Comment on Cisco’s Security Solutions Webinar

I attended a web based event today on Cisco Security “Vision” which was hosted by Fred Kost, Director of Security Marketing.

First impressions were, nothing new, pushing the any client to any application security model.

Several mentions of “comsumerised end points” i.e. employees using Apple iphones etc. To access their company network.

Their “SecureX” architecture was discussed which seems to be a vision statement based on how to link all their recently acquired security products together, rather than what will this do for my company’s security posture?

There was a “real world” scenario given by Tom Gillis, VP of Security whereby a hapless American corporate executive, “Kevin”, loses his ipad in a bar after a few beers and thereby risks a major security incident because his password was “1234” and therefore easily guessed by a thief.

The saviour in this scenario was the Cisco Security Intelligence Operation which correlated a duplicate logon and killed the stolen ipad after wiping its contents.

Apart from the fact that no corporate application would allow such a password to be setup and used in the first place, I do wonder what real damage such an opportunistic thief could have done with “Kevin’s” login details.

I imagine the unauthorised user could have sent malicious emails to Kevin’s contact list, but apart from that, probably not very much?

Another analogy that was used was Kevin using his company pc to login to a twitter site on a TV program which contained malware, which was automatically prevented by Cisco’s “context aware” technology. Well, again, is that anything new? What would have happened if he had downloaded that malware onto his PC? Any antivirus package / firewall setup could / should have prevented any serious damage?

The only interesting item came from Gordon Thompson their Director of Security for Europe. He announced their plans to launch a security user license which will cover all of Cisco’s security products, thus avoiding the need for organisations to manage multiple Cisco Licenses for their different security products. This is due out in August.

I did think this would genuinely save time and hassle for IT/Security managers keeping track of different Cisco license which run out at different times of the year. It is obviously similar to Microsoft’s Enterprise or Campus license. I asked Gordon if the Cisco equivalent will include non Cisco products such as WebEx. The answers was, no. They have enough on their plate introducing a security only user license and there seems to be no plans to have a single “Cisco Client User license”, at least not yet?