Across Europe, people are rethinking what they rely on the internet for: balancing classic demands for speed and reliability, with the growing needs of rising eco-consciousness, secure cloud… Read more on Cisco Blogs

​

Across Europe, people are rethinking what they rely on the internet for: balancing classic demands for speed and reliability, with the growing needs of rising eco-consciousness, secure cloud infrastructure, and the increase of the Internet of Things (IoT) connecting our devices, from smart cars to home appliances. This trend perfectly aligns with the European Commission’s Digital Decade 2030, where secure and sustainable digital infrastructure is one of the top 4 priorities.

The 2023 Cisco Broadband Survey finds that as over 68% of consumers in Europe expect to connect cars, appliances, energy and water to the internet, broadband networks must scale to support new connectivity needs. Broadband is also seen by 77% of survey participants in Europe as critical national infrastructure, escalating the need for to accelerate the move towards a more sustainable and secure internet for all.

Need for more spectrum confirmed by connectivity increase as consumers expand digital lives

As the number of connected devices grows from billions to trillions, so does the demand for bandwidth and processing power to analyse all the data produced. According to the Cisco Broadband Survey, there’s no sign of this slowing down. Consumers are embracing the shift toward an ever more digital life. A majority of Europeans surveyed already have, or expect to have, their cars (64%), home appliances (68%), energy (74%) and water (61%) connected.

This is yet another signal for policymakers to ensure the need for more bandwidth is met by allocating more spectrum to mobile and wireless networks and removing existing barriers to the uptake of digital technologies.

Whilst half of consumers surveyed indicated feeling positive about new ways to connect their homes and lives to the internet, a majority (67%) saying that the cost-of-living crisis has changed the way they spend money on digital services: 18% have reported moving to a lower cost broadband package and 15% have cancelled streaming services.

Consumers want sustainable broadband

Whilst speed remains the main reason for those planning to upgrade their broadband, the carbon-cost of connectivity is a concern for 64% European surveyed, with young people aged 18-24 the most worried. In addition, 72% said they would be willing to pay more for sustainable broadband, with around a fifth prepared to pay a price premium of more than 20%.

This supports a wider market trend, shown in a 2019 survey by Nielsen and a 2022 survey by Globescan, revealing widespread consumer awareness around the environmental impact of the products they use and a demand for companies to step up and mitigate negative impacts on the planet.

The carbon footprint of the information and communications technology sector is estimated to account for around 2.1 – 3.9% of global greenhouse gas emissions, and more than half of that comes from networks and data centers. Transition to next-generation networks and improved network efficiency with further adoption of ICT tools, while accelerating the move to renewable energy sources, are all essential responses for greening telecoms networks[1].

The latest Wi-Fi technologies excel in low-power, cognitive radio techniques including spectrum sensing, spectrum sharing, and adaptive transmission and explain why national regulators have recommended consumers to switch to using Wi-Fi when at home during periods of peak energy consumption[2].

Securing more bandwidth for sustainable reliable connectivity

Cisco is on a mission to transform the Internet for the Future, focusing on designing products with energy efficiency and security in mind, including circular economy principles in product development and business operations, and taking a smart and sustainable approach to lifecycle management.

Whilst speed, cost and reliability remain critical, building sustainable secure networks that can fuel global connectivity and automation has become a top priority. The European Union has been working on the development of new policies to support industry investment and as we approach World Radiocommunication Conference 2023 (WRC-23), we trust governments will seize the opportunity to secure more bandwidth for sustainable reliable connectivity.

About the Cisco Broadband Survey

The Cisco Broadband Survey is based on a survey of workers across 12 countries in EMEA. The extracted European data in this blog steams from 16,625 workers in the UK, Germany, Italy, France, Switzerland, Poland, Spain, Sweden, and the Netherlands. It was completed during January and February 2023. The sample includes respondents based in every region of each country, who either work full-time remotely; full-time in an office; hybrid, between home and the office; or on the frontline. The poll was conducted by independent research consultancy Censuswide, who abide by and employ members of the Market Research Society – which is based on the ESOMAR principles.

[1] ETNO, “The State of Digital Communications 2023” 2023

[2] Wi-Fi Alliance, “Wi-Fi: sustainable connectivity” 2023

  As the number of connected devices continues to grow, so does the demand for bandwidth, driving the increasing need to allocate more spectrum to mobile and wireless networks.    Read More Cisco Blogs 

If there’s one thing that Raj Bhat, SDA for Premier Accounts in CX (Customer Experience) knows how to do, it’s how to create a bucket list, one that has taken him to Peru, Tanzania and beyond.

But he … Read more on Cisco Blogs

​

If there’s one thing that Raj Bhat, SDA for Premier Accounts in CX (Customer Experience) knows how to do, it’s how to create a bucket list, one that has taken him to Peru, Tanzania and beyond.

But he didn’t always have one. His list came out of the COVID-19 pandemic when he started walking daily. His walks became hikes and, in the process, Raj says he, “got to know people from all walks of life, their journeys and their adventures, and their stories and life experiences made me want to go to certain places in the world.”

This was the beginning of his bucket list.

When someone in Denver recommended Sky Pond in Rocky Mountain National Park in the winter, he decided to go even though he never skied or hiked in that terrain.

When he met a woman from Peru who was born and raised in a small village along the Inca Trail, he decided to experience the remoteness of the Inca Trail trek to Machu Picchu.

Then while on the trail, he met someone from Tanzania.

“Before we said goodbyes on the trail, he surprised me by singing one of these old Bollywood songs,” said Raj. “He apparently watched the movie a dozen times on a black-and-white television back in Africa!” This led to Raj’s decision to add Mount Kilimanjaro to his bucket list.

Mount Kilimanjaro in northern Tanzania, is a dormant volcano that is also known as Africa’s highest mountain. At 19,340 feet above sea level, it is the highest free-standing mountain above sea level in the world.

Witnessing how dedicated, hardworking, and positive all the sherpas (porters) were despite having to carry enough supplies for the hikers’ seven days on the trail, Raj says, “ They’re definitely not in it just for the money. They respect Mother Nature and worship the mountains. They are very passionate, incredible young human beings dedicated to ensuring every hiker makes it to their goalpost.”

Mount Kilimanjaro has six or seven tracks or routes, each with a different success rate. Raj’s track, the Machame route, has an 80-85 percent success rate, and altitude sickness is the main contributor to summit failures. One person had to abort his attempt to summit in his group of five hikers and 22 sherpas.

There are two more items on his bucket list: Mount Everest Base Camp and Mount Rainier in Washington State. “Once you set out to do something, you need to do it,” says Raj.

Before his bucket list journey and before the COVID-19 pandemic, Raj’s regimen was to spend 30 to 40 minutes each morning doing breathing exercises and yoga.

“I am fortunate to have an opportunity to work for Cisco, an employer that promotes work-life balance,” says Raj. “Some hikes required me to take extended leave of absence which my manager, Anthony Davis, totally supported.”

He credits his ability to better handle conflict, different viewpoints, and “aggressive schedules” to the lessons he learned on the trail from remote parts of the world.

Whether you are early in your career, a seasoned professional, or somewhere in between, Cisco has a wide range of technical and non-technical career opportunities for you to explore. Recognized by Great Place to Work as the Number One Company to Work for three years in a row in the United States and over a dozen countries worldwide. We are known for our people, our conscious culture, and our commitment to powering an inclusive future. Learn more now.

  If there’s one thing that Raj Bhat, SDA for Premier Accounts in CX (Customer Experience) knows how to do, it’s how to create a bucket list, one that has taken him to Peru, Tanzania and beyond.  Read More Cisco Blogs 

So, what happens when the Great Resignation turns into the great resurrection back to the company you first loved? Well, you get me, Janene Baker, a Talent Acquisition leader who, almost two years… Read more on Cisco Blogs

​

So, what happens when the Great Resignation turns into the great resurrection back to the company you first loved? Well, you get me, Janene Baker, a Talent Acquisition leader who, almost two years ago, was a part of the trend of employees who left for newer and what could’ve been perceived as better opportunities at other companies.

Cisco and I have a lot of history. When I talk about my career journey, I tell everyone I built and grew my career at Cisco. I worked my way up from an individual contributor to leading leaders during my 11-year tenure here. When I left, I thought I was at a point where it made sense to try something new, and sometimes that new thing seems big, shiny, and very appealing.

So, I took the leap, and I left Cisco.

On the surface, all was great. I was learning new skills and meeting new people — so my move was not for nothing, right? However, something was missing. I realized when you make a big life change, you learn more about yourself and what you truly value. I discovered — for me — it’s not about a role in a company with instant name recognition. I began to miss working at a place that aligned with who I am at my core. I longed to work for a place like Cisco that values and sees its employees and their well-being so much that they created “A Day for Me” each quarter, allowing them to prioritize themselves. I wanted to work for a company that takes a stand on social justice and backs it up with action through programs like OneTen, an initiative committed to unlocking potential, hiring, and advancing Black employees. I missed having the flexibility to live out the coined phrase “One Company, Many Careers” and be supported by leaders like our Chief People Officer, Kelly Jones, who embodies this exact expression and supported my development. At my core, I missed the Conscious Culture embedded in who Cisco is as a company.

When the stars aligned and I had the opportunity to return to Cisco, there was never a second guess or a second thought. It was an emphatic YES!

I wondered what people would think about me coming back just shy of being gone for two years. Well, let me tell you — it was like a homecoming party, and that’s when I knew I was right back where I needed to be. It’s been surreal coming back to the place that took a chance on me very early in my career and propelled me into my current leadership journey. It’s been humbling being back at the place that supported me personally through time off for my wedding all those years ago. Don’t even get me started on the benefits I was afforded when I became a new mom, not once, but three times here as I continued to grow my career. That’s a blog post all its own! It’s been fun seeing the work never stop, only evolve, and I can jump back in to continue building that Cisco bridge I know and love so much.

To my fellow Cisconians, before you assume the grass is greener on the other side, I encourage you to think about what motivates you; the true values you want to see in a company. Have that bold conversation with your leader about your development, growth, and needs because I can tell you — this Cisco culture is one that’s hard to beat (Hence the reason we’ve won #1 Best Workplace in the U.S. three years in a row!).

If you’re not at Cisco yet and wondering what all the hype is about, check out our Cisco careers here!

Subscribe to the We Are Cisco Blog.

  Talent Acquisition Manager Janene B. left Cisco in pursuit of something new but returned, realizing she needed a career and a company aligning with who she is at her core.  Read More Cisco Blogs 

When you think of organizations investing to deliver the best application experience, you usually think of private sector businesses. But Brad Welsh from the State of Indiana Office of Technology… Read more on Cisco Blogs

​

When you think of organizations investing to deliver the best application experience, you usually think of private sector businesses. But Brad Welsh from the State of Indiana Office of Technology (IOT) has made it his mission to deliver the best application experience to 6.8 million constituents statewide.

Providing the applications IT backbone for the entire state

Brad, along with his team at the IOT, has helped 90 state agencies streamline operations, quickly fix their IT issues. and work better together – which means they all deliver a better experience to their constituents. And it’s all backed by Cisco Full-Stack Observability (FSO) solutions.

Brad says, “As a technology provider for the state, we have certain goals we need to achieve. We are shifting from a mindset of providing uptime on servers to a mindset of around-the-clock uptime across our infrastructure and business critical applications. It’s not just 8-to-5 anymore. Applications must be available all the time and we must have visibility into our network to make that happen.”

IOT supports a range of state partner agencies, from the Department of Motor Vehicles to the Commissioner of Higher Education. So, when service disruptions occur at any constituent-facing agency, Brad and his team need to address the issue quickly.

From fire drills and big, uncomfortable meetings to rapid resolution

“Before we implemented Cisco Full-Stack Observability,” Brad says, “we didn’t have the insight or visibility into the applications and across the network, that we needed. When an issue would arise, it would become a fire drill that would include many people across network, database, and many other IOT teams.”

And that meant if co-workers were called in to work on ruling out if an issue was caused by a network, by a third party vendor – a security issue – or something else – it was an interruption to their daily workflow and productivity But now with Cisco FSO, troubleshooting that used to take days now can take minutes.

Brad Welsh teaching FSO to colleagues

There are no more fire drill meetings where everyone has to rapidly troubleshoot the root cause of issues in their respective area. In fact, Brad has empowered other IT teams he works with to take advantage of Cisco FSO technologies, and even held an event to educate other state agencies on how to modernize their applications and achieve full-stack observability.

Working smoothly through crunch time and dealing with the unexpected

The State of Indiana has a lot of transaction-based services. They have a lot of “Black Fridays” as Brad calls them – or days where their application infrastructure is tested by an onslaught of usage. For instance, a large citizen agency has end-of-month renewals that all need to be processed at the same time. In the past, it would be a disaster if this site went down at the wrong time – but recently Brad was able to determine if an issue was with the application infrastructure or the ISP – in minutes.

In addition to anticipating peak periods, Cisco FSO solutions have helped Brad deal with the unexpected.

During the pandemic, Brad was able to help the Workforce Development Department process a higher-than-average amount of unemployment claims. Ongoing application issues that had been a mystery to solve – like a certification printout for teachers’ licenses—became easier to troubleshoot and got fixed. And Brad’s office has helped the professional licensing agency he supports work better – so they can better serve their constituents at crunch time. And with Cisco Secure Application, security issues that used to bring down the whole application no longer do so because Brad can just temporarily shut down the part that needs to be fixed.

Learn more about Brad’s successes with Cisco Full-Stack Observability

  Delivering the best application experience for over 90 agencies and 6.8 million constituents can be a hard job. Cisco Full-Stack Observability solutions help the State of Indiana's Office of Technology resolve issues faster and plan for the unexpected.  Read More Cisco Blogs 

When I stepped into the world of technology, I never imagined I would see this day so early in my career. Since I’m a fairly recent addition to the Cisco family, the opportunity to attend Cisco Live i… Read more on Cisco Blogs

​

When I stepped into the world of technology, I never imagined I would see this day so early in my career. Since I’m a fairly recent addition to the Cisco family, the opportunity to attend Cisco Live in Las Vegas was already momentous. Little did I know this experience would surpass all expectations. I found myself embracing a role I never anticipated: Speaker!

I don’t know if you can imagine my initial shockwaves when I received an unexpected invitation to assist a seasoned expert with a 4-hour lab session. I wasn’t just excited. I was humbled to know someone recognized my potential and trusted me with such responsibility.

I am going to take you behind the scenes of Cisco Live for a glimpse into what speakers experience. You’ll view the other side of the speaker curtain, see what it’s like to prepare, and even find some humor in my first-time story.

“The audience is not against you; they’re rooting for you,” he said.

“They’re there to learn something.”

First impressions of Cisco Live Las Vegas

Akhila Pamukuntla takes the Cisco. U Theater stage to present.

When I arrived in the vibrant city of Las Vegas for Cisco Live, I was struck by the grandeur and scale of Cisco Live. The excitement in the air was visible as attendees and exhibitors from all corners of the globe flooded the Mandalay Bay Convention Center.

Standing in the middle of the busy convention halls, I saw teams diligently setting up booths and displays. I felt nervous yet exhilarated.

My first session on Jupyter Notebook was also the opener for the Cisco U. Theater. Before taking the stage, I was apprehensive at the thought of addressing such a large audience, but I felt confident. I drew strength in knowing I was well-prepared and passionate about the topic. Plus, I had supportive mentors around me.

With a deep breath, I took the stage. I was ready—ready to deliver the session that would set the tone for an incredible week of learning.

In November 2022, Hank Preston, Principal Engineer, asked me to assist him with his four-hour, instructor-led lab session. I was pretty excited because I didn’t think many Cisconians got to go to Cisco Live this quickly in their career. But I was also nervous because it was Hank, a celebrity in the networking field. I didn’t know how I would be able to present. But of course, I said yes, and we started putting the lab together.

Cisco U. had recently been introduced to the world. So the Cisco U. Theater was set up at the Learning & Certifications (L&C) booth, and they asked speakers from L&C to present on any topic they wanted to in the Cisco U. Theater. I chose Jupyter Notebook (a sort of command line interface [CLI] for Python) because I had used it a lot in college, and it was different than what everyone else would present.

How I became a Cisco Live speaker

Akhila Pamukuntla and Hank Preston practice their Cisco Live sessions.

It all began in November 2022 when Hank Preston, Principal Engineer, asked me to assist him with his 4-hour, instructor-led lab session. I was pretty excited. After all, I didn’t think the chance to attend Cisco Live was all that common for people like me—those so early in their Cisco career, that is.

But I was also nervous. This was Hank Preston. Hank is pretty much a celebrity in the networking field. At the thought of pairing up with him, I wondered how I would be able to present. But of course, I said yes. And we started putting the lab—our lab— together.

Just when I thought Hank’s lab session was my only focus for Cisco Live Las Vegas, I was invited to speak at the Cisco U. Theater!

About the Cisco U. Theater

We recently introduced the world to Cisco U., a new digital learning experience that offers modular, bite-sized learning in your moment of need. The Cisco U. Theater is an iteration of this concept, offering short lightning talks on specific tech topics. One of the best parts of the theater is Cisco Live attendees can drop in at a moment’s notice as they visit the Learning and Certifications Booth in the World of Solutions.

So when the team offered me the chance to present on my choice of topic, I chose Jupyter Notebook. Jupyter Notebook is a sort of command line interface (CLI) for Python. I had used it a lot in college, and it was different from what everyone else would present in the Cisco U. Theater.

Akhila Pamukuntla and Raymond Viscaina present, “What Happens When I Click Start Lab?”

So here I was thinking I was there to help with a lab session, but then I was asked to speak at the Cisco U. Theater! Not long after, my manager, Raymond Viscaina, Engineering Leader, asked me to assist him with his theater session, What Happens When I Click Start Lab. I couldn’t believe it. Now I had to prep for two theater sessions and a lab session. What a bonus!

Getting through prep sessions

Akhila Pamukuntla and Hank Preston prepare before Akhila’s Cisco U. Theater Session.

Surreal. It’s the only word I can think of to describe the prep for the lab session with Hank. However, as for my solo session in the theater, I was too focused on my presentation to think about almost anything else.

I was lucky enough to have Engineering Leader Joe Rinehart assigned as my mentor a few weeks before the event. As I practiced my solo session with Joe, some of the tips he gave included: “Practice often, practice in front of a mirror, and space matters.”

He said I should find a space like an empty room or theater, which is a lot different than practicing in your bedroom. So, I went to my local library and asked for an empty room. With me, pre-event blueprints of the theater and a map of the booth layout. I even had a photo of Cisco Live Amsterdam’s crowd at the Cisco U. Theater to prepare me for the volume of attendees in Las Vegas, despite hearing Las Vegas would be much greater in scale.

About two weeks before I left, I was using every tool in my arsenal to visualize the event, mentally preparing myself. And that’s when I realized my session was the opening session—the very first Cisco U. Theater session of the week.

Until that moment, I didn’t even know what time or day I was presenting; I just kept practicing. But when I saw the date was Monday at 10 a.m. Pacific Time, I realized no other speaker was scheduled before me. Well, you can imagine my reaction.

I was terrified.

Presenting on the big day

Akhila Pamukuntla presents in front of a full theater.

Not only was I the first speaker to present in the theater, but the Learning and Certifications Booth was the first sight for attendees upon entering the World of Solutions. The WoS also opened at the exact same time as my session, and attendees were ready and waiting. I became a bundle of nerves when I saw the onslaught of people.

Before we started, we had to test my microphone. First, they put it on my T-shirt. That didn’t sound right. So, then they gave me a headset. That didn’t work out, either. My head is kind of small, so we had to work a little harder to get it to fit.

“Speak louder,” they said. They kept telling me, repeatedly, to speak louder during the mic test. I felt like I was yelling. I soon realized I had to speak louder because more people would be entering the World of Solutions during the presentation. No pressure, I thought.

When I finally started speaking to the crowd, I saw Joe, my pre-Cisco-Live prep mentor. I immediately recalled something important he said during those sessions.

“The audience is not against you; they’re rooting for you,” he said. “They’re there to learn something.”

My session was streaming live on the Cisco Training and Certification LinkedIn page and on the Cisco U. by Learning and Certifications YouTube Channel. My family was watching. No pressure.

When I first started my presentation, I could feel my voice shaking. Maybe three to five minutes into it, though, I realized it wasn’t as bad as I thought it would be. I tried to make eye contact with as many people as I could. I was still a bit scared. What if they didn’t react?

But with every head nod, I felt my confidence grow. I was making sense to them. And that kept me going.

During my talk, I asked the audience questions. “How many of you are familiar with Jupyter and have used it before?” My goal was to get them engaged. That was one of Hank’s tips. You need to know if they’re with you. (And yes, a few people had heard of Jupyter and had even used it before.)

An engaged crowd at the Cisco U. Theater.

Next up, a demo. I was actually showing them Jupyter Notebook live, in real time. The lines of code were already written, with me executing and explaining each step as I went through it. I noticed people typing along, taking notes as I continued.

Finally, I had made it through. And what a relief! After that, my other presentations fell into place; the Cisco U. Theater session with my manager, plus the 4-hour lab session with Hank. Ironically, although I was in a smaller room, I was more nervous there. And the one part I had practiced the most was the part I slightly stumbled over! I got through that as well, though. I must say, looking back at my experience, I learned a lot about presenting from being a speaker at Cisco Live. But the thing that I will always remember is how I got there: my mentors.

Mentors make all the difference

When I reflect on the whole Cisco Live experience, I realize I went through quite a transformation. Initially, the fear of presenting in front of a crowd and being surrounded by professionals overwhelmed me. However, looking back now, I realize it was the incredible individuals I encountered and the meaningful conversations we shared that made my experience truly unforgettable.

It wasn’t just the colleagues and peers around me. It was also those whom I presented to. It was every unexpected message I received on LinkedIn, asking to learn more about the topic of my session. It was when I was singled out and stopped by attendees on the aisles of Cisco Live to express their appreciation for my theater session.

The support and encouragement I received after my theater session reassured me. I had made a positive impact. But that’s not all. Speaking at Cisco Live sparked newfound confidence within me. It has taught me that it’s the people and the connections we form that ultimately make any experience meaningful and memorable. And I can’t wait to do it again.

Thanks for reading! I invite you to watch my first session as a Cisco Live Speaker below.

Watch “Jupyter Notebooks,” by Akhila Pumukuntla, presented in the Cisco U. Theater at Cisco Live 2023 Las Vegas.

Join the Cisco Learning Network today for free.

Follow Cisco Learning & Certifications

Twitter  Facebook 

In my role, I have the incredible opportunity to meet trailblazing IT leaders just like you every day. Each has told me that in order to continue to innovate and help their organization thrive, they must align technology investments to business priorities and achieve remarkable, tangible results. But they can’t do it alone! IT leaders have also shared with me the need for strategic advisors with deep technical expertise and understanding of their business to inform their decisions and accelerate technology adoption.

In response to what we hear from customers like you, we are continually evolving our Customer Experience (CX) services portfolio. Today, I am excited to announce that we are launching a brand-new outcomes-driven offering – Cisco Lifecycle Services (LCS). These services shift your focus from IT challenges to business outcomes. LCS lets you start with your desired outcomes, then helps you identify and execute IT initiatives aligned to those outcomes, which allows you to demonstrate measurable results. You also get Cisco experts with advanced tools, automation, and AI/ML insights to accelerate time-to-outcomes.

“Companies require IT services that provide the scalability and adaptability to align to changing business and technology needs. Organizations of all sizes and across multiple industries need the ability to orient technology initiatives to discreet business outcomes with measurable KPIs. I believe that Cisco’s new Lifecycle Services is novel in its delivery mechanism to this end and leans into its depth of knowledge and capabilities. ”
– Will Townsend, VP & Principal Analyst, Moor Insights and Strategy

Focus on Business Outcomes

We understand your business, industry, and technologies. Distilled from over 30 years of experience helping thousands of organizations worldwide, Cisco Lifecycle Services empowers YOU to:

1. Drive business outcomes with continuous engagement.

Let’s say your priority is to reduce risk, enhance customer experience, and increase operational excellence – these are your desired business outcomes (and we have 11 in our catalog). With your desired outcomes as the compass, Cisco experts help you identify and develop IT optimization and transformation strategies. We then work with your team and partners to prioritize, implement, and drive the adoption of these strategies so that you achieve tangible business outcomes.

2. De-risk and accelerate time-to-outcomes.

With this service, you make informed decisions. Our experts have AI/ML insights, tools, and automation to translate telemetry data into actions. You also accelerate time-to-outcomes by removing execution roadblocks. You close skills-gap and talent shortages with Cisco’s team of deep technical experts to fast-track planning, designing, implementing, and automating your IT environment.

3. Demonstrate measurable success.

At the beginning of the engagement, together with you, we identify outcomes aligned KPIs (Key Performance Indicators). Next, we use our automated KPI measurement tools and telemetry to create a baseline. Throughout the engagement, Cisco experts track, measure, translate, and report the impact aligned with your desired outcomes.

4. Exercise flexible choices that align with the way you work.

At Cisco, we’re committed to your success. We understand that your organization is unique and has ways of working. With this service, you get the flexibility to engage Cisco experts and our partners in the best way for you.

Provide deep and meaningful advice with actionable recommendations.
Work with you as part of your team.
Do it for you with end-to-end delivery ownership.

And, should your business priorities change during the engagement, we realign the experts and IT initiatives to your new direction.

Simple, consistent, and integrated engagement model

When you choose Cisco and our partners, you expect a simple, consistent, and high-quality experience. Rooted in learnings from our delivery experts and customer feedback, we expect to exceed your expectations with the new engagement model.

Baseline: We begin by understanding your business objectives and tailoring KPIs to align with your goals. Then, we establish a baseline using telemetry and other methods.
Analyze: Using telemetry and high-touch discovery, our experts analyze your IT environment and identify strategies to achieve your desired business outcomes.
Recommend: We make recommendations, help you prioritize IT initiatives, and build an execution plan.
Execute: We and our partners work with you to remove roadblocks to ensure the execution of prioritized initiatives – aligned with the way you work.
Measure: To demonstrate progress consistently, we track, measure, translate, and report KPIs at regular intervals using Automated Dashboard and Quarterly Business Reviews (QBR).

When you start with a business outcome, you know multiple IT initiatives will get you there. It gets complex. With Integrated Service Delivery, our experts handle the complexity and coordinate with your teams, partners, and the Cisco team to keep everyone in sync and focused on the ultimate objective. All you experience is simplicity, consistency, and measurable business outcomes.

Previews surpassed initial expectations.

We organized field trials with select customers to validate our new approach. The initial response surpassed our highest expectations. A broad range of organizations representing service providers, manufacturing, healthcare, retail, finance, education, and the public sector signed up for the preview, and the feedback tells us our impact with outcomes exceeds the value of previous services provided. Now we’re ready to bring this tremendous value to you.

Amplify with Cisco Partners

Cisco Lifecycle Services complements the capabilities and scale of our extensive partner ecosystem. Suppose you are already working with one of our partners. In that case, Cisco Lifecycle Services allows you and the partner to deepen the strategic relationship and achieve greater alignment on your business priorities and the business outcomes you desire. As Cisco and Cisco Partner experts analyze your environment and make recommendations to transform and optimize your IT environment, our flexible model allows you to engage your preferred partners to deliver a variety of implementation and managed services.

Let’s shift the focus from challenges to business outcomes.

To learn how your IT organization can accelerate their ability to deliver new and better business outcomes, visit Cisco Lifecycle Services here. You can also contact your Cisco account representative or authorized partner directly to set up an introductory meeting.

​

In my role, I have the incredible opportunity to meet trailblazing IT leaders just like you every day. Each has told me that in order to continue to innovate and help their organization thrive, they must align technology investments to business priorities and achieve remarkable, tangible results. But they can’t do it alone! IT leaders have also shared with me the need for strategic advisors with deep technical expertise and understanding of their business to inform their decisions and accelerate technology adoption.

In response to what we hear from customers like you, we are continually evolving our Customer Experience (CX) services portfolio. Today, I am excited to announce that we are launching a brand-new outcomes-driven offering – Cisco Lifecycle Services (LCS). These services shift your focus from IT challenges to business outcomes. LCS lets you start with your desired outcomes, then helps you identify and execute IT initiatives aligned to those outcomes, which allows you to demonstrate measurable results. You also get Cisco experts with advanced tools, automation, and AI/ML insights to accelerate time-to-outcomes.

“Companies require IT services that provide the scalability and adaptability to align to changing business and technology needs. Organizations of all sizes and across multiple industries need the ability to orient technology initiatives to discreet business outcomes with measurable KPIs. I believe that Cisco’s new Lifecycle Services is novel in its delivery mechanism to this end and leans into its depth of knowledge and capabilities. ”
– Will Townsend, VP & Principal Analyst, Moor Insights and Strategy

Focus on Business Outcomes

We understand your business, industry, and technologies. Distilled from over 30 years of experience helping thousands of organizations worldwide, Cisco Lifecycle Services empowers YOU to:

1. Drive business outcomes with continuous engagement.

Let’s say your priority is to reduce risk, enhance customer experience, and increase operational excellence – these are your desired business outcomes (and we have 11 in our catalog). With your desired outcomes as the compass, Cisco experts help you identify and develop IT optimization and transformation strategies. We then work with your team and partners to prioritize, implement, and drive the adoption of these strategies so that you achieve tangible business outcomes.

2. De-risk and accelerate time-to-outcomes.

With this service, you make informed decisions. Our experts have AI/ML insights, tools, and automation to translate telemetry data into actions. You also accelerate time-to-outcomes by removing execution roadblocks. You close skills-gap and talent shortages with Cisco’s team of deep technical experts to fast-track planning, designing, implementing, and automating your IT environment.

3. Demonstrate measurable success.

At the beginning of the engagement, together with you, we identify outcomes aligned KPIs (Key Performance Indicators). Next, we use our automated KPI measurement tools and telemetry to create a baseline. Throughout the engagement, Cisco experts track, measure, translate, and report the impact aligned with your desired outcomes.

4. Exercise flexible choices that align with the way you work.

At Cisco, we’re committed to your success. We understand that your organization is unique and has ways of working. With this service, you get the flexibility to engage Cisco experts and our partners in the best way for you.

Provide deep and meaningful advice with actionable recommendations.
Work with you as part of your team.
Do it for you with end-to-end delivery ownership.

And, should your business priorities change during the engagement, we realign the experts and IT initiatives to your new direction.

Simple, consistent, and integrated engagement model

When you choose Cisco and our partners, you expect a simple, consistent, and high-quality experience. Rooted in learnings from our delivery experts and customer feedback, we expect to exceed your expectations with the new engagement model.

Baseline: We begin by understanding your business objectives and tailoring KPIs to align with your goals. Then, we establish a baseline using telemetry and other methods.
Analyze: Using telemetry and high-touch discovery, our experts analyze your IT environment and identify strategies to achieve your desired business outcomes.
Recommend: We make recommendations, help you prioritize IT initiatives, and build an execution plan.
Execute: We and our partners work with you to remove roadblocks to ensure the execution of prioritized initiatives – aligned with the way you work.
Measure: To demonstrate progress consistently, we track, measure, translate, and report KPIs at regular intervals using Automated Dashboard and Quarterly Business Reviews (QBR).

When you start with a business outcome, you know multiple IT initiatives will get you there. It gets complex. With Integrated Service Delivery, our experts handle the complexity and coordinate with your teams, partners, and the Cisco team to keep everyone in sync and focused on the ultimate objective. All you experience is simplicity, consistency, and measurable business outcomes.

Previews surpassed initial expectations.

We organized field trials with select customers to validate our new approach. The initial response surpassed our highest expectations. A broad range of organizations representing service providers, manufacturing, healthcare, retail, finance, education, and the public sector signed up for the preview, and the feedback tells us our impact with outcomes exceeds the value of previous services provided. Now we’re ready to bring this tremendous value to you.

Amplify with Cisco Partners

Cisco Lifecycle Services complements the capabilities and scale of our extensive partner ecosystem. Suppose you are already working with one of our partners. In that case, Cisco Lifecycle Services allows you and the partner to deepen the strategic relationship and achieve greater alignment on your business priorities and the business outcomes you desire. As Cisco and Cisco Partner experts analyze your environment and make recommendations to transform and optimize your IT environment, our flexible model allows you to engage your preferred partners to deliver a variety of implementation and managed services.

Let’s shift the focus from challenges to business outcomes.

To learn how your IT organization can accelerate their ability to deliver new and better business outcomes, visit Cisco Lifecycle Services here. You can also contact your Cisco account representative or authorized partner directly to set up an introductory meeting.

  Helping customers achieve business outcomes with the right expertise, services, and solutions is core to what we do. Learn how our new Cisco Lifecycle Services help you achieve outcomes faster.  Read More Cisco Blogs 

In my role, I have the incredible opportunity to meet trailblazing IT leaders just like you every day. Each has told me that in order to continue to innovate and help their organization thrive, they… Read more on Cisco Blogs

​

In my role, I have the incredible opportunity to meet trailblazing IT leaders just like you every day. Each has told me that in order to continue to innovate and help their organization thrive, they must align technology investments to business priorities and achieve remarkable, tangible results. But they can’t do it alone! IT leaders have also shared with me the need for strategic advisors with deep technical expertise and understanding of their business to inform their decisions and accelerate technology adoption.

In response to what we hear from customers like you, we are continually evolving our Customer Experience (CX) services portfolio. Today, I am excited to announce that we are launching a brand-new outcomes-driven offering – Cisco Lifecycle Services (LCS). These services shift your focus from IT challenges to business outcomes. LCS lets you start with your desired outcomes, then helps you identify and execute IT initiatives aligned to those outcomes, which allows you to demonstrate measurable results. You also get Cisco experts with advanced tools, automation, and AI/ML insights to accelerate time-to-outcomes.

“Companies require IT services that provide the scalability and adaptability to align to changing business and technology needs. Organizations of all sizes and across multiple industries need the ability to orient technology initiatives to discreet business outcomes with measurable KPIs. I believe that Cisco’s new Lifecycle Services is novel in its delivery mechanism to this end and leans into its depth of knowledge and capabilities. ”
– Will Townsend, VP & Principal Analyst, Moor Insights and Strategy

Focus on Business Outcomes

We understand your business, industry, and technologies. Distilled from over 30 years of experience helping thousands of organizations worldwide, Cisco Lifecycle Services empowers YOU to:

1. Drive business outcomes with continuous engagement.

Let’s say your priority is to reduce risk, enhance customer experience, and increase operational excellence – these are your desired business outcomes (and we have 11 in our catalog). With your desired outcomes as the compass, Cisco experts help you identify and develop IT optimization and transformation strategies. We then work with your team and partners to prioritize, implement, and drive the adoption of these strategies so that you achieve tangible business outcomes.

2. De-risk and accelerate time-to-outcomes.

With this service, you make informed decisions. Our experts have AI/ML insights, tools, and automation to translate telemetry data into actions. You also accelerate time-to-outcomes by removing execution roadblocks. You close skills-gap and talent shortages with Cisco’s team of deep technical experts to fast-track planning, designing, implementing, and automating your IT environment.

3. Demonstrate measurable success.

At the beginning of the engagement, together with you, we identify outcomes aligned KPIs (Key Performance Indicators). Next, we use our automated KPI measurement tools and telemetry to create a baseline. Throughout the engagement, Cisco experts track, measure, translate, and report the impact aligned with your desired outcomes.

4. Exercise flexible choices that align with the way you work.

At Cisco, we’re committed to your success. We understand that your organization is unique and has ways of working. With this service, you get the flexibility to engage Cisco experts and our partners in the best way for you.

Provide deep and meaningful advice with actionable recommendations.
Work with you as part of your team.
Do it for you with end-to-end delivery ownership.

And, should your business priorities change during the engagement, we realign the experts and IT initiatives to your new direction.

Simple, consistent, and integrated engagement model

When you choose Cisco and our partners, you expect a simple, consistent, and high-quality experience. Rooted in learnings from our delivery experts and customer feedback, we expect to exceed your expectations with the new engagement model.

Baseline: We begin by understanding your business objectives and tailoring KPIs to align with your goals. Then, we establish a baseline using telemetry and other methods.
Analyze: Using telemetry and high-touch discovery, our experts analyze your IT environment and identify strategies to achieve your desired business outcomes.
Recommend: We make recommendations, help you prioritize IT initiatives, and build an execution plan.
Execute: We and our partners work with you to remove roadblocks to ensure the execution of prioritized initiatives – aligned with the way you work.
Measure: To demonstrate progress consistently, we track, measure, translate, and report KPIs at regular intervals using Automated Dashboard and Quarterly Business Reviews (QBR).

When you start with a business outcome, you know multiple IT initiatives will get you there. It gets complex. With Integrated Service Delivery, our experts handle the complexity and coordinate with your teams, partners, and the Cisco team to keep everyone in sync and focused on the ultimate objective. All you experience is simplicity, consistency, and measurable business outcomes.

Previews surpassed initial expectations.

We organized field trials with select customers to validate our new approach. The initial response surpassed our highest expectations. A broad range of organizations representing service providers, manufacturing, healthcare, retail, finance, education, and the public sector signed up for the preview, and the feedback tells us our impact with outcomes exceeds the value of previous services provided. Now we’re ready to bring this tremendous value to you.

Amplify with Cisco Partners

Cisco Lifecycle Services complements the capabilities and scale of our extensive partner ecosystem. Suppose you are already working with one of our partners. In that case, Cisco Lifecycle Services allows you and the partner to deepen the strategic relationship and achieve greater alignment on your business priorities and the business outcomes you desire. As Cisco and Cisco Partner experts analyze your environment and make recommendations to transform and optimize your IT environment, our flexible model allows you to engage your preferred partners to deliver a variety of implementation and managed services.

Let’s shift the focus from challenges to business outcomes.

To learn how your IT organization can accelerate their ability to deliver new and better business outcomes, visit Cisco Lifecycle Services here. You can also contact your Cisco account representative or authorized partner directly to set up an introductory meeting.

  Helping customers achieve business outcomes with the right expertise, services, and solutions is core to what we do. Learn how our new Cisco Lifecycle Services help you achieve outcomes faster.  Read More Cisco Blogs 

The Black Hat Network Operations Center (NOC) provides a high security, high availability network in one of the most demanding environments in the world – the Black Hat event.

The NOC partners are… Read more on Cisco Blogs

​

The Black Hat Network Operations Center (NOC) provides a high security, high availability network in one of the most demanding environments in the world – the Black Hat event.

The NOC partners are selected by Black Hat, with Arista, Cisco, Corelight, Lumen, NetWitness and Palo Alto Networks delivering from Las Vegas this year. We appreciate Iain Thompson of The Register, for taking time to attend a NOC presentation and tour the operations. Check out Iain’s article: ‘Inside the Black Hat network operations center, volunteers work in geek heaven.’

We also provide integrated security, visibility and automation: a SOC (Security Operations Center) inside the NOC, with Grifter and Bart as the leaders.

Integration is key to success in the NOC. At each conference, we have a hack-a-thon: to create, prove, test, improve and finally put into production new or improved integrations. To be a NOC partner, you must be willing to collaborate, share API (Automated Programming Interface) keys and documentation, and come together (even as market competitors) to secure the conference, for the good of the attendees.

XDR (eXtended Detection and Response) Integrations

At Black Hat USA 2023, Cisco Secure was the official Mobile Device Management, DNS (Domain Name Service) and Malware Analysis Provider. We also deployed ThousandEyes for Network Assurance.

As the needs of Black Hat evolved, so have the Cisco Secure Technologies in the NOC:

Cisco XDR: threat intelligence aggregation
ThousandEyes: Network Assurance
Cisco Umbrella: DNS visibility and security
Cisco Secure Malware Analytics (Formerly Threat Grid): sandboxing and integrated threat intelligence
Cisco Secure Cloud Analytics (Formerly Stealthwatch Cloud): network traffic visibility and threat detection
Cisco Webex: incident delivery and team collaboration
Cisco Security Connector: iOS device security and visibility, connected with Meraki Systems Manager

The Cisco XDR dashboard made it easy to see the status of each of the connected Cisco Secure technologies, and the status of ThousandEyes agents.

Below are the Cisco XDR integrations for Black Hat USA, empowering analysts to investigate Indicators of Compromise (IOC) very quickly, with one search. We appreciate alphaMountain.ai, Pulsedive and Recorded Future donating full licenses to the Black Hat USA 2023 NOC.

For example, an IP tried AndroxGh0st Scanning Traffic against the Registration server, blocked by Palo Alto Networks firewall.

Investigation of the IP confirmed it was known malicious.

Also, the geo location in RU and known affiliated domains. With this information, the NOC leadership approved the shunning of the IP.

File Analysis and Teamwork in the NOC

Corelight and NetWitness extracted nearly 29,000 files from the conference network stream, which were sent for analysis in Cisco Secure Malware Analytics (Threat Grid).

It was humorous to see the number of Windows update files that were downloaded at this premier cybersecurity conference. When file was convicted as malicious, we would investigate the context:

Is it from a classroom, where the topic is related to the behavior of the malware?
Or, is from a briefing or a demo in the Business Hall?
Is it propagating or confined to that single area?

The sample above was submitted by Corelight and investigation confirmed multiple downloads in the training class Windows Reverse Engineering (+Rust) from Scratch (Zero Kernel & All Things In-between), an authorized activity.

The ABCs of XDR in the NOC, by Ben Greenbaum

One of the many Cisco tools in our Black Hat kit was the newly announced Cisco XDR. The powerful, multi-faceted and dare I say it “extended” detection and response engine allowed us to easily meet the following goals:

One of the less public-facing benefits of this unique ecosystem is the ability for our engineers and product leaders to get face time with our peers at partner organization, including those that would normally – and rightfully – be considered our competitors. As at Black Hat events in the past, I got to participate in meaningful conversations about the intersection of usage of Cisco and 3rd party products, tweak our API plans and clearly express the needs we have from our partner technologies to better serve our customers in common. This collaborative, cooperative project allows all our teams to improve the way our products work, and the way they work together, for the betterment of our customers’ abilities to meet their security objectives. Truly a unique situation and one in which we are grateful to participate.

Secure Cloud Analytics in XDR, by Adi Sankar

Secure Cloud Analytics (SCA) allows you to gain the visibility and continuous threat detection needed to secure your public cloud, private network and hybrid environment. SCA can detect early indicators of compromise in the cloud or on-premises, including insider threat activity and malware, as well as policy violations, misconfigured cloud assets, and user misuse. These NDR (Network Detection and Response) capabilities have now become native functionality within Cisco XDR. Cisco XDR was available starting July 31st 2023, so it was a great time to put it through its paces at the Black Hat USA conference in August.

Cisco Telemetry Broker Deployment

Cisco Telemetry Broker (CTB) routes and replicates telemetry data from a source location(s) to a destination consumer(s). CTB transforms data protocols from the exporter to the consumer’s protocol of choice and because of its flexibility CTB was chosen to pump data from the Black Hat network to SCA.

Typically, a CTB deployment requires a broker node and a manager node. To reduce our on-prem foot print I proactively deployed a CTB manager node in AWS (Amazon Web Services) (although this deployment is not available for customers yet, cloud managed CTB is on the roadmap). Since the manager node was deployed already, we only had to deploy a broker node on premise in ESXi.

With the 10G capable broker node deployed it was time to install a special plugin from engineering. This package is not available for customers and is still in beta, but we are lucky enough to have engineering support to test out the latest and greatest technology Cisco has to offer (Special shoutout to Junsong Zhao from engineering for his support). The plugin installs a flow sensor within a docker container. This allows CTB to ingest a SPAN from an Arista switch and transform it to IPFIX data. The flow sensor plugin (formerly Stealthwatch flow sensor) uses a combination of deep packet inspection and behavioral analysis to identify anomalies and protocols in use across the network.

In addition to the SPAN, we requested that Palo Alto send NetFlow from their Firewalls to CTB. This allows us to capture telemetry from the edge devices’ egress interface giving us insights into traffic from the external internet, inbound to the Blackhat network. In the CTB manager node I configured both inputs to be exported to our SCA tenant.

Private Network monitoring in the cloud

First, we need to configure SCA by turning on all the NetFlow based alerts. In this case it was already done since we used the same tenant for a Blackhat Singapore. However, this action can be automated using the API api/v3/alerts/publish_preferences/ by setting both “should_publish” and “auto_post_to_securex” to true in the payload. Next, we need to configure entity groups in SCA to correspond with internal Blackhat network. Since subnets can change conference to conference, I automated this configuration using a workflow in XDR Automate.

The subnets are documented in a CSV file from which the workflow parses 3 fields: the CIDR of the subnet, a name and a description. Using these fields to execute a POST call to the SCA /v3/entitygroups/entitygroups/ API creates the corresponding entity groups. Much faster than manually configuring 111 entity groups!

Now that we have network telemetry data flowing to the cloud SCA can create detections in XDR. SCA starts with observations which turn into alerts which are then correlated into attack chains before finally creating an Incident. Once the incident is created it is submitted for priority scoring and enrichment. Enrichment queries the other integrated technologies such as Umbrella, Netwitness and threat intelligence sources about the IOC’s from the incident, bringing in additional context.

SCA detected 289 alerts including Suspected Port Abuse, Internal Port Scanner, New Unusual DNS Resolver,and Protocol Violation (Geographic). SCA correlated 9 attack chains including one attack chain with a total of 103 alerts and 91 hosts on the network. These attack chains were visible as incidents within the XDR console and investigated by threat hunters in the NOC.

Conclusion

Cisco XDR collects telemetry from multiple security controls, conducts analytics on that telemetry to arrive at a detection of maliciousness, and allows for an efficient and effective response to those detections. We used Cisco XDR to its fullest in the NOC from automation workflows, to analyzing network telemetry, to aggregating threat intelligence, investigating incidents, keeping track of managed devices and much more!

Hunter summer camp is back. Talos IR threat hunting during Black Hat USA 2023, by Jerzy ‘Yuri’ Kramarz

This is the second year Talos Incident Response is supporting Network Operations Centre (NOC) during the Black Hat USA conference, in a threat hunting capacity.

My objective was to use multi-vendor technology stacks to detect and stop ongoing attacks on key infrastructure externally and internally and identify potential compromises to attendees’ systems. To accomplish this, the threat hunting team focused on answering three key hypothesis-driven questions and matched that with data modeling across different technology implementations deployed in the Black Hat NOC:

Are there any attendees attempting to breach each other’s systems in or outside of a classroom environment?
Are there any attendees attempting to subvert any NOC Systems?
Are there any attendees compromised, and could we warn them?

Like last year, analysis started with understanding how the network architecture is laid out, and what kind of data access is granted to NOC from various partners contributing to the event. This is something that changes every year.

Great many thanks go to our friends from NetWitness, Corelight, Palo Alto Networks, Arista and Mandiant and many others, for sharing full access to their technologies to ensure that hunting wasn’t contained to just Cisco equipment and that contextual intelligence could be gathered across different security products. In addition to technology access, I also received great help and collaboration from partner teams involved in Black Hat. In several cases, multiple teams were contributing technical expertise to identify and verify potential signs of compromise.

Bouncing ideas across the team to arrive at conclusion

For our own technology stack, Cisco offered access to Cisco XDR, Meraki, Cisco Secure Malware Analytics, Thousands Eyes, Umbrella and Secure Cloud Analytics (formerly known as StealthWatch).

The Hunt

Our daily threat hunt started with gathering data and looking at the connections, packets and various telemetry gathered across the entire network security stack in Cisco technologies and other platforms, such as Palo Alto Networks or NetWitness XDR. Given the infrastructure was an agglomeration of various technologies, it was imperative to develop a threat hunting process which supported each of the vendors. By combining access to close to 10 different technologies, our team gained a greater visibility into traffic, but we also identified a few interesting instances of different devices compromised on the Black Hat network.

One such example was an AsyncRat-compromised system found with NetWitness XDR, based on a specific keyword located in the SSL certificate. As seen in the screenshot below, the tool allows for powerful deep-packet-inspection analysis.

AsyncRAT traffic record.

After positive identification of the AsyncRat activity, we used the Arista wireless API to track the user to a specific training room and notified them about the fact that their device appeared to be compromised. Sometimes these types of activities can be part of a Black Hat training classes, but in this case, it seemed evident that the user was unaware of the legitimate compromise. This little snippet of code helped us find out where attendees were in the classrooms, based on Wireless AP connection, so we could notify them about their compromised systems.

A simple Arista API implementation that tracked where users were located on the conference floor.

Throughout our analysis we also identified another instance of direct malware compromise and related network communication which matched the activity of an AutoIT.F trojan communicating over a command and control (C2) to a well-know malicious IP [link to a JoeBox report]. The C2 the adversary used was checking on TCP ports 2842 and 9999. The example of AutoIT.F trojan request, observed on the network can be found below.

Example of AutoIT.F trojan traffic.

Above traffic sample was decoded, to extract C2 traffic record and the following decoded strings appeared to be the final payload. Notice that the payload included hardware specification, build details and system name along with other details.

AutoIT.F decoded trojan traffic sample

Likewise, in this case, we managed to track the compromised system through the Wi-Fi connection and notifiy the user that their system appeared to be compromised.

Clear Text authentication still exists in 2023

Although not directly related to malware infection, we did discover a few other interesting findings during our threat hunt, including numerous examples of clear text traffic disclosing email credentials or authentication session cookies for variety of applications. In some instances, it was possible to observe clear-text LDAP bind attempts which disclosed which organization the device belonged to or direct exposure of the username and password combination through protocols such as POP3, LDAP, HTTP (Hyper Text Transfer Protocol) or FTP. All these protocols can be easily subverted by man-in-the-middle (MitM) attacks, allowing an adversary to authenticate against services such as email. Below is an example of the plain text authentication credentials and other details observed through various platforms available at Black Hat.

Cleartext passwords and usernames disclosed in traffic.

Other examples of clear text disclosure were observed via basic authentication which simply used base64 to encode the credentials transmitted over clear text. An example of this was noticed with an Urban VPN (Virtual Private Network) provider which appears to grab configuration files in clear text with basic authentication.

Base64 credentials used by Urban VPN to get configuration files.

A few other instances of various clear text protocols such as IMAP were also identified on the network, which we were surprised to still be use in 2023.

iPhone Mail using IMAP to authenticate.

What was interesting to see is that several modern mobile applications, such as iPhone Mail, are happy to accept poorly configured email servers and use insecure services to serve basic functionalities, such as email reading and writing. This resulted in numerous emails being present on the network, as seen below:

Email reconstruction for clear text traffic.

This year, we also identified several mobile applications that not only supported insecure protocols such as IMAP, but also performed direct communication in clear text, communicating everything in clear text, including user pictures, as noted below:

Images transmitted in clear text.

In several instances, the mobile application also transmitted an authentication token in clear text:

Authentication token transmitted in clear text.

Even more interesting was the fact that we have identified a few vendors attempting to download links to patches over HTTP, as well. In some instances, we have seen original requests sent over HTTP protocol with the “Location” header response in clear text pointing to an HTTPS location. Although I would expect these patches to be signed, communicating over HTTP makes it quite easy to modify the traffic in MitM scenario to redirect downloads to separate locations.

HTTP download of suspected patches.HTTP download of suspected patches.

There were numerous other examples of HTTP protocol used to perform operations such as reading emails through webmail portals or downloading PAC files which disclose internal network details as noted on the screenshots below.

Clear text email inbox access.PAC files observed in clear text, disclosing internal network setup.

Cisco XDR technology in action

In addition to the usual technology portfolio offered by Cisco and its partners, this year was also the first year I had the pleasure of working with Cisco XDR console, which is a new Cisco product. The idea behind XDR is to give a single “pane of glass” overview of all the different alerts and technologies that work together to secure the environment. Some of Cisco’s security products such as Cisco Secure Endpoint for iOS and Umbrella were connected to via XDR platform and shared their alerts, so we could use these to gain a quick understanding of everything that is happening on network from different technologies. From the threat hunting perspective, this allows us to quickly see the state of the network and what other devices and technologies might be compromised or execute suspicious activities.

XDR console at the very beginning of the conference.XDR console on 10:35 a.m. on Aug. 5, 2023.

While looking at internal traffic, we also found and plotted quite a few different port scans running across the internal and external network. While we would not stop these unless they were sustained and egregious, it was interesting to see different attempts by students to find ports and devices across networks. Good thing that network isolation was in place to prevent that.

The example below shows quick external investigation using XDR, which resulted in successful identification of this type of activity. What triggered the alert was a series of events which identified scanning and the fact that suspected IP also had relationships with several malicious files seen in VirusTotal:

XDR correlation on suspected port scanner.

Based on this analysis, we quickly confirmed that port scanning is indeed valid and determined which devices were impacted, as seen below. This, combined with visibility from other tools such as Palo Alto Networks boundary firewalls, gave us stronger confidence in our raised alerts. The extra contextual information related to malicious files also allowed us to confirm that we are dealing with a suspicious IP.

XDR correlation mapping to additional attributes.

Throughout the Black Hat conference, we saw many different attacks spanning across different endpoints. It was helpful to be able to filter on these attacks quickly to find where the attack originated and whether it was a true positive.

XDR correlation on specific IP to identify connectivity to malicious domain and traffic direction.

Using the above view, it was also possible to directly observe what contributed to the calculation of malicious score and what sources of threat intelligence could be used to identify how was the malicious score calculated for each of the components that made up the overall alert.

A breakdown of XDR correlation of threat intelligence on specific IP.

It’s not just about internal networks

In terms of the external attacks, Log4J, SQL injections, OGLN exploitation attempts, and all kinds of enumeration were a daily occurrence on the infrastructure and the applications used for attendee registration, along with other typical web-based attacks such as path traversals. The following table summarizes some of the observed some of the successfully blocked attacks where we have seen the biggest volume. Again, our thanks to Palo Alto Networks for giving us access to their Panorama platform, so we can observe various attacks against the Black Hat infrastructure.

A summary of the most frequent external attacks observed during Black Hat 2023.

Overall, we saw a sizeable number of port scans, floods, probes and all kinds of web application exploitation attempts showing up daily at various peak hours. Fortunately, all of them were successfully identified for context (is this part of a training class or demonstration?) and contained (if appropriate) before causing any harm to external systems. We even had a suspected Cobalt Strike server (179.43.189[.]250) [link to VirusTotal report] scanning our infrastructure and looking for specific ports such as 2013, 2017, 2015 and 2022. Given the fact that we could intercept boundary traffic and investigate specific PCAP (packet capture) dumps, we used all these attacks to identify various C2 servers for which we also hunted internally, to ensure that no internal system is compromised.

Network Assurance, by Ryan MacLennan and Adam Kilgore

Black Hat USA 2023 is the first time we deployed a new network performance monitoring solution named ThousandEyes. There was a proof of concept of ThousandEyes capabilities at Black Hat Asia 2023, investigating a report of slow network access. The investigation identified the issue was not with the network, but with the latency in connecting to a server in Ireland from Singapore. We were asked to proactively bring this network visibility and assurance to Las Vegas.

ThousandEyes utilizes both stationary Enterprise Agents and mobile Endpoint Agents to measure network performance criteria like availability, throughput, and latency. The image below shows some of the metrics captured by ThousandEyes, including average latency information in the top half of the image, and Layer 3 hops in the bottom half of the image with latency tracked for each network leg between the Layer 3 hops.

The ThousandEyes web GUI can show data for one or many TE agents. The screenshot below shows multiple agents and their respective paths from their deployment points to the Black Hat.com website.

We also created a set of custom ThousandEyes dashboards for the Black Hat convention that tracked aggregate metrics for all of the deployed agents.

ThousandEyes Deployment

Ten ThousandEyes Enterprise Agents were deployed for the conference. These agents were moved throughout different conference areas to monitor network performance for important events and services. Endpoint Agents were also deployed on laptops of NOC technical associate personnel and used for mobile diagnostic information in different investigations.

Coming into Black Hat with knowledge of how the conference will be set up was key in determining how we would deploy ThousandEyes. Before we arrived at the conference, we made a preliminary plan on how we would deploy agents around the conference. This included what kind of device would run the agent, the connection type, and rough locations of where they would be set up. In the image below you can see we planned to deploy ThousandEyes agents on Raspberry Pi’s and a Meraki MX appliance

The plan was to run all the agents on the wireless network. Once we arrived at the conference, we started prepping the Pi’s for the ThousandEyes image that was provided in the UI (User Interface). The below image shows us getting the Pi’s out of their packaging and setting them up for the imaging process. This included installing heatsinks and a fan.

After all the Pi’s were prepped, we started flashing the ThousandEyes (TE) image onto each SD-Card. After flashing the SD-Cards, we needed to boot them up, get them connected to the dashboard and then work on enabling the wireless. While we had a business case that called for wireless TE agents on Raspberry Pi, we did have to clear a hurdle or wireless not being officially supported for the Pi TE agent. We had to go through a process of unlocking (jailbreaking) the agents, installing multiple networking libraries to enable the wireless interface, and then create boot up scripts to start the wireless interface, get it connected, and change the routing to default to the wireless interface. You can find the code and guide at this GitHub repository.

We confirmed that the wireless configurations were working properly and that they would persist across boots. We started deploying the agents around the conference as we planned and waited for them all to come up on our dashboard. Then we were ready to start monitoring the conference and provide Network Assurance to Black Hat. At least that is what we thought. About 30 minutes after each Pi came up in our dashboard, it would mysteriously go offline. Now we had some issues we needed to troubleshoot.

Troubleshooting the ThousandEyes Raspberry Pi Deployment

Now that our Pi’s had gone offline, we needed to figure out what was going on. We took some back with us and let them run overnight with one using a wired connection and one on a wireless connection. The wireless one did not stay up all night, while the wired one did. We noticed that the wireless device was significantly hotter than the wired one and this led us to the conclusion that the wireless interface was causing the Pi’s to overheat.

This conundrum had us confused because we have our own Pi’s, with no heatsinks or fans, using wireless at home and they never overheat. One idea we had was that the heatsinks were not cooling adequately because the Pi kits we had used a thermal sticker instead of thermal paste and clamp like a typical computer. The other was that the fan was not pushing enough air out of the case to keep the internal temperature low. We reconfigured the fan to use more voltage and flipped the fan from pulling air out of the case to pushing air in and onto the components. While a fan placed directly on a CPU should pull the hot air off the CPU, orienting the Raspberry Pi case fan to blow cooler air directly onto the CPU can result in lower temperatures. After re-orienting the fan, to blow onto the CPU, we did not have any new heating failures.

Running a couple of Pi’s with the new fan configuration throughout the day proved to be the solution we needed. With our fixed Pi’s now staying cooler, we were able to complete a stable deployment of ThousandEyes agents around the conference.

ThousandEyes Use Case

Connectivity problems with the training rooms were reported during the early days of the conference. We utilized several different methods to collect diagnostic data directly from the reported problem areas. While we had ThousandEyes agents deployed throughout the conference center, problem reports from individual rooms often required a direct approach that brought a TE agent directly to the problem area, often targeting a specific wireless AP (Access Points) to collect diagnostic data from.

One specific use case involved a report from the Jasmine G training room. A TE engineer traveled to Jasmine G and used a TE Endpoint Agent on a laptop to connect to the Wi-Fi using the PSK assigned to the training room. The TE engineer talked to the trainer, who shared a specific web resource that their training session depended on. The TE engineer created a specific test for the room using the online resource and collected diagnostic data which showed high latency.

During the collection of the data, the TE agent connected to two different wireless access points near the training room and collected latency data for both paths. The connection through one of the APs showed significantly higher latency than the other AP, as indicated by the red lines in the image below.

ThousandEyes can generate searchable reports based on test data, such as the data shown in the prior two screenshots. After capturing the test data above, a report was generated for the dataset and shared with the wireless team for troubleshooting. 

Mobile Device Mangement, by Paul Fidler and Connor Loughlin

For the seventh consecutive Black Hat conference, we provided iOS mobile device management (MDM) and security. At Black Hat USA 2023, we were asked to manage and secure:

Registration: 32 iPads
Session Scanning: 51 iPads
Lead Retrieval: 550 iPhones and 300 iPads

When we arrived for set up three days before the start of the training classes, our mission was to have a network up and running as soon as is humanly possible, so start managing the 900+ devices and check their status.

Wi-Fi Considerations

We had to adjust our Wi-Fi authentication schema. In the prior four Black Hat conferences, the iOS devices were provisioned with a simple PSK based SSID that was available everywhere throughout the venue. Then, as they enrolled, they were also pushed a certificate / Wi-Fi policy (where the device then went off and requested a cert from a Meraki Certificate Authority, ensuring that the private key resided securely on the device. At the same time, the certificate name was also written into Meraki’s Cloud Radius.

As the device now had TWO Wi-Fi profiles, it was now free to use its inbuilt prioritisation list (more details here) ensuring that the device joined the more secure of the networks (802.1x based, rather than WPA2 / PSK based). Once we were sure that all devices were online and checking in to MDM, we then removed the cert profile from the devices that were only used for Lead Retrieval, as the applications used for this were internet facing. Registration devices connect to an application that’s actually on the Black Hat network, hence the difference in network requirements.

For Black Hat USA 2023, we just didn’t have time to formulate a plan for the devices that would allow those that needed to have elevated network authentication capabilities (EAP-TLS in all likelihood), as the devices were not connecting to a Meraki network anymore, which would have enabled them to use the Sentry capability, but instead an Arista network.

For the future, we can do one of two things:

Provision ALL devices with the same Wi-Fi creds (either Registration or Attendee) Wi-Fi at the time of enrolment and add the relevant more secure creds (cert, maybe) as they enroll to the Registration iPads ONLY
More laboriously, provision Registration devices and Session Scanning / Lead Retrieval devices with different credentials at the time of enrolment. This is less optimal as:
We’d need to know ahead of time which devices are which used for Session Scanning, Lead Retrieval or Registration
It would introduce the chance of devices being provisioned with the wrong Wi-Fi network creds

When a Wi-Fi profile is introduced at the time of Supervision, it remains on the device at all times and cannot be removed, so option 2 really does have the opportunity to introduce many more issues.

Automation – Renaming devices

Again, we used the Meraki API and a script that goes off, for a given serial number, and renames the device to match the asset number of the device. This has been quite successful and, when matched with a policy showing the Asset number on the Home Screen, makes finding devices quick. However, the spreadsheets can have data errors in them. In some cases, the expected serial number is the device name or even an IMEI. Whilst we can specify MAC, Serial and SM device ID as an identifier, we can’t (yet) supply IMEI.

So, I’ve had to amend my script so that it, when it first runs, gets the entire list of enrolled devices and a basic set of inventories, allowing us to look up things like IMEI, device name, etc., returning a FALSE if still not found or returning the Serial if found. This was then amended further to search the Name key if IMEI didn’t return anything. It could, theoretically, be expanded to include any of the device attributes! However, I think we’d run quickly into false positives.

The same script was then copied and amended to add tags to devices. Again, each device has a persona:

Registration
Lead Retrieval
Session Scanning

Each persona has a different screen layout and application required. So, to make this flexible, we use tags in Meraki Systems Manager speak. This means that if you tag a device, and tag a setting or application, that device gets that application, and so on. As Systems Manager supports a whole bunch of tag types, this makes it VERY flexible with regards to complex criteria for who gets what!

However, manually tagging devices in the Meraki Dashboard would take forever, so we can utilise an API to do this. I just had to change the API call being made for the renaming script, add a new column into the CSV with the tag name, and a couple of other sundry things. However, it didn’t work. The problem was that the renaming API doesn’t care that the ID that is used: MAC, Serial or SM Device ID. The Tagging API does, and you must specify which ID that you’re using. So, I’d changed the Alternative Device ID search method to return serial instead of SM device ID. Serial doesn’t exist when doing a device lookup, but SerialNumber does! A quick edit and several hundred devices had been retagged.

Of course, next time, all of this will be done ahead of time rather than at the conference! Having good data ahead of time is priceless, but you can never count on it!

Caching Server

Downloading iOS 16.6 is a hefty 6GB download. And whilst the delta update is a mere 260MB, this is still impactful on the network. Whilst the download takes some time, this could be massively improved by using a caching server. Whilst there’s many different ways that this could be achieved, we are going to research using the caching capability built into macOS (please see documentation here). The rational for this is that:

It supports auto discover, thus there’s no need to build the content caching at the edge of the network. It can be built anywhere, and the devices will auto discover this
It’s astoundingly simple to set up
It will be caching both OS (Operating System) updates AND application updates

Whilst there wasn’t time to get this set up for Black Hat USA 2023, this will be put into production for future events. The one thing we can’t solve is the humongous amount of time the device needs to prepare a software update for installation!

Wireless

Predictably (and I only say that because we had the same issue last year with Meraki instead of Arista doing the Wi-Fi), the Registration iPads suffered from astoundingly poor download speeds and latency, which can result in the Registration app hanging and attendees not being able to print their badges.

We have three requirements in Registration:

General Attendee Wi-Fi
Lead Retrieval and Session Scanning iOS devices
Registration iOS devices

The issue stems from when both Attendee SSID and Registration SSID are being broadcast from the same AP. It just gets hammered, resulting in the aforementioned issues.

The takeaway from this is:

There needs to be a dedicated SSID for Registration devices
There needs to be a dedicated SSID throughout Black Hat for Sessions Scanning and Lead Retrieval (This can be the same SSID, just dynamic or identity (naming changes depending on vendor) PSK)
There needs to be dedicated APs for the iOS devices in heavy traffic areas and
There needs to be dedicated APs for Attendees in heavy traffic areas

Lock Screen Message

Again, another learning that came too late. Because of the vulnerability that was fixed in iOS 16.6 (which came out the very day that the devices were shipped from Choose2Rent to Black Hat, who prepared them), a considerable amount of time was spent updating the devices. We can add a Lock Screen message to the devices, which current states: ASSET # – SERIAL # Property of Swapcard

Given that a visit to a simple webpage was enough to make the device vulnerable, it was imperative that we updated as many as we could.

However, whilst we could see with ease the OS version in Meraki Systems Manager, this wasn’t the case on the device: You’d have to go and open Settings > General > About to get the iOS Version.

So, the thoughts occurred to me to use the Lock Screen Message to show the iOS version as well! We’d do this with a simple change to the profile. As the OS Version changes on the device, Meraki Systems Manager would see that the profile contents had changed and push the profile again to the device! One to implement for the next Black Hat!

The Ugly….

On the evening of the day of the Business Hall, there was a new version of the Black Hat / Lead Retrieval app published in the Apple App Store. Unfortunately, unlike Android, there’s no profiles for Apple that determine the priority of App updates from the App Store. There is, however, a command that can be issued to check for and install updates.

In three hours, we managed to get nearly 25% of devices updated, but, if the user is using the app at the time of the request, they have the power to decline the update.

The Frustrating…

For the first time, we had a few devices go missing. It’s uncertain as to whether these devices are lost or stolen, but…

In past Black Hat events, when we’ve had the synergy between System Manager and Meraki Wi-Fi, it’s been trivial, as inbuilding GPS (Global Positioning System) is not existent, to have a single click between device and AP and vice versa. We’ve obviously lost that with another vendor doing Wi-Fi, but, at the very least, we’ve been able to feed back the MAC of the device and get an AP location.

However, the other frustrating thing is that the devices are NOT in Apple’s Automated Device Enrollment. This means that we lose some of the security functionality: Activation Lock, the ability to force enrollment into management after a device wipe, etc.

All is not lost though: Because the devices are enrolled and supervised, we can put them into Lost Mode which locks the device, allows us to put a persistent message on the screen (even after reboot) and ensure that the phone has an audible warning even if muted.

You can find the code and guide at this GitHub repository and the guide in this blog post.

SOC Cubelight, by Ian Redden

The Black Hat NOC Cubelight was inspired by several projects primarily the 25,000 LED Adafruit Matrix Cube (Overview RGB LED Matrix Cube with 25,000 LEDs