Cisco promotes virtual patching and Live Protect runtime shielding as patch-gap mitigations amid AI-driven vulnerability surge
A Cisco blog post by Jason Maynard argues that vulnerability discovery driven by frontier AI and open-weight models is outpacing defenders, and that organizations still take up to 43 days to patch. The author cites a Microsoft release on Oct 13 of 1,411 patches, including 70 critical flaws and 3 zero-days, as evidence of the patch load. Cisco presents two compensating approaches: network-layer virtual patching and Live Protect, a temporary runtime shield for Cisco devices. This is vendor product messaging, not a report of an incident or of exploitation.
Detalhes técnicos
- Virtual patching: Cisco Talos writes Snort rules that match exploit traffic. The rules sit in an Intrusion Policy on Secure Firewall, and matching packets are logged or dropped. Secure Workload can inventory running workloads and push a filtered CVE map to FMC, so Firepower Recommendations enable only the relevant signatures. It also works for third-party software and OT. Limitations stated: it only sees traffic that crosses the firewall, novel variants can evade signatures, and the vulnerable software stays on the host. SnortML is meant to catch variants for certain protocols, and TLS and QUIC proxy handle traffic that needs decryption.
- Workload controls: Secure Workload can enforce CVE-based controls directly on the workload using native capabilities. The control is removed once the workload is patched.
- Live Protect: a temporary runtime shield on the device itself, starting with NX-OS on Nexus 9000. After PSIRT discloses a vulnerability, Talos and engineering validate a small eBPF (Tetragon) policy that intercepts a specific syscall, process or file access. It is deployed from Nexus Dashboard or SD-WAN Manager, starting in monitor mode, then enforce, and is retired once the fixed image is installed. It requires no image upgrade or reboot. It targets bugs that do not appear as clean network traffic, such as local file abuse, some control-plane issues and local privilege escalation. Isovalent runtime protections can extend this to workloads such as containers.
Remediação
- Cisco states that none of these controls replaces the actual patch. They only shrink the exposure window while patches go through change control.
- Use virtual patching for systems that cannot be patched quickly, Live Protect for infrastructure devices, and workload or runtime controls for workloads, as layered defense in depth.
Linha do tempo
-
Cisco promotes virtual patching and Live Protect runtime shielding as patch-gap mitigations amid AI-driven vulnerability surge
ler a análise desta fonte ocultar
A Cisco blog post by Jason Maynard argues that vulnerability discovery driven by frontier AI and open-weight models is outpacing defenders, and that organizations still take up to 43 days to patch. The author cites a Microsoft release on Oct 13 of 1,411 patches, including 70 critical flaws and 3 zero-days, as evidence of the patch load. Cisco presents two compensating approaches: network-layer virtual patching and Live Protect, a temporary runtime shield for Cisco devices. This is vendor product messaging, not a report of an incident or of exploitation.
Technical Details
- Virtual patching: Cisco Talos writes Snort rules that match exploit traffic. The rules sit in an Intrusion Policy on Secure Firewall, and matching packets are logged or dropped. Secure Workload can inventory running workloads and push a filtered CVE map to FMC, so Firepower Recommendations enable only the relevant signatures. It also works for third-party software and OT. Limitations stated: it only sees traffic that crosses the firewall, novel variants can evade signatures, and the vulnerable software stays on the host. SnortML is meant to catch variants for certain protocols, and TLS and QUIC proxy handle traffic that needs decryption.
- Workload controls: Secure Workload can enforce CVE-based controls directly on the workload using native capabilities. The control is removed once the workload is patched.
- Live Protect: a temporary runtime shield on the device itself, starting with NX-OS on Nexus 9000. After PSIRT discloses a vulnerability, Talos and engineering validate a small eBPF (Tetragon) policy that intercepts a specific syscall, process or file access. It is deployed from Nexus Dashboard or SD-WAN Manager, starting in monitor mode, then enforce, and is retired once the fixed image is installed. It requires no image upgrade or reboot. It targets bugs that do not appear as clean network traffic, such as local file abuse, some control-plane issues and local privilege escalation. Isovalent runtime protections can extend this to workloads such as containers.
Remediation
- Cisco states that none of these controls replaces the actual patch. They only shrink the exposure window while patches go through change control.
- Use virtual patching for systems that cannot be patched quickly, Live Protect for infrastructure devices, and workload or runtime controls for workloads, as layered defense in depth.