Oh, ok, so we have covered or now we have some understanding why the clock moved.00:00Now let's talk about the new operation model and how to respond. So the 1st is the customer playbook framework. Then how to sequence your patch queue outside in, then what to do when the maintenance cannot land in time.00:16Of course, we're gonna talk about Cisco as a part of the picture for many customers because it is the digital front door inventory advisories visibility and remediation workflows. But we will call it where it applies. Our focus is the playbook and yours in the strategy.00:36Everything that we're going to discuss in this topic is runnable, name owners publishing writtens and cannot touch up does not require committee at 02:00 A.M. in the morning.00:57Okay, the playbook and share that things floating to the customer response through the customer playbook. At the top, you see that that change, things vulnerability, attack favorities, then the playbook itself.01:13And under the playbook, there are three pillars that you can run every quarter. Advanced modernize and referring to the hardening. We are talking here about predictable maintenance, pre stage change requests, fewer surprise emergency patches.01:31One is called notifications arrive. That is your change calendar and your piece of subscription. Modernized is retired end of life. This is about unsupported switch routers and appliance need a refresh plan or document.01:51That is often the conversation with finance when not feels build exists.02:11Elevated setment and shield when change cannot keep pace. Runtime protection reach the gaps while you're scale while you scale the permanent fields. It is not a permission to defer modernization forever. Each pillar follows access and optimize. You just need a name and owner for each.02:16It is not perfect in one quarter, and basically you just need to share the playbook PDF with the network engineering security team change management and security engineering. For teams on Cisco support, Cisco Q operationalize most of this in one place.02:35Inventory security advisories and the resilience for the AI inside the portal.02:55So for now we just need to make a differentiation. The PDF, or the wrong book is what you are going to forward to your teams and AQ is where your team sees the state and prioritize advisories day to day.03:02Okay, let's talk about how to sort the queue before you spend the next maintenance week. Reachability drives urgency, that is the discipline behind outside impreditization. Work through three lessons before you reorder the queue, exposure, impact, and blast radius. Exposure.03:19Can I attack you reach the site?03:39Rank internet facing 1st. In part, what depends on it? Business criticality drives how fast its muscle and if someone gets foothold here, what could they reach next? So this slide gives you the practitioner version for each lens ran the internet 1st eh.03:41Internet facing 1st, let critically drive urgency and before you patch the queue.04:01Yeah. The recommendation is start with compromise course fastest. It could be edge, partner facing services, expose management, VPN entry, low balancers, anything externally reachable in a desert scope notice.04:09For end of life assets get update plan, not convenience deferrals. Of course, platform for economics matters too, hundred standalone devices can mean a hundred decisions. Platform managed space let you approve weight instead of hundreds of tickets. That is how higher.04:25Batch frequency is stays survivable.04:44Many teams apply this discipline in Cisco IQ, which provides you with cisco quick security advisory insights and accept criticality insights. This, this tool correlates exposure and impact so the queue becomes a ranked action list, not hundreds of disconnect alerts.04:47Oh. Still outside in is the method. IQ is just one place to run it if you are entitled to the Cisco support. Okay, let's on topic number two. So let's talk about tools and what to do when you cannot patch.05:06You already know outside in prioritization. In the next slides we will cover why Cisco increased hardenings, how runtime shifts work on support platforms and the bridge and your needs for maintenance cannot land in time.05:28Okay, so when you cannot patch immediately, runtime defense is a breach. It is not a destination, so patch when you can, but when you cannot patch and scale 2nd, then chill, then scale the feets, then retire the chill. Put that in the runbook so on call does not invent policy under pressure.05:50On this slide you can see four mechanisms that vike time while remediation process. Which validates shields under defeats lands, EBPF runtime in the workload and traffic path, exploit shields that can be updated independently.06:11And bridge controls were remediation process. All of that points toward a patch, a durable outcome. So Cisco Life protect delivers validate runtime shields for specific vulnerabilities with NO downtown returned automatically once the permanent fix is verified.06:29For now NXOS is the support is supported today. More platforms are expanded over time. The little lines will remains comprehensive patching to hardened releases compensating controls where yet and modernization for platforms that cannot be patched.06:47Chills by calendar planning, they do not replace enough life refresh. If not on your platform yet set many aggressively and pull the feets forward. Do not do not leave exposed services without documented compensating control.07:05So why is Cisco increasing passion cuttings? The answer is because most maintenance should land on the calendar before the incident, not after it. Predictable cuttings means fixes arrive from schedule.07:22Not surprises. Starting July 2026 hardening releases are now for the 1st and 3rd Wednesday of each month with advanced notice. Also fixes are grouped by type, we call that common weakness enumeration or CW bonding and cooperation.07:42Systems will get quarterly updates on those. With that, your team can prepare the same way every time instead of treating each advisory as one of emergency. And you can see this is still published out of the cycle when action cannot wait, so it's not gonna change.08:02And currently does not need. It means most work is pre staged while emergency can break last. Again, outside in still applies for out of site for work and subscribe to notifications so you please stage before the CVE tests arrive.08:21It's important to say that Cisco IQ consolidatesert and field notice exposure against your inventory and it's your face what was already in your environment, so prioritization is faster. If you use cisco IQ confirm advisory reports match that says your queue assumes.08:42Yeah Measure the progress by exposure reduction and time protect exceptions, not the open CV count alone. So keep that in mind, please.09:02Also block the July 2026 hardening days on your change calendar this week if you haven't done. Because that single step is why increased helps operators. So before moving to the active actions or to.09:17The runbook. Let me talk about the five pillar defensive frameworks.09:37In this strategy. So these five pillar defensive frame five pillar storms a strategy into something your team runs every week. Not something on a poster on the wall. Let's start by fundamentals. We're talking here about the strong basics. Facial resistanty.09:41A zero trust least privilege including for AI agents and clear patch and assets visibility. That's the baseline so if any question is not your only control.10:01Eliminated risk by retiring enough life here and other nice platforms you cannot define forever. Automated machine speed, so automate validation and containing and containment so people are not the bottleneck when the queue change overnight and back active in active defense.10:11It means from time protection on your most exposed assess that the ones you just prioritized outside team and hardness AI for defense. Use AI for threat hunting conformance testing and validation. Same kind of speed attackers use, but use it for defense.10:30So before moving to the be sure to assign one operation owner per pillar. Just remember that five name owners beat five perfect plans on paper or in other words, a strategy without name does not protect production.10:51On automate, pick the person who will confirm Cisco queue access this week.11:09
