Defending in the Post-Mythos Era

Oh. Welcome everybody to the webinar descending in the post meeting.00:00Thank you for being here. I'm Andres Vega and I have my colleague Palami Mohan here that will be presenting over the next 45 min. We have in the panelist Jared Calmos.00:17The same Hill eh so they will be there to answer all of your questions during the webinar session. So today we're going to talk about operational resiliencies for Cisco infrastructure practically through the lens of change windows.00:31Patch queues and maintenance calendars. Some of you are here for the pictures or others needs the operational, we will cover both organize around three things. You will see, you will see on the agenda or the three topics that we're going to cover in.00:51The AI area thread reality and new operating model that active actions you can take back to your team after this session. If you manage, if you manage to patch queues or approve maintenance windows, 2nd half of this session is built for you.01:11If you lead security or infrastructure program, the 1st half explains what, why the threat cloth move and why your calendar has to move with it. By the time we are done, you should have the start of one, one page run book.01:31Clear owners target dates and cannot touch segments your team can follow when an advisory lands length in the between in the day. We are required to share these slides as part of the webinar for your quick read.01:49Oh, ok, so before starting the session, let's do some quickly look into the house rules.02:06So please use the slido Q and A tab to ask any question you might have at any time during the webinar. Our experts panelists will respond to as many questions as possible. Response to unanswered questions will be posed alongside the recording of this webinar. We'll not be able to entertain life questions through the webinars, so please use the slido Q and A.02:25Okay, let's start by the agenda. So we will spend the time, we will spend our time in three topics. We will spend about 30 min. So the 1st topic is the AI threat reality. We will talk about how from here AI is changing the speed and the scale of attacks and what that means.02:45Means for disclosure to fix windows on internet facing assets. Second, we will be moving to the a new operational model.03:05It means NO reactive drills. We are talking we're gonna talk about predictables based approach. We'll walk through the customer playbook, outside in prioritization, harder than riften change when you cannot actually schedule and Cisco IQ when it supports execution on Cisco support.03:143rd active actions. Inventory what matters prioritized by business impact, close gaps, and leave with owners and days on a wrongbook you can actually execute. So let's start with the topic number one, the AI assets reality.03:34Is compressing the time from disclosure to slotation on internet facing access. That is not future planning cycle. It is already showing up in your batch queues. Over the next few slides when we make that concrete, what changed on the timeline, what operating model replace yourself.03:54To the final drills and how optimization change the sorting rules for your kill.04:10So why this matters now? Well, basically from here as this discovery is compressing disclosure to slotation on internet facing assets. That single chief is why this briefing exists. And this is not theoretical. So on the call out there's a call out on the right. Basically we.04:17Can say that Cisco has used this from here AI defensively across our own portfolio.04:37Around one point billion lines has been assessed in eight weeks, not eight years and every finding is as per review. Additional information can be found in the Cisco block eight years of security research in eight weeks.04:44Okay continue. And not long ago many teams measure urgency in months, sometimes weeks. Today the gap between disclosure and masses quotation is often shorter than a standard change window. Findings that once that below your severity threshold are in scope because the pensation goes faster than your.05:04Change calendar was designed forth. So when a piece of advisory drops on an exposed service, your calendar becomes the bottleneck. Now your awareness of the CVE, the things that is important. They are waiting on a window that dependency or an approval chain size for the slower.05:23Word. So how to respond? Here is how you respond. Prioritize reachability in the queue, not CVSSS alone. Treat any of life Cisco platform as isolate or refresh decision with a date.05:43Lean on predictable hardenings begin July July 2026 and as said some systems stay under strain while others stayed under within the business can absorb. Your constraint, your constraint is the change window. Sure by why, by what attackers can reach 1st if you.05:59The queue is sorted by severity alone reordered once by exposure. In most environments, two or three HS devices move ahead of quieter internal systems. And that pressure is exactly what the operating model has to change. So let's talk about it in our next slide.06:19So the operational model has to change because the threat clock did. That's the that's the the statement. So what yesterday looked like per CV triage patching response measuring days and a default posture of patch everything with NO real prioritization.06:41Today, today looks like hardened releases, predictable reading with advanced notice prioritization by exposure and business impact. And second when the calendar cannot absorb the fees.06:59That is the sheet from reactive drills to current space hardening your change board can be here, not a one time project. We're talking about a week a weekly meeting July 2026 is when Cisco formalized that within for hardening releases. Your job is to align change management to it, not five.07:16Notified it as a surprise work.07:36If leadership asks why clients increase, the honest answer is simple. Maintenance belongs on the calendar before the incident, not after it. The open session change will be lost in your queue.07:38So the below threshold issues are in scope. Now, you should prioritize by exposure and reachability, not by CVSS alone. That's why the queue feels heavier even when you are passion more, more findings on exposed services goes into active exploitations. While score only sorting still pushes internally.07:58A lab access to the front of the line and list border system weight. To rate that start with severity. For each candidate in the queue, ask three things. Is it reachable from the internet or a partner network? What is the last radius? Do you have a compensating control today?08:17Anything that fails those filters and sits on end of life or unsupported Cisco platform goes on a separate track when not partial for exists isolation or refresh are the honest choice. Documented with an owner and a date.08:38E.g., same day two advisories, high score or an internal print server, medium on a border firewall. Outside in with the firewall 1st that matters.08:55