malicious traffic.

High Impact Events

AttackersAttacks
20.2.185.2523
220.231.10.2118
10.141.10.3110
10.141.10.197
220.231.10.756
TargetsAttacks
10.0.10.12424
10.141.10.4523
20.2.185.8110
20.2.185.377
10.131.10.1244

Lower Impact Events

AttackersAttacks
220.231.10.124975
172.149.41.1615
186.107.10.124581
220.231.10.21468
172.91.41.1465
TargetsAttacks
10.0.10.124645
192.38.41.133615
10.110.10.12588
10.0.10.21569
192.89.41.133465

IPv6 Attacks and Traffic

IPv6 traffic is a potential avenue for attacks that is often left unprotected by organizations. Network security is often thought of strictly from an IPv4 perspective, yet hosts may communicate internally and even externally to an organization over IPv6, exposing them to attack risks. The following communications were observed over IPv6 during the assessment period.
Hosts Using IPv6 in your Network (Monitored)
0
Attacks Seen over IPv6
9

Logo

III. Business Risk of Attacks

Business Risk of Intrusion Attempts

Different types of attacks were detected on the network, each introducing different business risks. Here are the most common attack types observed along with the risks each introduces.
Attack ClassificationNumber of EventsRisk Associated with the Attack
Potential Corporate Policy Violation16Information Theft: These events indicate usage of apps and protocols in ways that may be prohibited by organizational policy.
A Network Trojan was Detected0Infrastructure Damage, Information Theft: A trojan is a program that appears to be benign to an end user but is in fact malicious. It can be used to steal information or cause damage.
Denial of Service16System Degradation, Denial of Service: Denial of service (DoS) attacks attack the reliability of your network infrastructure, causing service to be denied to legitimate users.
Administrator/User Privilege Gain62Information Theft, Infrastructure Damage: Users on network machines who gain privileges illicitly may be able to steal information and control machines.

Logo

IV. Recommendations

Despite your existing network and endpoint protections, critical attacks are taking place and placing your organization at risk. New countermeasures and security controls are required to mitigate the risk.
Cisco recommends deployment of network-based protections via the threat-focused Cisco Firepower Next Generation Firewall and NGIPS Appliances to complement existing protections. These will provide the following new capabilities and benefits:
New CapabilityBenefit
Real-Time Contextual AwarenessProfile hosts, applications, users, and network infrastructure in real time. Assess potential vulnerabilities and identify network changes.
Automatic Impact AssessmentDetermine the risk of any attack to your business in real time in order to optimize response to it.
File Identification and ControlDetect and optionally block files by file type. Capture files for offline analysis, if desired.
Advanced Malware Protection (AMP)Protect against malware with AMP for networks, which includes integration with AMP ThreatGRID for superior sandboxing, security intelligence and advanced file analysis. Also, AMP for Endpoints provides endpoint protection to offer defense in depth.
URL filteringEnforce acceptable use of the internet.
Application Visibility and ControlIdentify and control over 3000 applications. By leveraging OpenAppID, application detectors can be created for custom application. Furthermore, Snort rules can be written to address specific applications.
Security IntelligenceWith unparalleled visibility into the Internet, Cisco Talos provides dynamic IP and URL black list to protect against malicious websites.
Automatic Policy TuningAutomatically tune IPS protections in response to changes in your network composition.
Association of Users with Security and Compliance EventsAssociate users with activity on the network, including attacks and application usage, through integration with Active Directory servers.
Collective IntelligenceGet rapid detection and insight into emerging threats so that defenses stay effective.
Virtual ProtectionProtect VM-to-VM communications the same as physical networks.
In addition, Cisco offers optional Advanced Malware Protection for networks and hosts, and optional Application Control and URL Filtering, to help better protect against the latest threats. Please contact your Cisco representative or reseller for more information.

Logo

 

About Cisco
It's no secret that today's advanced attackers have the resources, expertise, and persistence to compromise any organization at any time. As attacks become more sophisticated and exploit a growing set of attack vectors, traditional defenses are no longer effective.

It's more imperative than ever to find the right threat-centric security products, services, and solutions for your current environment. These solutions must also easily adapt to meet the evolving needs of your extended network, which now goes beyond the perimeter to include endpoints, mobile devices, virtual machines, data centers, and the cloud.

For over three decades, Cisco has been a leader in network security protection, innovation, and investment. Our expertise and experience helps us increase intelligence and expand threat protection across the entire attack continuum for a level of security you can build your business on.

Cisco delivers intelligent cybersecurity for the real world.
Contact Us
Want to learn more about getting this information on your network? Go to cisco.com/go/security and request a live demo.