Posts Tagged ‘security’

How to Secure Mobile Devices and Cloud Applications for the Remote Workforce

Recently, we polled viewers of our Behind the Network series. Out of 81 responses, 51 confirmed that security and compliance is what worries them the most about shifting to a more remote workforce. It’s no surprise that security is always a top priority, even as our work environment changes. While most organizations prioritize protecting employees, devices, business applications, and sensitive data from cyberattacks, the task is no easy feat. Let’s take one aspect of security and break it down into actionable steps: securing mobile devices.

When it comes to securing mobile phones, IT administrators know the importance of using endpoint management software to provision, configure, and monitor those assets. Another critical step is asking key questions like: 

  • What was the state of the device before we installed the management software? 
  • Are we certain that our corporate applications are being deployed to a secure device?
  • Are we certain the applications themselves are secure? 

There are two critical pillars in security are the device level and at the application level. When planning your mobile foundation, the combined Meraki Systems Manager and Duo’s Trusted Endpoint feature helps you address each of these areas. Meraki Systems Manager provides complete control over your mobile phones and Duo provides the best possible Multi-Factor Authentication (MFA), used from those secure devices, to ensure your users access corporate applications securely and with the highest level of authentication. Duo’s Trusted Endpoint feature, integrated with Systems Manager, ensures an extra level of trust based on a Duo issued certificate unique to each mobile device.

Whether your company buys phones for your employees or whether you manage BYOD phones, you can use Meraki Systems Manager to ensure the security of those devices. Configure password requirements, enforce GeoFencing policies, automatically deploy “Sentry WiFi” profiles for secure wireless, and track inventory to ensure the OS and apps are up-to-date. Additionally, for an even stronger foundation you can deploy company-purchased phones using Apple’s DEP or Zero Touch on Android phones, so that security is turned on at the factory before the shrink wrap is opened.

Given how important Duo’s MFA capability is to a defense-in-depth strategy, and how logically it builds on top of the OS security Meraki Systems Manager provides beneath it, you would be right to ask “what is the most secure process for deploying and configuring Duo on my mobile devices?” Duo’s Trusted Endpoint feature is the exact answer to this question.

Meraki Systems Manager now integrates directly with Duo and supports the Trusted Endpoint feature for securely deploying Duo to iOS and Android devices. Configuration takes just a few minutes. You can easily set up both Meraki and Duo from your couch at home given that both systems are managed using native cloud dashboards. Upon completion, you will have laid down the ultimate secure foundation for mobile OS management and MFA application security. Using the Duo Trusted Endpoint feature, Meraki Systems Manager is able to provision Duo automatically to each device while simultaneously configuring Duo so that it is enrolled in Duo’s PKI before the MFA actions are allowed.

Fast, scalable deployment of mobile devices requires a trusted foundation, otherwise you are building a very shaky structure for your business. Meraki Systems Manager, when combined with Duo’s Trusted Endpoint capability, is a comprehensive security solution for mobile devices. The operating system is configured and secured by Meraki—with security originating at the factory if zero touch provisioning is used. Your multi-factor authentication provided by Duo ensures that access to corporate applications is gated securely. And, critically, the security foundation for the Duo application itself is laid down using Meraki System Manager’s integration with the Trusted Endpoint feature.

For more information on this enterprise security feature, please join us on an upcoming live webinar co-presented by Meraki and DUO.

Introducing Meraki Trusted Access

These days, as individuals carry multiple types of devices and expect to be connected at all times, the job of an IT admin becomes more complicated and stressful. Knowing what each end-user and device is trying to do on the network can be a burden. How can you feel confident that your network security will not be jeopardized while company assets remain contained? 

Systems Manager, Cisco’s Mobile Device Management (MDM) solution, is evolving to address this need. We are introducing Meraki Trusted Access, which securely connects personal devices to business-critical resources without requiring an MDM profile to be installed. 

Meraki Trusted Access enhances both the IT and end-user experience

For IT, Meraki Trusted Access means no longer dealing with tedious and manual onboarding processes. Granting secure network access to end devices becomes seamless and automated. With the Meraki dashboard, IT can sync their Active Directory server to create user profiles. From those user profiles, Trusted Access can then be enabled for specific Wi-Fi networks, specifying how many devices each user can onboard to get access and for how long. A user’s device gets access using a certificate, once that user is authenticated, the device is now “trusted”. A “trusted” device can now securely access resources. 

Additionally, Meraki Trusted Access enables more control and manageability over certificate-based onboarding processes. Whether a user is managed or unmanaged, the certificate authentication is done with Meraki. This removes the need to engineer complex third-party integrations. Finally, Systems Manager also offers an open API platform for customized integrations, for more business-critical operations. 

For end-users, Meraki Trusted Access means an easier way to access critical applications. By using the newly enhanced Meraki Self-Service Portal, end-users can sign into the portal and start onboarding their devices themselves. From there, they can download certificates directly to those devices, granting them secure access to business-critical applications they might need. On top of this intuitive method of getting their devices access, end-users will also be happy to know that their privacy stays intact. They will no longer need to enroll into an MDM solution in order to get the access they need.

Meraki Trusted Access is the easiest way to securely connect devices without an MDM

 

Enabling Meraki Trusted Access is simple. Meraki Trusted Access is enabled when you have both Meraki MR access points and Meraki Systems Manager in your network. 

You can configure Meraki Trusted Access in 4 simple steps: 

  1. Enable Trusted Access on an SSID
  2. Create an end-user profile under Systems Manager. You can automatically use Active Directory group tags to enable Trusted Access or configure users manually.
  3. Select the end-user’s network access privileges and tie them to the SSID that has Trusted Access enabled 
  4. Share the Self-Service Portal link to the end-user so they can onboard their devices and download the trusted certificate.

Cisco’s MDM solution, Meraki Systems Manager, continues to provide end-users and end-devices network security with flexible authentication methods, automated device onboarding, and dynamic security policies. 

If you are a current MR and SM customer, you can try Meraki Trusted Access today (just make sure you have enough SM licenses to cover the number of mobile devices). Start by reading our Meraki Trusted Access documentation guide for a smooth set-up. If you’d like to learn more about Systems Manager, you can connect with the Meraki team to start a 30-day free trial, no strings attached.

 

Integrating MV Smart Cameras with Access Control

A puzzle is a picture broken up into hundreds of pieces. An individual piece doesn’t offer much insight into the big picture, but as more pieces are connected, the story becomes clearer. Physical security is similar in that one piece of information about a single event doesn’t always provide a clear picture of what actually happened.

Say that a security team receives an alert with two pieces of information:

  • A door was propped open for 60 seconds.
  • An employee badge, Sarah’s to be specific, was used to unlock the door.  

What should the security team do? The answer depends on the circumstances. Was it actually Sarah using her badge? Why was the door open for so long? Was there tailgating, and if so, who else came in? Video can help answer these questions, but how do you know when and where to look? To make sense of events faster and get the complete picture, video and access control systems need to work together.

Get Answers More Quickly

Fortunately, Meraki MV smart camera APIs make it easy to provide video context to establish the validity of things like access control logs. The video link API can be used to pair video footage with access control events. The snapshot API can retrieve a snapshot from the relevant camera for more immediate context on a given event, in this case a person badging in. 

This means when there is an alert, or an event needs to be reviewed, it’s easy for the user to quickly understand what happened. With this type of integration in the scenario above, security could have easily looked at the snapshot or accessed the relevant video in the dashboard to verify that it was Sarah using her badge, and that she propped open the door to carry in a couple of boxes. 

The Sequr Platform make it easy to access relevant video from your MV smart cameras

MV Integration is Built into the Sequr Platform

While the APIs are available for anyone to use, Sequr has made it even easier for customers using their cloud access control system. The Sequr platform integration with Meraki MV smart cameras make it quick and easy to get started. Once the API key has been entered, simply map cameras to doors and start monitoring access control logs with Meraki MV smart cameras. 

In the Sequr platform, a video link to the relevant feed will appear next to each event. Selecting the link will launch the camera in the Meraki dashboard and play video for the event. Sequr users can also configure the system to create a short video clip, viewable in the Sequr platform. The videos can also be included in alerts, sent via email or to a messaging platform, making it even easier for teams to quickly assess events. 

MV smart camera video clips can be included with alerts on the Sequr platform

To learn more about our MV smart camera APIs, visit the Meraki Developer Hub on DevNet. To learn more about the Sequr cloud access control system, check out the Meraki Marketplace.

Exploring Snort

 

Introduction

The internet can be a dangerous place, with malware, ransomware, worms and botnets to name just a few things. How can you keep your organization and its data safe?  The Meraki MX leverages some industry-leading security technologies and puts them in the hands of users, network operators and partners whilst simultaneously making them easy to enable.  

In this blog post, we will explore one of the security technologies that Meraki utilizes to help keep users safe, namely Snort, which is an open-source network intrusion detection system/intrusion prevention systems (IDS/IPS).

What exactly is IDS/IPS?

Before we talk about why we think Snort is great, we first need to talk about what an IDS/IPS is.  

IDS/IPS systems are devices or software that monitors networks or computers to detect malicious or anomalous behaviour.  An IDS simply alerts the network or system operators of malicious or anomalous behaviour, whereas IPS will also actively prevent this behaviour.  

To provide an analogy, think of a firewall as a door securing access in and out of a controlled area.  The IDS is akin to a security camera pointing at the door, whereas an IPS is a security camera with frickin’ lasers!

image credit: thinkgeek.com

Why is Snort #1 in the industry?

For a start, Snort, under the guise of Cisco, has consistently been in the upper right-hand corner of Gartner’s Magic Quadrant for IPS for many years.  Fundamentally, Snort is the #1 IPS in the world because it is the most widely deployed, with over 4 million downloads open-source variant alone. That doesn’t even take into account the variants running on Cisco FirePower Firewalls, Cisco ASA with FirePower services firewalls, and Cisco Meraki MX security appliances.  

The open source nature of Snort’s development provides the following benefits:

  • Rapid responseCisco Talos is constantly (24x7x365) updating the rulesets that Snort uses, meaning organizations that leverage Snort are quickly protected from emerging threats.
  • Greater accuracy – The rulesets running on Snort are reviewed, tested, and improved upon by the community of users, which means organizations using Snort are leveraging the knowledge of security teams worldwide.
  • High adaptability – The open source nature of Snort means that companies and organizations can build the power of Snort directly into their own applications.

Snort isn’t a silver bullet on its own,  but no security technology is.  That is why at Meraki we expose the threat information identified by Snort and other technologies in a single pane of glass, enabling network defenders to  quickly and easily understand whether a threat is targeted (and hence serious) or part of the background of the internet.

That single panel of glass is the Meraki Security Center, and it allows network defenders to see all threat data in a given network for 30 days and, in three or four clicks, lock in on a potential issue whilst cutting through the noise.

Talos?

In its own words, Cisco Talos is the industry-leading threat intelligence group fighting the good fight!  They are a team of exceptionally talented women and men who peer into the dark corners of the internet to protect your organization’s people, infrastructure and data.  Their researchers, data scientists and engineers deliver protection against attacks and malware that underpins the entire Cisco security ecosystem, Meraki included.

If you would like to learn more about Cisco Talos, then we recommend subscribing to the ‘Beers with Talos’ podcast and listen to Mitch, Craig, Joel, Matt & Nigel break down the latest threats and trends.  With the exception of Nigel (who does support the best football team in the world, so he gets a pass), the Beers with Talos team runs Meraki MX Security Appliances in their home networks!

Conclusion

The implementation of Snort on Meraki’s MX security appliances typifies Meraki’s philosophy; we take an industry leading, best-in-class technology and we make it simple to enable and configure.  All while making the data you get from it both easy to understand and to act on.

If you think your organization could benefit from the power and simplicity of Snort in the Meraki MX Security Appliance, contact Meraki sales today.

References 

SD-WAN con Meraki

 

Si trabaja en el sector de tecnología de red, probablemente habrá escuchado del término SD-WAN muchas veces en los últimos meses. En esta publicación, desarrollaremos algunos de los conceptos para ayudar a mostrar por qué SD-WAN podría ser de gran beneficio  para su negocio.

SD-WAN significa diferentes cosas para diferentes proveedores, sin mencionar todo el hardware dedicado, el software y las licencias necesarias para ejecutar estas soluciones. El objetivo de SD-WAN es permitir a las organizaciones ahorrar dinero y atender sus necesidades de conectividad más rápido.

En Cisco Meraki, tenemos una solución SD-WAN incluída con la licencia base (licencia para empresas) en todos los dispositivos de seguridad Meraki MX SD-WAN y no requiere de servidores ni hardware adicionales. Solo conéctelo, configúrelo en el panel de Meraki y comience a ahorrar dinero, agregue valor en otras áreas del negocio.

Registro para Webinar SD-WAN

SD-WAN es un acrónimo de (Software-Defined Wide Area Network) y es una tecnología que forma la familia de tecnologías de red definida por software (SDN), con otro ejemplo que es el acceso definido por software. El estar definido por software significa que las decisiones sobre cómo el tráfico puede enrutarse entre todos los sitios en la WAN están definidas por la política, y su comportamiento se adapta a la condición de la WAN en lugar de tener una configuración fija.

Las soluciones SD-WAN logran esto a través de una serie de funciones, tales como resistencia, seguridad, calidad de servicio, optimización de aplicaciones y mucho más. La solución Meraki SD-WAN utiliza una combinación única de estas tecnologías para crear una solución que sea fácil de configurar, implementar y administrar.

Si no está roto, no lo arregles

Si bien este suele ser un buen consejo, el dilema del innovador también nos enseña que si no introduces la tecnología disruptiva en un espacio establecido, como la WAN, ¡alguien más lo hará! MPLS ha visto mucha innovación, pero sería justo decir que esa innovación es, en su mayor parte, para los proveedores de servicios que ejecutan y ofrecen servicios WAN en la parte superior de las redes MPLS.

La simplicidad de Meraki SD-WAN significa que la potencia y la flexibilidad están directamente en manos del cliente o proveedor de servicios. Lo que significa que sin la necesidad de dispositivos, servicios o actualizaciones adicionales, los clientes pueden crear o beneficiarse de una conectividad de red más rentable.

Si bien este tipo de enrutamiento preferencial está disponible en las redes MPLS tradicionales, por lo general, solo está disponible a nivel premium, en un conjunto de clases limitadas y para redes o aplicaciones predefinidas. Mientras que Meraki SD-WAN combina la detección de aplicaciones basada en la capa 7 que viene en todo el stack de Meraki para lograr esto de una manera más breve

¿Por qué Meraki entonces?

A menudo bromeamos diciendo que la SD-WAN es solo un esparcimiento mágico basado en políticas construido sobre la VPN automática de Cisco Meraki. Sin embargo, utiliza tecnología abierta basada en estándares que probablemente ya haya usado. A lo que nos referimos específicamente aquí es una tecnología creada originalmente en Google, pero más tarde de código abierto, que está incorporada en la mayoría de sus productos (por ejemplo, Gmail, Google Drive).

Los dispositivos de seguridad y SD-WAN MX utilizan esta tecnología para inferir la latencia, la fluctuación de fase y la pérdida de paquetes de rutas virtuales entre 2 MX, como se muestra a continuación. Estas tres cosas juntas nos brindan la capacidad de calcular una Puntuación de opinión media (MOS), que se puede usar para calificar la aceptabilidad de una ruta WAN para el tráfico de voz.

Esto significa que una de las políticas que viene preconfigurada es la capacidad de elegir la ruta virtual que sea mejor para el tráfico de voz: una ganancia rápida para todos. En el caso de que cambie la mejor ruta virtual para la voz, el MX moverá automáticamente los flujos a la siguiente ruta más apropiada.

Para rastrear aplicaciones con diferentes características a la voz, simplemente puede agregar una clase de rendimiento personalizada que le permita establecer un umbral compatible para latencia, fluctuación de fase, pérdida de paquetes o cualquier combinación de las tres. A continuación, se puede hacer referencia a este criterio como criterio para la selección de ruta virtual en una única política de UI, como se muestra a continuación:

Finalmente, y completamente integrado en la solución, está la capacidad de ver cómo los flujos atraviesan las rutas virtuales de su red casi en tiempo real e históricamente de manera más poderosa:

Meraki ha estado simplificando tecnología compleja durante más de una década y SD-WAN es solo otro ejemplo en el que hemos aplicado la magia de Meraki para permitir que las organizaciones se centren en su misión. También vale la pena señalar que Meraki ha estado ofreciendo SD-WAN desde 2016, lo que la convierte en una de las plataformas tecnológicas más establecidas y estables en este espacio.

Miles de clientes en todo el mundo ya han elegido Meraki SD-WAN y miles más ya lo estan probando. Conoce más en nuestros webinars con demo en vivo de SD-WAN, registro aquí.

 

A New MX Lineup for the Modern Branch

You are probably aware of the increasing use of cloud-hosted applications, as well as the worldwide availability of reliable LTE coverage. You’ve almost certainly witnessed the increasing use of mobile devices, growth of video traffic, and increasing security threats. These trends challenge modern organizations to adapt to a complex landscape with higher bandwidth requirements, multiple uplinks, and threats that can take down networks. Despite these complexities, IT admins can use new technologies to position their branch networks for a successful future.

What’s new?

Today, we are excited to announce brand new additions to our MX and Z products, with multiple new MX security & SD-WAN appliances, along with a new Z-Series teleworker and IoT device. With upgraded and improved hardware, the additions to the MX line feature higher throughputs, faster Wi-Fi, and integrated LTE modems. The built-in modems will offer a greatly simplified way to connect remote locations or provide failover redundancy via LTE.

The MX67 and MX68 lineup

The new MX products benefit from state of the art new hardware features designed to deal with an evolving branch environment:

  • Up to 450 Mbps Throughput
  • 802.11ac Wave 2 Wireless
  • Integrated 300 Mbps CAT 6 LTE cellular modem

The MX family adds six new models to the highly successful MX64 and MX65 small branch security & SD-WAN appliances. The new MX67 and MX68 products include models with wired, wireless, cellular, and PoE+ capabilities.  Both the MX67C and MX68CW feature region-specific SKUs to accommodate separate cellular bands. Meraki is partnering with mobile providers to fully certify the cellular platforms across all regions. For more details of MX67, MX67W, MX68, MX68W, and the cellular MX67C, MX68CW visit the MX datasheet.

The new Z-Series

We are also delighted to add a new model to our feature-packed Z-Series teleworker gateway family with the Meraki Z3C, now with LTE. A built-in 100 Mbps CAT 3 LTE modem in the Z3C provides an elegant way to add redundancy for teleworker deployments. Our customers are also excited about using the Z3C to securely connect remote or isolated machinery such as vending machines, ATMs, and kiosks.

LTE in the dashboard

Similar to the rest of Meraki’s products, these new cellular MX and Z-Series models offer exceptional visibility via the Meraki dashboard. For these models, IT admins can monitor current traffic and historical performance, as well as the ability to troubleshoot and configure their LTE connections. For example, the dashboard allows users to configure and reset their cellular connection with a few clicks of a button. There will be a new LTE API, and the dashboard will make it simple to manage devices at scale using templates.

The Meraki MX continues to march forward in its mission to provide market-leading threat intelligence and an intuitive SD-WAN offering to keep customers connected and secure. Try out the new devices for yourself with a free trial, and let us know what you think.

One more thing…

Speaking of free trials, for those purchasing the new MX and Z-Series models in the next three months, we have an additional treat: a free 45-day trial of Meraki Insight, our intuitive tool for monitoring and troubleshooting WAN and application performance. With Insight, IT admins can monitor the status of all uplinks in the organization, and troubleshoot any network outages within seconds. It also provides detailed performance metrics to understand the root cause of ISP outages. Contact a Meraki sales representative for more information.

To learn more about the MX67 and MX68 models, as well as the Z3C, watch the launch webinar or visit the What’s New page.

Meraki MR + Umbrella: A Match Made In the Cloud

The pace at which new security threats are being introduced and propagated online has reached exponential levels, gaining speed with each passing year. Organizations have more locations and devices to protect, and threats are using many different ports to try to gain access or exfiltrate data. Security teams are often understaffed and struggle with complex, siloed systems that do not integrate or share intelligence in a programmatic way. These teams need solutions that are easy to deploy, simple to manage, can scale exponentially, and can integrate with other tools.

Securing your wireless users from malicious attacks — particularly these “DNS blind spots” that exist in many networks and are exploited by 97% of advanced malware — is of paramount importance. Unfortunately, recent surveys indicate that 75% of organizations do not actively monitor and apply security for DNS.

It is within this context that we are excited to announce support for integration between Meraki MR wireless access points (APs) and Cisco Umbrella (formerly OpenDNS).

Umbrella is the industry’s first secure internet gateway, a cloud-delivered first line of defense against threats like malware, ransomware, and phishing.  Umbrella enforces security at the DNS layer by identifying requested web domains hosting nasty stuff — malware, phishing, etc. — and block end user access to them. Umbrella also enables more secure DNS querying through a tool called DNSCrypt, which automatically encrypts DNS queries between your network and Umbrella’s servers, effectively eliminating the chance that your queries will be the victim of eavesdropping or man-in-the-middle (MITM) attacks. This secures the “last mile” of a client’s internet connection, which is often left exposed and vulnerable.

There is no additional cost or charge for taking advantage of this integration (which is available to all Meraki wireless customers who have upgraded to our latest MR26.x firmware), but Meraki wireless customers who wish to integrate with Umbrella will need a separate Umbrella license and account with that service.

 

Enabling Umbrella integration

So, what does this mean for admins of Meraki wireless networks? This integration with Umbrella enables Meraki admins who obtain Umbrella licenses (WLAN, Professional, Insights, or Platform) to seamlessly assign DNS filtering via Meraki group policy or SSID to specific subsets of wireless clients, or to them all.

Enabling Umbrella integration takes only a few steps. First, the Meraki and Umbrella dashboards must be linked via the Umbrella Network Devices API key. Once this API key is generated from within the Umbrella dashboard, it needs to be copied into the Meraki dashboard by navigating to Network-wide > General.

Enabling Meraki + Umbrella integration within the Meraki dashboard.

 

Once the Meraki and Umbrella dashboards have been configured, linking a Meraki SSID or group policy to an Umbrella security policy is easy (note: Meraki group policies must be set to use ‘Custom SSID Firewall & Shaping Rules’ to link an Umbrella policy to them). After this initial setup, a unique identifier is generated behind the scenes for the specified Meraki SSID or group policy and is used by Umbrella to determine how to evaluate traffic from that Meraki network moving forward.

To link a Meraki SSID to an Umbrella policy, navigate to the Wireless > Configure > Firewall & Traffic Shaping section of the Meraki dashboard. There, you will find a button to link Umbrella policies.

Linking an Umbrella policy to a Meraki SSID.

 

By default, the last policy physically listed in the Umbrella dashboard’s ordered policy list will be inherited by a Meraki SSID unless a different policy is selected from the dropdown list.

To link a Meraki group policy to an Umbrella security policy, navigate to the Network > Configure > Group policies page in the Meraki dashboard and choose the specific Meraki group policy that you want to link. Under the ‘Layer 7 firewall rules’ section of that policy, you’ll be able to choose which Umbrella policy you’d like to apply.

Applying an Umbrella DNS policy to the Meraki ‘VIP Umbrella Clients’ group policy.

 

Once a Meraki SSID or group policy has been successfully linked to an Umbrella security policy, clients connecting to that SSID or who have been applied that group policy will have their DNS queries encrypted (if the AP supports 802.11ac) and verified against the corresponding Umbrella policy. Encrypting DNS queries between Meraki APs and Umbrella DNS endpoints helps secure the ‘last mile’ of client web browsing and protects against devastating MITM attacks or packet snooping that can reveal which websites client devices are browsing.

An example Umbrella policy may prohibit access to known malicious web domains or websites that host specific types of content, like gambling or peer-to-peer domains. If the client’s request for access to a given website is allowed, Umbrella will return an encrypted DNS response with the appropriate IP address. If the request is denied, then an encrypted DNS response pointing to the Umbrella block page will be returned instead.

Taken together, Meraki wireless and Umbrella integration provide a significantly more robust security framework for IT admins looking to protect clients from web threats in a more proactive way. Instead of waiting for a malicious site to infect a machine and then using tools like antivirus to detect and remediate, Meraki MR customers can rest easy knowing that they are protected from ever reaching harmful sites in the first place.

Interested customers should contact Meraki Support to have this feature enabled. This feature requires an early-release MR firmware version that can be enabled with Meraki support assistance.

To find out more, speak to a Meraki sales representative today.

Ensure you’re secure from VPNFilter

The newest blog post from the Cisco Talos intelligence team, one of the largest commercial threat intelligence teams in the world, highlights VPNFilter, the newest malware threat spreading across the Internet. This attack can lead to stolen website credentials, IoT device vulnerabilities, Internet connection cut-offs, and devices potentially rendered completely unusable.

At this point in time, no Meraki devices are known to be affected. Meraki and Talos are conducting ongoing investigations into this threat and its signatures. Meraki MX users who use the Advanced Security license have the capability to protect their network from security vulnerabilities such as VPNFilter.

MX Ensures Security

The Meraki MX makes it very easy to implement powerful Cisco security technologies like Snort and Advanced Malware Protection (AMP). In addition to AMP and Snort, Meraki MX allows for intuitive URL blocking, as well as Layer 3 firewall rules to ban nefarious IP addresses. These capabilities play an integral role in keeping networks safe from malware.

With Cisco Snort technologies enabled, the MX performs real-time traffic analysis and can generate alerts or take actions based on a constantly updated database of threat signatures. For example, Snort has already updated and pushed out rulesets to allow identification and prevention of VPNFilter malware for Meraki MX users who have IPS enabled. IPS rulesets are updated every 24 hours and pushed out to the MX, constantly keeping you safe from new threats. The Meraki cloud also delivers firmware, bug, and feature updates to the MX.

Example of Meraki MX blocking VPNFilter exploit with Intrusion Prevention

In addition to IDS/IPS, the MX’s integrated AMP technology can detect malware and block it from being downloaded on the network. AMP can also retroactively detect files that have been downloaded on the network that have malicious markers. VPNFilter is known to infect networks by downloading files to the network from specific URLs. Fortunately, Cisco AMP has already updated its malware database for file hashes associated with VPNFilter and pushed these updates over the cloud to Meraki MX users with AMP enabled. The Meraki MX is helping protect your network by delivering these technologies via the cloud directly to your doorstep.

Blocking Threats in 3 Steps with Meraki MX

As highlighted in the detailed post from Talos, action can be taken on a list of identified URLs, IP addresses, Snort signatures, and AMP file identifiers related to VPNFilter. All of these threats can be easily neutralized within the Meraki dashboard. To enable AMP, Snort, and URL blocking features on the MX, an Advanced Security license is required. The Layer 3 firewall rules are incorporated in both MX licenses (Enterprise License and the Advanced Security License).

Following Step 1 is most important, and only takes 15 seconds, while Steps 2 & 3 take less than one minute each. Being able to secure your network easily is the hallmark of Meraki MX.

1. Enabling AMP & Snort

Visit the Security appliance > Configure > Threat protection section. A few simple clicks allow you to enable AMP and set Snort IPS to ‘Prevention’ mode with the ‘Security’ ruleset.

2. URL Blocking

Go to Security appliance > Content filtering to block the URLs listed in the Cisco Talos blog post.

3. Blocking nefarious IP addresses

Under Security appliance > Firewall you have the ability to deny traffic to all known IP addresses associated with VPNFilter malware, as listed by Cisco Talos.

For more detailed information on VPNFilter, please refer to this post from Cisco Talos. We will continue to monitor the threat landscape and work with our Talos team to provide you updates on VPNFilter and other security vulnerabilities as they develop. To learn more about the many capabilities of the Meraki MX, including SD-WAN and Security, visit the Meraki website or sign up for one of our webinars.

Saving on security is no saving at all

The last couple of weeks have shown how vulnerable our connected world can be. Reports of a new wave of Distributed Denial of Service (DDoS) attacks at a scale beyond what has been seen before are attracting worldwide headlines. With traffic floods now reaching the terabyte scale, only those with global resources and deep pockets can withstand such an onslaught.

“The attack began around 8 p.m. ET on Sept. 20, and initial reports put it at approximately 665 Gigabits of traffic per second.”

KrebsOnSecurity Hit with Record DDoS – KrebsOnSecurity – September 21st 2016

Powering this new wave of cyber weaponry is the Internet of Things (IoT). A nascent breed of devices taking their steps into the world at a time where the value of something is dramatically amplified by its integration into the network. Unfortunately this rapid push to connect everything has not always been balanced with the rapid push to secure the underlying technology architecture.

“That cyberattack was powered by something the internet had never seen before: an army made of more than one million hacked Internet of Things devices.”

How 1.5 Million Connected Cameras Were Hijacked to Make an Unprecedented Botnet Motherboard – September 29th 2016

One of the unwilling device types in these recent attacks are IP enabled security cameras. These cameras and recording systems are typically well connected and remotely accessed. When this is combined with poorly implemented web interfaces, default passwords, and a lack of cyber security oversight, systems are effectively waiting to be exploited.

“Attackers used an army of hijacked security cameras and video recorders to launch several massive internet attacks last week, prompting fresh concern about the vulnerability of millions of “smart” devices”

Hackers Infect Army of Cameras, DVRs for Massive Internet Attacks The Wall Street Journal – September 30th 2016

The Meraki MV Security Camera delivers on the promise of simple connected devices without security compromise. At the heart of MV is the same core software powering other Meraki devices like wireless access points and security appliances. This code has been honed over the last 10 years, battle tested in the most demanding of locations, and it provides the most secure control infrastructure of any security camera available.

All MV management traffic and video transport is encrypted by default: it’s not even possible to configure MV to operate without encrypted communications. Administrative access to the cameras is only available through the Meraki dashboard, an interface that can be secured with advanced technologies such as two factor authentication.

Beyond the individual devices, the Meraki infrastructure is housed in SSAE16 / SAS70 Type II certified data centres, undergoes daily penetration testing, and is covered by our security rewards program. These policies and processes allow us to meet the most rigorous of customer requirements, including the need to be PCI compliant.

The initial savings of a low cost or consumer grade security camera system may prove expensive later on. If it is trivial for cameras to be used to attack legitimate businesses and other organisations, how much extra effort would it take for someone to start snooping through those same cameras?

With the advent of National Cyber Security Awareness Month, the MV team will be posting more information on MV’s security architecture to highlight our commitment to a safe world of connected devices. Until then, for further information please contact us to find out more.

Reactive network rules

One of the most popular capabilities of our MX security appliances and MR wireless access points is their ability to control what is going on in the network. This can be accomplished via a whole range of built in features such as Layer 7 traffic shaping, Layer 7 firewalling, intrusion prevention, malware scanning, and content filtering. Importantly these features can be easily applied in varying ways to different devices or users with the creation of custom network policies.

Known as Group Policies, these customized network rules prevent network administrators having to enforce a ‘one size fits all’ policy. They can make the network fit their users’ requirements, rather than the other way round. As is typical of Meraki feature design, the simplicity of configuration makes deploying it achievable and not an unattainable dream.

group_policies

However, what if we could make this even simpler to implement? Systems Manager Sentry provides simple, automatic security that is context aware. Sentry Policies enable dynamic updates to a client device’s assigned Group Policy based on contextual information gathered by the Systems Manager MDM. Now your firewall, traffic shaping, or content filtering rules can be automatically updated based on changes to a device’s security posture, logged-in user, or even location.

Sentry Policies are automatically made available when Systems Manager is deployed with Meraki network equipment. Due to the unified Meraki cloud management architecture, no complex integration or further configuration is required. If you can’t see Sentry Policies in your dashboard, then you are running an older version of Systems Manager. Click here to find out how to upgrade.

sentry_policies_comb

 

For one example of how Sentry Policies can be implemented,consider a content filtering deployment in an education environment. The multi-user authentication capability of the Systems Manager app allows devices such as iPads to have unique apps, settings, and restrictions per student. When a student logs into the device, Sentry Policies can trigger a content filtering policy change on the MX suitable for that class’s age group or subject. This is done without any teacher or administrator intervention.

new_sm_app_login

For security conscious customers, Sentry Policies can also be used to control network access. When a device is detected that is jailbroken or has an undesirable app installed, Sentry can implement firewall rules in the access points to block that device’s connectivity to sensitive corporate resources. Again, this requires no administrator intervention.

sentry_policy_edu_new

Systems Manager Sentry is unique in the way it enables automated security and simplified IT operations by unifying network and endpoint management. To find out more, sign up for one of our advanced webinars covering the Sentry feature set, or contact us to get a live demonstration.