The proper security tools can prevent infection or stop outbreaks, mitigate or reduce losses from malicious events, and even decrease legal liability. These products can also often serve as an excellent source of information about what is happening in your enterprise.

Regular review and understanding of the logs produced by these tools and services can enable you to benchmark what is normal and typical for your enterprise, which in turn provides a benchmark to spot unusual or atypical behavior that might indicate an advanced persistent threat or other intrusion.


Correlating log information across various tools and services also provides a timely “pulse” of the threat landscape, which can sometimes have interesting associations to global non-malware-related events.

Most importantly, regular review and understanding of the data can help uncover the elusive “black swan”—the types of surreptitious and malicious events that otherwise could fly below the radar.


The Cisco 4Q11 Global Threat Report released today features data from across Cisco Security Intelligence Operations. This quarter’s contributors were Cisco Intrusion Prevention System (IPS), Cisco IronPort, Cisco Security Research and Operations (SR&O), and Cisco ScanSafe.

Key highlights from the Cisco 4Q11 Global Threat Report include:

• Enterprise users experienced an average of 339 Web malware encounters per month in 4Q11
• An overall average of 362 Web malware encounters per month occurred throughout 2011
• The highest rate of encounters occurred during September and October 2011 at 698 and 697 on average per enterprise, respectively
• An average of 20,141 unique Web malware hosts were encountered per month in 2011, compared to a monthly average of 14,217 in 2010
• During 4Q11, 33 percent of Web malware encountered was zero-day malware not detectable by traditional signature-based methodologies at the time of encounter
• The rate of SQL injection signature events remained fairly steady throughout 4Q11, with a slight decrease observed as the quarter progressed
• Denial of Service events increased slightly over the course of 4Q11
• Global spam volumes continued to decline throughout 2011.