The IT Nerd

From the “OMFG this is HUGE!” department comes this warning from networking gear company Cisco. In short, their gear along with other vendors gear are being attacked by state sponsored actors:

ArcaneDoor is a campaign that is the latest example of state-sponsored actors targeting perimeter network devices from multiple vendors. Coveted by these actors, perimeter network devices are the perfect intrusion point for espionage-focused campaigns. As a critical path for data into and out of the network, these devices need to be routinely and promptly patched; using up-to-date hardware and software versions and configurations; and be closely monitored from a security perspective. Gaining a foothold on these devices allows an actor to directly pivot into an organization, reroute or modify traffic and monitor network communications. In the past two years, we have seen a dramatic and sustained increase in the targeting of these devices in areas such as telecommunications providers and energy sector organizations — critical infrastructure entities that are likely strategic targets of interest for many foreign governments.  

Cisco’s position as a leading global network infrastructure vendor gives Talos’ Intelligence and Interdiction team immense visibility into the general state of network hygiene. This also gives us uniquely positioned investigative capability into attacks of this nature. Early in 2024, a vigilant customer reached out to both Cisco’s Product Security Incident Response Team (PSIRT) and Cisco Talos to discuss security concerns with their Cisco Adaptive Security Appliances (ASA). PSIRT and Talos came together to launch an investigation to assist the customer. During that investigation, which eventually included several external intelligence partners and spanned several months, we identified a previously unknown actor now tracked as UAT4356 by Talos and STORM-1849 by the Microsoft Threat Intelligence Center. This actor utilized bespoke tooling that demonstrated a clear focus on espionage and an in-depth knowledge of the devices that they targeted, hallmarks of a sophisticated state-sponsored actor. 

UAT4356 deployed two backdoors as components of this campaign, “Line Runner” and “Line Dancer,” which were used collectively to conduct malicious actions on-target, which included configuration modification, reconnaissance, network traffic capture/exfiltration and potentially lateral movement.  

The reason why this is huge is that Cisco is by far the number one vendor of networking gear. Thus it perhaps isn’t shocking that they will be the number one target for threat actors wanting to find vulnerabilities to exploit. Yes, this warning makes mention of “network devices from other vendors”, but what that means is that everyone regardless of whether they use Cisco gear or not should be very, very concerned.

Now this warning has some mitigation steps that Cisco customers and others should read:

Working with victims and intelligence partners, Cisco uncovered a sophisticated attack chain that was used to implant custom malware and execute commands across a small set of customers. While we have been unable to identify the initial attack vector, we have identified two vulnerabilities (CVE-2024-20353 and CVE-2024-20359), which we detail below. Customers are strongly advised to follow the guidance published in the security advisories discussed below.  

Further, network telemetry and information from intelligence partners indicate the actor is interested in — and potentially attacking — Microsoft Exchange servers and network devices from other vendors. Regardless of your network equipment provider, now is the time to ensure that the devices are properly patched, logging to a central, secure location, and are configured to have strong, multi-factor authentication (MFA). Additional recommendations specific to Cisco are available here.  

Thus this is a great time to patch all the things and implement some sort of MFA or paswordless authentication system to protect yourself. Because this is a today problem which requires a today solution to avoid getting pwned by whomever this threat actor is.

By Gregg Ostrowski, CTO Advisor, Cisco Observability 

These days, applications serve as the main gateway for organizations across multiple sectors. The need to deliver seamless and secure digital experiences is crucial, as businesses are aware that even the slightest mistake in application performance can have negative consequences, including a loss of customers, revenue, and reputation. 

Technologists are recognizing the need for innovative approaches and new tools to manage and optimize their applications. Many IT departments are suffering from ‘tool sprawl,’ where IT teams are using separate and siloed monitoring solutions to manage different aspects of their IT estate – including applications, network and infrastructure. 

The problem is this approach doesn’t provide unified visibility across cloud native and on-premises environments and it doesn’t enable teams to quickly identify issues and understand their root causes up and down the application path. And of course, this inability to isolate issues increases the likelihood of costly application downtime and disruption. 

This is why we’re now seeing a major shift from application performance monitoring (APM) to full-stack observability. Cisco research, found that for 85 per cent of global technologists, observability is now a strategic priority for their organization. 

The benefits of full-stack observability 

With observability, Canadian IT teams can achieve comprehensive and unified visibility into the availability, performance, and security of their applications, extending down to the core network and infrastructure levels. This allows them to monitor and manage performance in real-time, quickly pinpointing issues, mapping dependencies, and applying fixes. Metrics like Mean Time to Resolution (MTTR) improve, optimizing the digital experience, and allowing technologists to allocate less time to troubleshooting, which fosters more innovation. 

It sounds simple but the shift from APM to FSO is more complicated than just flicking a switch and implementing a single new tool overnight. It’s a journey which takes time (often two to three years for large enterprises) and involves significant technical, cultural, and structural change. The starting point for most organizations will be an existing APM approach, built around multiple monitoring tools, but every organization will take a different route to achieving observability, depending on its own specific business needs. 

Advantages of an open platform approach 

Starting out on their journey, organizations need to establish an open and adaptable platform as the foundation for building their capabilities. Consolidating tools may bring on resistance from teams accustomed to specific solutions and hesitant to accept enforced tool restrictions. However, adopting an open platform bypasses this issue by allowing integration and correlation of signals from various tools. For example, an organization might employ separate solutions for network monitoring, application monitoring, and security. All these solutions provide signals which can be aggregated and sent to an alerting system. 

If these signals are all directed to an open, centralized platform for correlation, it enables rapid root cause analysis and provides a single source of truth for issue detection and streamlining operational efficiency.  

Three milestones for organizations on the journey to observability 

While each organization will follow its own unique path to get from APM to full-stack observability, there are some key steps every organization will take (in the most appropriate order), which brings significant benefits to Canadian IT teams: 

1. Expanding visibility across domains 

Regularly, the first step for organizations is to add infrastructure visibility (such as Kubernetes and hosted environments) and network visibility into their monitoring approach. This means that rather than just focusing on the application itself, IT teams can monitor the different domains which are required to make the application function – such as network and infrastructure.  

2. Building security into the monitoring strategy 

By integrating security monitoring into their observability capabilities, organizations can ensure complete protection for applications, from development through to production, across code, containers, and Kubernetes. 

With continuous runtime application self-protection (RASP), technologists can protect applications from the inside out, wherever they live and however they are deployed. They can see what is happening inside the code to prevent known exploits and simplify vulnerability fixes. Developers can generate targeted insights into their application environments which allow them to respond to threats at scale – whether that’s in containers, on-premises, or in the cloud – and integrate security throughout the entire application lifecycle. 

Crucially, adding security into observability enables much greater collaboration between security and application teams, facilitating the shift to DevSecOps methodologies. 

3. Generating an end user view 

By implementing digital experience monitoring (DEM), organizations can start to look at application performance from the customer perspective, understanding and analyzing the experiences end users are enjoying when using an application or digital service. Functionality such as Session Replay enables IT teams to visualize how customers are behaving and engaging. Digital experience monitoring tends to be prioritized within industries which are very consumer-driven, retail but also financial services. This is where delivering an optimized digital experience is crucial. 

Canadian IT leaders must develop a holistic strategy for observability 

As organizations urgently look to expand their visibility into cloud native technologies, the shift to full-stack observability is gathering speed. IT leaders are recognizing the benefits and they’re eager to start taking full advantage. 

However, they need to take the time to ensure they have the right strategy and approach from the start, giving just as much consideration to the cultural and process changes required for success as the implementation of the observability platform itself. 

Finally, IT leaders need to understand there is never really an end to the journey to full-stack observability. As new technologies emerge, there will always be a need to add new layers of monitoring and visibility. This is why a platform approach is beneficial, with open standards enabling organizations to plug in new tools and solutions. This way, observability provides the foundation for rapid and sustainable innovation into the future.