Cisco is proud to announce the general availability of an entirely new capability in the software industry and a first for Cisco: the distribution of SPDX-formatted Software Bill of Materials… Read more on Cisco Blogs

​

Cisco is proud to announce the general availability of an entirely new capability in the software industry and a first for Cisco: the distribution of SPDX-formatted Software Bill of Materials (SBOMs). SBOMs are a crucial step forward in providing visibility and ultimately, greater resilience across the entire software supply chain. As of June 2023, most customers and partners can request an SBOM for any supported on-premise Cisco software released after September 2021.

I have blogged about Cisco’s commitment to transparency, specifically our support for SBOMs and our desire to collaborate across the software community to build the next generation of transparency. Today, Cisco stands ready to distribute SBOMs. This comes before other large technology vendors, ahead of the forthcoming government mandates, to customers outside of the public sector, and in a standardized, machine-readable format. Considering the shared complexities across the software industry, this is an important moment to recognize in our march toward software transparency that reduces risk.

The idea of an SBOM is deceptively simple, a machine-readable data format for organizing metadata describing the composition of software artifacts. SBOMs document the third-party software components contained in a downloadable software image. Cisco customers can download and use software in many ways, including client applications that run on end-user devices (e.g., Cisco Secure Client with AnyConnect), hardware-based appliances with applications running on Cisco-maintained operating systems (e.g., Identity Services Engine), virtualized applications that run in customers’ data centers or public cloud environments (e.g., Intersight), and network operating systems that power Cisco routers, switches, and firewalls (e.g., IOS XE, IOS XR, Nexus OS, FTD).  The pervasiveness and scale of software across networks combined with decades of software evolution highlights the incredible complexity that SBOMs are attempting to overcome.

The novelty of SBOMs is in standardizing how dependency metadata is documented; Cisco can make software dependency information which was previously only used internally useful for customers and organizations beyond Cisco. Sharing SBOMs across organizational boundaries provides customers with visibility into a software vendors’ upstream dependencies. Distributing SBOMs to our customers and partners underscores Cisco’s commitment to software transparency that both improves software supply chain resiliency and reduces cascading risk.

I often describe the software supply  chain  graph to illustrate the complexities that make documenting SBOMs an intricate problem shared across the software industry. Several factors have contributed to Cisco’s ability to deliver on this commitment, which we believe will help your organization to adopt SBOMs:

Strong Foundation: For more than a decade, an internal ecosystem of tools and processes has managed Cisco’s third-party software At Cisco SBOM requirements are part of the Cisco Secure Development Lifecycle policy. Start by defining your internal policies for third party software risk management and compliance.
Standardized Approach: Cisco supports the development of SBOM-related standards, including SPDX, CSAF, and OmniBOR. We have improved internal tools supporting these external standards and have set internal standards to ensure quality and consistency in the SBOMs we distribute. Start by defining the process you will use across your organization; at Cisco we refer to this as the SBOM workflow.
Centralized Services: New investments across Cisco have enabled the centralized development of capabilities that any engineering team can use to reduce duplication of SBOM tools and services and to accelerate SBOM adoption. Start by identifying the distinct types of software your organization distributes and creating requirements for centralized services to support all your software distribution types.
Unified Commitment: A collaborative rollout of SBOMs across multiple engineering organizations at Cisco underscores our focus to meet our customers’ needs. Start by gaining support from organizational leaders; at Cisco we regularly communicate updates to engineering and security leaders.

While this is a significant step forward, industry is early in this SBOM journey, and at Cisco we continue to identify areas to improve. To accelerate adoption, SBOMs must be natural biproducts of the software build process. Software build environments are the manufacturing lines for products. Breaking the build process by instrumenting new tools or updating libraries can have significant economic repercussions. It will take time for SBOM tooling to become stable, scalable, and available across programming languages, version control systems, compilers and linkers, CI/CD and pipeline automation tools, and packaging ecosystems. General availability of these tools is necessary to minimize human intervention as we aim to improve the accuracy and completeness of SBOMs.

Additional work in standardizing the distribution, consumption, and analysis of SBOMs alongside other datasets is also necessary. We welcome your comments and encourage you to consider the following two questions:

How are you adopting SBOMs in your organization?
What is your biggest priority as SBOMs continue to gain traction?

Learn more about SBOMs at Cisco.

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

InstagramFacebookTwitterLinkedIn

  This announcement underscores our commitment to software transparency that improves supply chain security.  Read More Cisco Blogs 

Let’s be honest, the last few years have been rough on all of us. Shifting our daily routines to match today’s hybrid-work environment has been quite a challenge. Some of us are still adapting to our … Read more on Cisco Blogs

​

Let’s be honest, the last few years have been rough on all of us. Shifting our daily routines to match today’s hybrid-work environment has been quite a challenge. Some of us are still adapting to our new approach to work – whether hybrid or fully remote.

This challenge is not new to us at Cisco. Before the pandemic, we had globally dispersed teams. But finding a balance between work and personal life post-pandemic has become even more of a necessity. Many of our teams working across multiple regions and time zones face additional obstacles. How can we enable our colleagues to come together and problem-solve important issues in a fun and thought-provoking environment?

Since 2021, the Cisco Product Security Incident Response Team (PSIRT) has been organizing the official Capture-the-Flag (CTF) exercise for Cisco’s Security Research & Operations organization. Participants have enjoyed the challenge and cooperation of the CTF, raising their awareness about cybersecurity and learning about evolving attacks and how to defend against them.

Every year since then, we have strived to create bigger, better, and more fun CTF events. In 2023, our goals were to:

Achieve our usual excitement and nurture our desire for collaboration
Extend the event to early-in-career and non-technical employees to demonstrate the importance of cybersecurity awareness and education for organizations and individuals alike

This year, we chose CyberStart, the innovative educational platform inspiring the next generation of cybersecurity professionals. CyberStart is an engaging platform sponsored by SANS that offers hundreds of technical challenges ranging from Offensive Security to Programming to Forensics through a powerful, yet fun, gamified narrative. This program also includes a strong infrastructure and reliable support team to make sure the CTF exercise runs smoothly.

We had more than 60 players from around the world, speaking more than 10 languages, with some technical gurus and some casual CTF gamers at their very first CTF experience. But this wasn’t the first time Cisco and SANS partnered for a CTF event. They also hosted the Cisco Women in Cybersecurity CyberStart Challenge in 2020.

Our participants loved it! But don’t take my word for it. Here’s what we heard from the participants when we asked them “How much did you enjoy this event?”

“The CTF is great, but I think challenges aside, the social aspects of it, getting to know people and work with them, is really valuable.” (Nick Leali – Technical)

“I really enjoyed it. I wasn’t particularly excited about doing it just because I am not in a technical role and don’t have much experience with analyzing things like pcap, mem, or looking at files too in depth, but once I got going, I was having a lot of fun. There were a few tools that were really hard to get up and running on the Kali VM, so I ended up doing some challenges on my personal computer running ubuntu. I honestly would love for it to be longer.” (Claire Griffin – Non-Technical)

“I am not in an uber-technical role, so I love that I can still solve some challenges and generally have most tools in the UI needed to be successful on the more modest challenges.” (Travis Kober – Technical/Non-Technical)

“Great event, and for me getting a team together for some team bonding was the best and intended value to sign up vs. how many challenges completed.” (Greg Taam – Technical/Non-Technical)

Thank You SANS!

This was such a fantastic experience, and we achieved all our goals to help cybersecurity experts, non-technical, and early-in-career participants learn new tools and procedures, engage collaboratively, and appreciate how to solve cybersecurity challenges together.

We highly recommend CyberStart as a platform to learn about common cybersecurity threats and how to study them in a fun and collaborative way. Reach out to SANS for more information.

Thank you, SANS, for this awesome platform and for sponsoring our annual event. We look forward to next year and the greater challenges to come.

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

InstagramFacebookTwitterLinkedIn

  CyberStart helps demonstrate the importance of cybersecurity awareness and education while inspiring the next generation of global cybersecurity professionals.  Read More Cisco Blogs 

Let’s continue the journey I started in my first blog about Cisco, AI and automation. In it, I focused on our zero-touch RMA notification tool. Now we’ll explore Webex Chat Assistant, our AI-based Read more on Cisco Blogs

​

Let’s continue the journey I started in my first blog about Cisco, AI and automation. In it, I focused on our zero-touch RMA notification tool. Now we’ll explore Webex Chat Assistant, our AI-based conversational tool.

The Collective Intelligence of Webex Chat Assistant

I mentioned in ‘Machines as “Thinking” Partners’ that annually, Cisco has 16 million customer exchanges. That massive amount of information is fodder for our AI crucible. From it, we forged Webex Chat Assistant, merging technology and service innovations.

Connect with it for help, day or night. You get targeted answers and make it smarter and faster… for you. The question of real versus artificial intelligence is moot, as Heinlein’s rhetoric from The Number of the Beast highlights: “Who is more real? Homer or Ulysses? Shakespeare or Hamlet? Burroughs or Tarzan?” We’re the co-creators. This is our collective intelligence. There’s nothing “artificial” about that. Just an easy, different way to find fast answers.

 “AI, robots, and humans work better when they work together.”—Klaus Schwab, Founder and Executive Chairman, World Economic Forum

Webex Chat Assistant was also the natural solution for customers who’ve told us that sometimes they’d rather fix a problem than open a support case. So, to create a customer service experience as superior as working with the Cisco TAC, we designed it with two themes in mind: reduce friction and fail fast.

Let me explain.

Reduce Friction and Fail Fast

To reduce friction, we focused on comprehension, speed, and relevancy. First, we looked at that AI crucible and asked ourselves your questions. Turnkey questions, such as, “How do I change my virtual background?” More involved questions, such as, “How do I enable single sign-on certificate expiration alert notifications?” We answered them in dozens of ways to bake the vagaries of human language, and comprehension, into your AI experience to create a “real” Cisco TAC experience. Today Webex Chat Assistant “speaks” in English. We’re now programming in additional languages. Our goal is to make Webex Chat Assistant as multi-lingual as the Cisco TAC.

Next is speed. Answers come fast, as fast as you can type. They’re also edited and optimized for chat, so they’re as quick to read as receive. Conversations with Webex Chat Assistant last about five minutes. The time saved compared to a traditional case can add up as you use it more and more.

Finally, there’s relevancy. In our last quarter, we delivered exact match answers for 35 percent of your queries using guided, follow-up questions that pinpoint precise responses. We launched with 50 guided question sets, and now we’ve authored hundreds and counting, adding more quarterly as you, our technology, and marketplace conditions evolve.

In our last quarter, we delivered exact match answersfor 35 percent of your queries.

“No employee makes the same mistake twice.”

Like Asimov’s robotics credo from“I, Robot”, Webex Chat Assistant is designed to fail fast. It “knows” when to step aside and connect you with a Cisco TAC engineer. And here’s a critical detail: None of your initial exchanges are lost in the ether. All details are logged and tagged so your engineer enters the conversation fully informed by an AI-to-human warm handoff in a seamless transition. Again, who or what part of that total experience was more, or less, real?

As my summer reading author Isaac Asimov said, “There is not a discovery in science, however revolutionary, however sparkling with insight, that does not arise out of what went before.” Watch this space to discover, if you have not already, our Virtual TAC engineer. With it, we are doubling down on natural AI communication and collaboration on even more complex topics to help you better manage your IT, time, and bandwidth challenges.

Find out more about what we are doing with

Artificial Intelligence at Cisco

  Let’s continue the journey I started in my first blog about Cisco, AI, and automation. In it, I focused on our zero-touch RMA notification tool. Now we’ll explore Webex Chat Assistant, our AI-based conversational tool.  Read More Cisco Blogs 

Compliance risk mitigation is arguably the most important strategic priority for banks, insurers, and wealth management institutions.  Hybrid work is not a “one size fits all”, as organizations bala… Read more on Cisco Blogs

​

Compliance risk mitigation is arguably the most important strategic priority for banks, insurers, and wealth management institutions.  Hybrid work is not a “one size fits all”, as organizations balance the appropriate mix between brick and mortar, remote work, or both.  The impact of digitization and hybrid work on business communications compliance is increasingly relevant in response to ongoing U.S. regulatory actions by the SEC and CFTC (Commodities Futures Trading Commission), with fines issued over $2B and climbing to 12+ financial institutions for lack of supervision of unapproved communication methods.

Compliance challenges include:

Smartphone and tablet use by consumers and employees
Increased use of collaboration platforms
Regulated employee activity in work from home offices
Cost of storage and archiving

Industry reactions include:

Shift back to corporate-owned devices
Turning off features, including record, chat, screen-sharing
Burdensome oversight / mandating return-to-office
Scaling back versus modernizing

With increased sense of urgency to digitize processes, financial institutions must record, monitor, and supervise customer-facing and customer-related internal conversations concerning its products and services – including all forms of electronic communications, with retention periods varying from three to seven years.  Regulatory-driven corporate compliance obligation best practices which directly relate to communications fall into three primary categories: record-keeping, storage, and supervisory review.

There is increased industry compliance pressure to maintain a reliable audit trail of everyday business practices, whether audio, video, or chat, to quickly detect potential compliance risks in visual, spoken and written content with internal and external customers.

Cisco has a solution

Marc Gilman, Theta Lake General Counsel and VP of Compliance

Cisco Investments portfolio company, Theta Lake provides UCC compliance and security solutions to address this immediate industry problem, including the potential financial implication of doing nothing.

“Financial institutions must navigate an increasingly rigorous regulatory environment while managing a complex set of communications technologies. Regulators across the globe expect firms to capture, retain, and supervise communications on any platform used to discuss financial products and services, regardless of where or when the interaction occurs. Theta Lake solves this problem by providing seamless integrations with Cisco’s full suite of collaboration platforms allowing firms to capture every video, voice, and chat communication and the dynamic components of those discussions like emojis, reactions, file transfers, whiteboards, and screen shares. Theta Lake helps firms every step of the way–from capturing core features of communications like chat, polling, or Q&A, to providing search and e-discovery capabilities across those conversations, even across different collaboration applications, and offering strategic supervision and long-term data retention capabilities using our multi-patented, AI-driven risk detections and smart workflows.” Marc Gilman, Theta Lake General Counsel and VP of Compliance.

What are next steps

While this has focused largely on the trading desk of global commercial banks, something financial institutions should not do in response to the SEC’s orders is to treat the issue as a one-dimensional problem. Buying a tech solution is not sufficient for most banks to solve the problem of understanding and monitoring how their employees communicate; banks also need competencies in how to handle the data they get from monitoring conversations.

Communication compliance also applies for financial institutions overall, including insurance, e.g., state insurance department claim standards of performance audits, potential adverse lawsuit from miscommunication on policy coverage terms and monetary limits.

There are many challenges to monitoring employee communications. One is sorting out who owns the data taken from employees’ communications and how stakeholders like the CTO and CRO want the data handled. Another is leveraging the data collected to find value efficiently.

For any financial institutions, there is assuredly a lesson from these fines, and inaction for these firms is not an option. Are you proactive or reactive?

We welcome the opportunity to talk further.

Why Cisco for Financial Services?

  Compliance risk mitigation is a strategic priority for financial institutions. The impact of digitization and hybrid work on business communications compliance is causing challenges that could result in industry fines as evidenced by the SEC punishment to major banks.  Read More Cisco Blogs 

Identifying the Need

In today’s rapidly evolving digital landscape, Channel Partners face many challenges. The constant emergence of new technology solutions and a myriad of complex offerings often l… Read more on Cisco Blogs

​

Identifying the Need

In today’s rapidly evolving digital landscape, Channel Partners face many challenges. The constant emergence of new technology solutions and a myriad of complex offerings often leaves gaps in service requirements. To stay ahead, partners are compelled to continually develop their expertise and confidently deliver solutions on every engagement. There is an increasing need for upskilling and reskilling to stay relevant and competitive, along with managing employee turnover that often leaves talent gaps and the departure of critical knowledge.

This is where the Mentored Install Network Training (MINT) Program comes in. Recognizing these needs, we have a tailored program designed not only to fill these gaps but also to empower partners to grow. It allows partners to graduate their skills progressively, enabling them to undertake larger, more complex projects and boost their top and bottom line.

Tailored for Success

MINT is designed for our Channel Partners who have a strong desire to leverage our industry-leading mentoring solutions to amplify their business performance. MINT brings together non-competitive, external third-party partners who operate worldwide across a vast array of Cisco solutions and architectures. This unique approach ensures that our Channel Partners can focus on what is important to them without worrying about competition.

To ensure the highest standards of service delivery, all MINT Partners have been thoroughly vetted by Cisco technical experts. MINT Partners must also go through a rigorous qualification process to participate in the program. To maintain eligibility, they are required to adhere to all company compliance standards, financial obligations, and requirements. This includes having a Non-Resell Partner Agreement (NRPA) that ensures our Channel Partners can maintain their unique offering in the market without any concerns about overlap from MINT.

Whether you are looking for pre-sales (Proof of Value) and/or post-sales (Mentored Installs) with trusted services on Cisco offerings to your customers, MINT is built with your success in mind. Rest assured, with MINT, you are in capable and credible hands.

Unveiling Our Services

At its core, MINT is a SKU-based program that offers a comprehensive suite of mentoring services to our Channel Partners. These include but are not limited to:

Extensive mentoring and white-glove support for creating a sustainable services practice
Access to technical resources for deployment/implementations
Advisory/consulting services
Business development assistance

MINT is strategically designed to equip our Channel Partners with the business acumen, technical knowledge, and support they need to fully leverage Cisco’s solutions and deliver unmatched value to their customers.

Get Started with MINT

Ready to explore a world of possibilities with MINT? Getting started with your journey is simple and straightforward. Channel Partners seeking mentoring support can reach out to their Cisco sales teams, explore our MINT SharePoint site, or order SKUs directly from the price list. All transactions are made through purchasing SKUs listed on the Global Price List (GPL), all at a standard price, governed by our SolutionsPlus program.

The list price per SKU is set at $1,250 with a standard 20% discount. Net price of $1,000 per SKU. To determine the number of SKUs required to engage, we will arrange a Level of Effort session between the MINT Partner and Channel Partner. Once the necessary number of SKUs is determined, they are easily added to the Bill of Materials (BoM) via CCW. When your SKUs are booked, our dedicated MINT team will reach out to guide you through the MINT engagement process.

The MINT Team is excited to embark on this journey with you, starting today.

Learn more about Cisco’s MINT Program!

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with #CiscoPartners on social!

Cisco Partners Facebook    Cisco Partners LinkedIn

  MINT is designed for our Channel Partners who have a strong desire to leverage our industry-leading mentoring solutions to amplify their business performance. MINT brings together non-competitive, external third-party partners who operate worldwide across a vast array of Cisco solutions and architectures.  Read More Cisco Blogs 

Do you feel a bit lost when people refer to certain environmental sustainability topics and aren’t sure where to start when it comes to learning more? Sustainability 101 is a blog series that you can … Read more on Cisco Blogs

​

Do you feel a bit lost when people refer to certain environmental sustainability topics and aren’t sure where to start when it comes to learning more? Sustainability 101 is a blog series that you can turn to for information about different environmental terms that may come up at work, during discussions with friends, and even at your annual holiday gathering.

This blog was written by Nicole Kenney, Program Manager, Sustainable Packaging, and Drew Phan, Packaging Engineer.

Nicole Kenney and Drew Phan

As part of modern life, most of the products we buy come in plastic packaging. When you buy something with plastic packaging, you’re probably not aware of what type of plastic it is. There is recycled plastic, which is when recycled bits of plastic are reprocessed into plastic products. And there is also virgin plastic, also known as virgin plastic polymers, which according to a 2022 report, means “newly manufactured resin produced from petrochemical or biomass feedstock used as the raw material for the manufacture of plastic products and which has never been used or processed before.”

Essentially, virgin plastics are manufactured from previously unused materials, which means they can take a bigger toll on the environment.

Since the 1950s, plastic has overrun the packaging industry by providing inexpensive and light-weight protection for products. Plastic packaging is widely available in the form of conventional foams, bags, and clamshell trays. Over the decades, this has led to a global build up of plastic pollution, since these materials are not always managed correctly at end of use. Although plastics are found in all major municipal solid waste categories, in the United States the containers and packaging category had the most plastic tonnage at over 14.5 million tons in 2018 alone.1  That is equivalent to the weight of over 300,000 gray whales. The sheer volume of waste has led to growing awareness around the impact of packaging and increased customer demand for sustainable alternatives.

At the same time, a product has little to no value if it arrives damaged. Cisco’s Packaging Engineering division thinks holistically when it comes to designing Cisco’s packaging with sustainability in mind. We are rethinking product packaging and are sourcing alternative materials to plastic. Our strategy includes eliminating plastic bags in our packaging wherever possible.  As an example, we have removed plastic packaging from our power cords, resulting in a reduction of over 10 million bags annually. Work is underway to apply the same efforts across additional component categories.

Design for Recyclability

Where we cannot completely remove plastic packaging, we must choose alternatives with a smaller environmental footprint.  This means opting for recyclable materials that are easily separated and widely accepted in curbside recycling streams. Once these materials are recovered, they can be broken down and re-processed into the feedstock for the next round of packaging.

As an example, our plastic thermoform cushions are made of the same high-density polyethylene material as milk jugs and can be accepted in the same plastic curbside recycling stream.* According to the U.S. Environmental Protection Agency (EPA), HDPE (High Density Polyethylene) is one of the most frequently recycled plastics in the United States.1

In the case of plastic bags in our accessory kits, efforts are underway to utilize fiber-based paper envelopes and corrugated sleeves that are recyclable. Paper is currently the best alternative because it is the most recycled material in the United States.2 

Choose Recycled Materials

Recycled materials are different from recyclable materials in that recycled packaging has a percentage of material inputs that have already been broken down and reprocessed after use. By incorporating more recycled content into our packaging, we conserve valuable resources and reduce greenhouse gas emissions compared to manufacturing virgin materials. Choosing recycled materials also promotes recycling by increasing the demand for recycled materials.

We are focusing our energy on recyclable and recycled plastics because, unfortunately, biodegradable and compostable plastics aren’t well suited for use in the electronics industry.

Biodegradable and bio-based are terms used loosely to describe plastics made from plant sources. The biggest concern for these materials is that it is not always clear how long it will take for these plastics to break down. Since they are often not certified compostable, they can potentially leech toxins into the soil.3

When it comes to compostable packaging, the U.S. Federal Trade Commission (FTC) Green Guides explain that this packaging must be certified with “competent and reliable scientific evidence that all materials in the product or package will break down into — or become part of — usable compost safely and in about the same time as the materials with which it is composted.”4 This is good for organic waste like food scraps, grass clippings and yard waste. But currently, the shorter shelf life of compostable packaging makes it better suited for food packaging than the electronics industry.

A circular strategy

 We are evolving to a more circular model in which we reduce the resources we consume and the waste we generate. With this approach, we try to prioritize materials with recycled content; design products for resource efficiency; and facilitate repair, remanufacturing, and recycling to extend product life. That’s why we have a goal for 100% of new Cisco products and packaging to incorporate Circular Design Principles by fiscal year 2025.** Using recycled materials is an example of one of our principles.

By pursuing our goal to incorporate Circular Design Principles, we can use less virgin material, and consume less material overall. Reducing our packaging carbon footprint will drive progress towards Cisco’s packaging goals.5

As we take the necessary steps to embed Circular Design Principles into our packaging portfolio, it is important to remember that every choice has tradeoffs — there is no one-size fits all solution. Achieving circularity is an iterative process — what is best for today may not be what’s best for tomorrow. But if we remain agile and strive for success, we can continue to move in a positive direction towards a circular economy.

Follow our Packaging Engineering team’s journey as we continue to evolve our circular packaging portfolio.6

* Check your local municipality for more info.

** In fiscal year 2022, we had conducted a soft launch of a new scoring tool that evaluates circularity in products and packaging. We used the soft launch to evaluate 13% of new products and packaging, and found that 33% of them successfully met our circular design criteria. This is equivalent to 4% of total new products and packaging released in fiscal year 2022 meeting circular design criteria. In early fiscal 2023, the scoring tool was formally launched across all business units, and we expect the universe of new products and packaging evaluated to increase in fiscal 2023.

References

1 Plastics: Material-Specific Data Federal Trade Commission (ftc.gov)

5 Environmental Goals – Cisco ESG Hub

6 Cisco Sustainable Packaging – Cisco

  Have you heard the phrase “virgin plastics” in the news and wondered what it meant? Learn more from Cisco's Sustainable Packaging team.  Read More Cisco Blogs