The world of cybersecurity never stops changing. Every day bad actors grow bolder and more devious as they try to break your security, steal your data, and offer it back to you for ransom. They’ve b… Read more on Cisco Blogs

​

The world of cybersecurity never stops changing. Every day bad actors grow bolder and more devious as they try to break your security, steal your data, and offer it back to you for ransom. They’ve become very good at what they do, and they only need one small crack in your security to wreak the most havoc. There are network sentries that guard your network, but where one solution is good—two is a much stronger option.

Luckily for you, Cisco Duo and ISE are the perfect pair to protect your network.

Why are Duo and ISE better together?

Think of Cisco Duo’s multi-factor authentication (MFA) as the added layer of security that verifies a user’s identity at the time of login, like a high-tech forcefield that only lets in the good guys through—if they have their secret passcodes. Consider Cisco ISE as the intelligent cohort, analyzing everything from users to devices. Together, they provide deep visibility into the users and devices requesting access to Virtual Private Network (VPN) and Terminal Access Controller Access Control System (TACACS+), ensuring that network access is granted only to those who successfully authenticate using Duo MFA.

This blog will cover how Cisco Duo and ISE have partnered to strengthen organizational security by making the Duo MFA integration process with ISE easier for IT admins. But you can also learn about how Cisco ISE and Duo work together with our latest At-A-Glance.

What to expect from this update?

Released in November 2023, existing customers utilizing Cisco ISE with Duo no longer need to maintain an external VM or server for the Duo Authentication  Proxy, otherwise known as a Duo Auth Proxy. (Duo Auth Proxy is an on-premises software service that performs primary authentication against LDAP directory, or RADIUS and then in turn contacts Duo for secondary authentication.)

This update replaces Auth Proxy with Duo APIs to prevent unauthorized users requesting confidential access to VPN network or their network access device (TACACS+).

Here is how we are enhancing integration experience for IT admins:

Making authentication workflow simpler

Cisco ISE will now handle the primary authentication and directly transmit authentication requests to the Cisco Duo cloud for secondary authentication via APIs- Auth API and Admin API, eliminating the necessity to establish an external Duo Authentication proxy.

Natively integrating and managing MFA

Integration Wizard: Located in the ‘External Identity Sources’ menu and under the ‘MFA’ tab.

Now in the Cisco ISE GUI, IT admins are guided through simple step-by-step wizard to integrate ISE and Duo MFA eliminating extensive training or time required to do the task. This upgraded ISE GUI for IT admins comes without any interference to the end-user experience.
In addition to the setup experience, directly in the ISE GUI, IT admins can also easily manage their Duo connections to re-specify which users of Active Directory groups that they would like to proceed with MFA and create policies for specific user groups.

Create your MFA Policies in the ‘Policy Sets’ Page: Located within the ISE policy tab under the sidebar

Now in the ISE policy set page, administrators can create policies catered specifically for multi-factor authentication rules. Each rule will specify the Duo connection(s) and the conditions which must be met to proceed through the multi-factor authentication process.

Lowering IT burden and costs

A significant portion of Cisco Duo and ISE users are leveraging Duo’s MFA capabilities through the existing Duo Auth Proxy. However, as we delve into the intricacies and expansiveness of these environments, it becomes clear that many customers not only incur additional costs with deploying an appliance to host the Duo Auth Proxy but also allocate manpower to manage them. As a result of leveraging Auth and Admin APIs-

No additional costs are incurred for external servers hosting the Duo Auth Proxy.
IT admins can spend less time establishing, maintaining, and troubleshooting the integration and more time doing other more meaningful things.

Easier authentication workflow with Auth API and Admin API

With elimination of the Duo Auth Proxy, the authentication workflow is simpler and quicker. Here is the 4 steps process for VPN and TACACS+ users:

Admin syncs list of AD groups from ISE to Duo using the Admin API. In the case of existing groups or users, ISE only sends a list of updated ones preventing duplication.
Cisco ISE receives a RADIUS authentication request and performs the primary authentication against configured identity source.
Cisco ISE invokes the Auth API which allows Duo to perform the secondary authentication, or also known as MFA
Cisco ISE upon acknowledgement from MFA acceptance from Duo grant user access to the network.

Thanks to Cisco ISE and Duo, not only can you be the leader of your network’s security solution, but also prepare your organization for authorized access with MFA, bolstering your defenses against digital threats and advancing secure authentication.

To learn more about what Cisco ISE and Duo can do together, review this At-A-Glance.

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Security on social!

Cisco Security Social Channels

InstagramFacebookTwitterLinkedIn

  Cisco Duo and ISE have partnered to strengthen organizational security by making the Duo MFA integration process with ISE easier for IT admins.  Read More Cisco Blogs 

In June of 2022 at the RSA Conference, we announced our vision for the Cisco Security Cloud Platform. We set out to provide an integrated experience to securely connect people and devices everywhere… Read more on Cisco Blogs

​

In June of 2022 at the RSA Conference, we announced our vision for the Cisco Security Cloud Platform. We set out to provide an integrated experience to securely connect people and devices everywhere to applications and data anywhere. We focused on providing an open platform for threat prevention, detection, response, and remediation capabilities at scale. Since the announcement, we’ve been working hard to deliver, and the core of what we’ve accomplished has been rooted in how we can bring simplicity to security, and simplicity for our customers.

Our platform vision was founded with five key design goals in mind: Cloud-native, multicloud, unified, simplified, AI-first, and open and extensible. Here’s how we have executed on our vision since we launched the Cisco Security Cloud:

We delivered Cisco Secure Access, a cloud-delivered security service edge (SSE) solution, grounded in zero trust, that provides our customers exceptional user experience and protected access from any device to anywhere.
We improved zero-trust functionality with an integrated client experience (Secure Client), and industry first partnerships with Apple and Samsung using modern protocols to deliver user friendly, zero trust access to private applications, and improved network traffic visibility.
We delivered our Extended Detection and Response (XDR) solution with first-of-its-kind capabilities for automatically recovering from ransomware attacks that costs businesses billions of dollars annually.
We have made significant investments in advanced technologies and top talent in strategic areas like multicloud defense, artificial intelligence, and identity with the acquisitions of Valtix, ArmorBlox, and Oort.
We simplified how customers can procure tightly integrated solutions from us with our first set of Security Suites (User, Cloud, and Breach Protection) that are powered by AI, built on zero trust principles, and delivered by our Security Cloud platform.
We have taken a major step in making artificial intelligence pervasive in the Security Cloud with the new Cisco AI Assistant for Security, and introduction of our AI Assistant for Firewall Policy. Managing, updating, and deploying policies is one of the most complex and time-consuming tasks that is fraught with human error. Our AI Assistant solves the complexity of setting and maintaining these policies and firewall rules.

Our goal continues to be lifting the complexity tax for customers

While I’m certainly proud of the tremendous progress we have made in the last two years, I know there’s still work to be done. It’s a well-known fact that within security industry, every time there is a new problem, there would be a cluster of security companies that spring up to solve that problem. This whac-a-mole approach can certainly challenge efficiency but, more importantly, it puts the burden on the customer to constantly deploy a new vendor, a new tool, and manage siloed data. I refer to this as customers paying the “complexity tax”.

This has created fatigue among security practitioners and increased interdependencies, blind spots, and unpredictability as evidenced by the eye-opening data from Gartner showing that 75% of organizations today are pursuing security vendor consolidation. Customers should not have to spend time deciphering what products they need in order to solve their specific security challenges. That should be our job and I take this responsibility to heart.

What’s crucial to our success is to listen to the voice of our customers, which is a powerful force in helping us steer in the right direction. We always appreciate candid feedback we get from customers. A couple of recent reminders we got from customers include:

Customers value things that will minimize disruption when migrating to a new solution or platform. They need our help to simplify and make this process easier through features like the Cisco Secure Firewall Migration Tool and the Cisco AI Assistant for Security.
We must be mindful that there are operational and business costs associated, and vendor or software consolidation may not always be as easy as technology migration – for example, factoring in for cost of existing software licenses of decommissioned products.
Hybrid cloud is the de facto operating model for companies today and security is no exception. We must continue to deliver the benefits of cloud operating model and SaaS-like functionality to on-premises security environments.

The Road Ahead

As we mentioned at launch, fulfilling the Security Cloud vision is a multi-year commitment and journey. From the Cisco Security Engineering standpoint, our go-forward strategy and priorities include:

A major priority is for us to optimize the user experience and simplify management across our portfolio for features and products we have shipped. We will continue to focus on delivering innovation from a customer-centric approach and shifting focus from deliverables to outcomes; the business value we can provide and what problems we can solve.
Working closely with our customers to prioritize customer-found defects or security vulnerabilities as we develop new features. In general, security efficacy continues to be one of our top objectives for Cisco Security engineering.
Harnessing the incredible power and potential of generative AI technology to revolutionize threat response and simplify security policy management. Solving these problems is one of the first “killer applications” for AI and we’re only scratching the surface of what we can do from AI-driven innovation.
With Oort’s identity-centric technology, we will enhance user context telemetry and incorporate their capabilities across our portfolio, including our Duo Identity Access Management (IAM) technology and Extended Detection and Response (XDR) portfolios.
Leveraging our cloud-native expertise and decades of on-premises experience to reimagine and redefine how security appliances are deployed and used.

We are making big moves, and our Cisco Security Cloud journey continues. Our vision is realized through innovation, and innovation comes from new technology, new concepts for mature technologies, and new ways to build, buy or use our capabilities. Stay tuned on more news from us as we continue to deliver some of the most exciting innovation areas for Cisco and the security industry at large.

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Security on social!

Cisco Security Social Channels

InstagramFacebookTwitterLinkedIn

  Our vision for the Cisco Security Cloud is rooted in bringing simplicity to security and to our customers. We have been hard at work delivering on our promise.  Read More Cisco Blogs 

Embracing sustainability and reducing our environmental footprint has been a longstanding priority at Cisco. For almost two decades, Cisco has set transparent, publicly declared objectives as… Read more on Cisco Blogs

​

Embracing sustainability and reducing our environmental footprint has been a longstanding priority at Cisco. For almost two decades, Cisco has set transparent, publicly declared objectives as benchmarks, diligently tracking our progress and holding ourselves accountable. Additionally, we’ve developed comprehensive programs to empower customers to achieve their sustainability goals.

We understand that sustainability is a collaborative effort, and success requires leveraging our extensive partner network. Collaboration is essential, and it’s through working with our partners that we foster innovation and gain support across the value chain. To this end, Cisco has developed several sustainability-focused programs that enable partners to offer customers end-to-end solutions designed with sustainability in mind, while also enhancing deal profitability.

Net zero by 2040

Cisco has embarked on an ambitious journey towards sustainability, aiming to achieve net-zero status by the year 2040. This goal has not been mere words but supported by continuous improvement and innovation across our entire business landscape. Our primary focus has been on delivering tangible, data-validated advancements that lead us closer to the realization of all our sustainability goals, ultimately culminating in our net-zero goal.

These efforts have not gone unnoticed. The approval of our net-zero goal by Science Based Targets initiative (SBTi) stands as a testament to the robustness of our plan, the allocation of resources, and the soundness of our strategic approach. This validation confirms our determination to truly meet these targets, helping to forge a path towards a more sustainable future.

As for our partners, whether you are just starting this journey or already investing, there are four key Cisco programs to consider, through which we work together to meet our sustainability objectives.

Earn Your Cisco Environmental Sustainability Specialization

Launched in 2022, the Environmental Sustainability Specialization (ESS) equips partners with Cisco-specific sustainability knowledge. It covers key sustainability terms, the technology behind our Sustainable Solutions, Cisco’s commitment to a circular economy, and supporting programs. Only one person in the company needs to complete this training and exam. For others in the partner organization, we have additional efforts to educate partner sellers on these topics. If you’re not the one going through formal training, we’ll summarize the partner programs you should leverage in this blog.

Leverage the Cisco Takeback & Reuse Program Plus Incentive

Cisco’s Takeback and Reuse program is integral to CEO Chuck Robbins’ commitment to reclaim 100% of customer gear at no cost while providing partners with discount incentives. This program is an important step towards a circular economy, ensuring the responsible end-of-life management of returned equipment, with a remarkable 99.9% material recycling or reuse success rate.

Partners benefit from this initiative through a stackable discount of up to 7% on Refresh deals, applied to new equipment when replacing older gear. To learn more, visit our Takeback and Reuse Program page. Please note that this incentive is exclusively available to partners with ESS certification and program enrollment, so ensure your company is specialized to take advantage of it.

Strategically Position Cisco Refresh

With Takeback products, we seize the opportunity to remanufacture gear based on their life stage, making them available through the Cisco Refresh program. This refurbished gear supports the circular economy, meeting rigorous quality and performance standards, and is readily available with no lead times. It’s cost-effective and environmentally friendly, and has a lower carbon impact than purchasing newly manufactured products. Explore available products on the Cisco Refresh list – the more we take back, the more we can offer!

Utilize Cisco Green Pay

Cisco Green Pay, through Cisco Capital, offers a flexible payment plan for solutions designed with sustainability in mind, covering hardware, software, and services with a set contract term. At term’s end, Cisco reclaims the hardware to support the circular economy, helping support a more sustainable lifecycle. Cisco’s ownership guarantees gear return, providing a consistent refresh cycle and benefits akin to the Takeback program. All of this is offered to the customer, requiring minimal effort from partners. Plus, customers receive a 5% discount when opting for Green Pay.

Let’s Get Started Helping the Planet Together!

Ready to begin? First, become specialized under the ESS and enroll in the Takeback Program. Inform your Cisco team of your interest. We have partner sustainability specialists to assist you in integrating sustainability into your sales approach and boosting your confidence in discussing your customers’ sustainability goals. Prepare for these conversations by researching your customers’ public sustainability goals on their websites.

Although we’ve made progress in reaching our sustainability goals, we recognize that much more work needs to be done to ensure that people and ecosystems can thrive together on a livable planet. There’s no time like the present to get started.

For further information, visit our Environmental Sustainability Products and Solutions webpage or consult your Cisco team for specialist guidance.

  Cisco has developed several programs that enable partners to offer customers end-to-end solutions designed with sustainability in mind.  Read More Cisco Blogs 

We have found ourselves in this wonderful season again. A season of giving, sharing, and remembering—a unique opportunity to slow down and be with those who bring you immense joy and peace.

We have w… Read more on Cisco Blogs

​

We have found ourselves in this wonderful season again. A season of giving, sharing, and remembering—a unique opportunity to slow down and be with those who bring you immense joy and peace.

We have worked hard this year and we’ve all exhibited limitless grit and determination to see that our partners were fueled for success. The efforts of our invaluable distributors have propelled our reach beyond what we could do alone and there lies the true value of partnership.

Looking back at success in Cisco services, software, and renewals

This year I have seen many areas where we have seen growth and success, but the area I’d like to highlight is in Services and Renewals.

<li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="  @CiscoPartners X/Twitter  " aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">Between the Cisco Services and Renewals team at Cisco and our distributors, we have transformed our value specific to CX including, premium services sales, enterprise agreements (EA) acceleration, and aggregating renewals between services and software.
The way distributors are supporting partners through disti-led offers around Cisco Enterprise Agreements (EA) has helped to drive multi-architecture sales and incremental expansion opportunities.
With Customer Success as a key priority, our distributors have been monumental players in helping customers experience and realize business outcomes through working with 2T Partners.
By expanding our A La Cart to EA campaigns in support of new logos and franchises, we are supporting customers in consolidating multiple subscriptions into a single contract. We have seen how this helps relieve the fatigue of migrating multi-vendor infrastructures into your customer’s solution by having it all under a single vendor.
In addition, our Renewals Rates across the entire portfolio continue to reach new heights. Distributors are supporting partners by capturing long-tail business with their commerce automation capabilities.
We’ve seen monumental triple digit year-over-year growth in the Success Tracks and customers realizing the value are becoming customers for life!

Looking ahead

While Services and Renewals successes are just a single area in Cisco’s business, it’s been a privilege to be a part of so many more successes across the other business areas, and their investments and efforts do not go unnoticed.

We have much to be thankful for, and our partnership with our Distributors is just the start. I would be remiss to leave out my gratitude to my family and friends. Have the happiest of holidays and we’ll see you in 2024.

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with #CiscoPartners on social!

Cisco Partners Facebook  

An unprecedented increase in distributed-denial-of-service (DDoS) attacks in recent years has resulted in lost revenue and productivity, increased ransomware costs, and impacted service-level… Read more on Cisco Blogs

​

An unprecedented increase in distributed-denial-of-service (DDoS) attacks in recent years has resulted in lost revenue and productivity, increased ransomware costs, and impacted service-level agreements (SLAs) for network operators.

According to Zayo Group’s annual DDoS Insights Report, attacks are accelerating rapidly, with a 314% increase in overall attacks from the first half of 2022 to the first half of 2023—surging by 1,300% in some industries. The report also notes “there are approximately 23,000 DDoS attacks every day globally” and “DDoS attacks can be costly to any business, but unprotected businesses experience an average cost of $200K per attack.” At the same time, increasing bandwidth requirements and millions of new internet-connected devices has further driven the need to address DDoS attacks more efficiently.

To address the growing problem of DDoS attacks, in 2022 we launched the industry’s first true on-box DDoS solution, Cisco Secure DDoS Edge Protection, with IOS XR 7.7.1 on our Cisco Network Convergence System 540 Series routers (NCS 540 Series). The first phase of the solution addressed threats from mobile endpoints such as IoT devices and mobile phones, helping customers detect and mitigate DDoS attacks on cell-site routers without the need for a centralized DDoS detection agent or a scrubbing center.

We are now extending this DDoS solution beyond mobility to all IP traffic types, starting with IOS XR 7.11.1 on our Cisco Network Convergence System 5500 (NCS 5500) and 5700 (NCS 5700) Series routers. This expanded solution will enable additional use cases for peering edge, broadband, aggregation, and core network deployments.

Challenges with traditional DDoS solutions

A traditional DDoS solution includes a centralized DDoS detection agent (physical or virtual form factor) deployed outside of the router. It also has a DDoS mitigation engine that typically pushes a Border Gateway Protocol (BGP) FlowSpec rule to divert the traffic to a scrubbing center, or to push a Remotely Triggered Black Hole (RTBH) rule.

Figure 1. Traditional DDoS deployment architecture

This type of architecture involves edge routers that face the attack traffic to export the NetFlow data or mirrored flows (after sampling) outside of the routers to a centralized location to detect the attacks. The mitigation involves network operators deploying large-scale scrubbing centers on-premises, or by subscribing to a cloud scrubbing provider. As a result, customers can incur substantial operational costs that grow as the scale and frequency of DDoS attacks increase.

With Cisco Secure DDoS Edge Protection, the external detection agent is no longer needed (see Figure 2). Since IOS XR supports an application hosting infrastructure to run docker containers on the routers, the centralized detection agent is now moved to the router. Because the agent runs as a docker container, the integration eliminates the need to export data outside of the router for attack detection.

Figure 2. New solution to an old problem

Providing the mitigation functionality within the container eliminates the need for dedicated scrubbing centers and reduces the scrubbing capacity needed in a network. The mitigation does not involve pushing a BGP FlowSpec rule; instead, a simple API callback to the edge router efficiently blocks the attack traffic.

The solution further simplifies the network with a single off-box controller to:

Orchestrate the containers across thousands of routers.
Handle the entire lifecycle management of the containers.
Provide a dashboard to operators on traffic stats, active attacks, history of attacks, etc.
Push the mitigation rules automatically or manually by the operators (only if manual option is selected) to the routers through the container.

The controller can run on any general-purpose compute platform and the entire solution can also be deployed in air-gapped networks. The solution is now supported on all variants of the NCS 5500 and NCS 5700 platforms, along with extending the support of non-mobile use cases on NCS 540 Series platforms.

Improving protection as security threats grow

As the threat landscape grows and evolves, the advanced capabilities of Cisco Secure DDoS Edge Protection can enable a range of positive outcomes for our customers, including:

Reduction in TCO—With reduced or no external scrubbing centers required, network operators can save on equipment and operational costs.
Sustainability goals alignment—The reduced need to power and cool scrubbing centers can in turn help reduce energy consumption for operators.
Customer satisfaction—With faster attack detection integrated on the routers, the overall latency with combined detection and mitigation is drastically reduced. Improved response time helps network operators meet tighter SLAs with their customers, even under active attack situations.
Defense in depth—With the edge routers acting as the first line of defense, the overall architecture aligns perfectly with the defense-in-depth philosophy on security architectures. The solution results in additional ROI from the existing routers already deployed in the network.
Investment protection—The solution can coexist with existing DDoS deployments, which provides investment protection for existing deployments. Customers can gradually phase out the traditional solutions over time.
Fewer dependencies—With the API-based mitigation to block the attacks, there is no longer a dependency on BGP FlowSpec for mitigation.

Find out more about Cisco Secure DDoS Edge Protection

  Cisco efficiently protects the network edge against growing DDoS attacks across mobility, broadband, peering, and core use cases with innovative integrated solution.  Read More Cisco Blogs 

December 10 marked the 75th anniversary of the United Nations’ adoption of the Universal Declaration of Human Rights (UDHR), a landmark document that for the first time recognized human rights and f… Read more on Cisco Blogs

​

December 10 marked the 75th anniversary of the United Nations’ adoption of the Universal Declaration of Human Rights (UDHR), a landmark document that for the first time recognized human rights and freedoms are inherent to all individuals, regardless of nationality, ethnicity, religion, or any other status. For Cisco, as we work to securely connect everything to make anything possible, this anniversary is an opportunity to reflect on the intersection between technology and human rights.

Since our inception nearly 40 years ago, Cisco technology has helped customers and partners make infrastructure stronger, financial services more secure, transportation safer, and first responders faster. But even as technology creates unmatched opportunity and potential for society, we recognize the inherent risk of technology being misused. Navigating this balance – securely connecting billions of people while respecting human rights – is core to who we are at Cisco.

We believe it’s incumbent on us to integrate respect for human rights into our operations, policies, and decision-making processes – and importantly – adapt our approach in alignment with the changing technology landscape. Here are just some examples of the way Cisco has evolved to address the considerations we face in the digital age.

Cisco’s Global Human Rights Policy was first adopted in 2012 and is updated on an annual basis. The policy publicly states Cisco’s commitment to respect all internationally recognized human rights articulated in the Universal Declaration of Human Rights (UDHR), the International Covenant on Civil and Political Rights (ICCPR), the International Covenant on Economic, Social, and Cultural Rights (ICESCR), and the eight core International Labour Organization (ILO) conventions.

In 2018, we shared our Human Rights Position Statements documenting Cisco’s point of view on encryption, data localization and sovereignty, surveillance by governments, internet of things, big data analytics, and artificial intelligence. We also built our Business & Human Rights team, responsible for setting Cisco’s human rights strategy and embedding human rights due diligence to address potential impacts to human rights at all stages of our value chain.

In 2020, we created our Human Rights Advisory Committee, a cross-functional group of senior leaders across Cisco’s business that advises the BHR team on issues related to Cisco’s support of and respect for human rights. The Human Rights Advisory Committee meets on a quarterly basis to discuss emerging human rights risks and opportunities and Cisco’s work to address them.

We also engage with suppliers globally to drive conformance to our human rights policies. As a founding member of the Responsible Business Alliance (RBA), Cisco adopted the RBA Code of Conduct as its Supplier Code of Conduct. This Code sets standards for labor, health and safety, environment, ethics, and management systems. This past year, our audits covered the working conditions of more than 446,000 workers, and our programs helped give workers a voice on health and safety, bonded labor, and responsible mining.

In 2023, we introduced a new Environmental, Social, and Public Policy Committee of our Board of Directors. Part of the Committee’s duty is to strategize and govern our approach to human rights, reflecting the increasing importance of and attention to these issues at the highest levels of our company.

We believe transparency around our commitments to respecting human rights is arguably just as important as the policies, frameworks, and guidelines we’ve put in place. Being transparent not only gives our customers and workforce the confidence to trust us, but it also helps us to continually learn and improve.

So, as we recognize the anniversary of UNDHR, I’m pleased to share both our FY2023 Cisco Purpose Report and Cisco ESG Reporting Hub – highlighting Cisco’s ongoing approach to respecting human rights as we work to power a more inclusive future for all.

Cisco 2023 Purpose Report: The Power of Purpose

ESG Reporting Hub

  For Cisco, as we work to securely connect everything to make anything possible, the 75th anniversary of the UN Declaration of Human Rights is an opportunity to reflect on the intersection between technology and human rights.  Read More Cisco Blogs