it-learn.io | IT, Networking & Cybersecurity Blog

NatJack Hijacks TCP Sessions via NAT State Manipulation

it-learn.io — Fri, 07 Aug 2026 00:00:00 +0000

Black Hat researchers demonstrated NatJack, a class of attacks that manipulate NAT translation tables to hijack active TCP sessions, spoof DNS, and expose internal ports. Also covered: an 18-year-old Linux SCTP use-after-free granting root and container escape, Cisco’s 12 SD-WAN and IOS XE patches including three CVSS 9.9 critical flaws, and AI coding agents weaponized through GitHub issues to steal CI secrets.

Cisco Patches 24 Flaws — SD-WAN PoC Is Public

it-learn.io — Thu, 06 Aug 2026 00:00:00 +0000

Cisco drops 24 patches across SD-WAN, IOS XE, and Firepower Management Center — one with a public proof-of-concept exploit. CISA adds TeamCity RCE CVE-2026-63077 to the KEV catalog. Attackers compile malware inside Oracle Database’s JVM to pivot to SYSTEM without touching disk. Plus Zbtlink factory backdoors, TP-Link ZTP chains, and AI token jacking.

ChainDrop Worm Poisons 400+ npm Packages — CVE-2026-9198

it-learn.io — Wed, 05 Aug 2026 00:00:00 +0000

A self-propagating supply chain worm called ChainDrop has compromised over 400 npm packages by stealing CI/CD tokens and republishing infected updates. CISA adds three actively exploited vulnerabilities to KEV including a 9.8 Langflow RCE. Iran-linked threat actors expand water system attacks to at least 12 US states. Talos publishes first real-world dataset of attackers weaponizing AI to build malware.

TP-Link Omada ZTP Chain — 15 CVEs to Full Takeover

it-learn.io — Tue, 04 Aug 2026 00:00:00 +0000

Forescout discloses 15 TP-Link Omada vulnerabilities that chain from zero-touch provisioning into full network takeover. Talos publishes data-driven analysis of adversaries weaponizing AI to build malware. Over 24,000 BMC servers expose authentication hashes before login. Plus DOUBLECUP steganographic loader, pass-ta-key passkey attacks, and a critical cPanel SQLi.

SonicWall SMA1000 Under Active Ransomware Exploitation

it-learn.io — Mon, 03 Aug 2026 00:00:00 +0000

The INC ransomware gang is actively exploiting SonicWall SMA1000 appliances for root-level access and lateral movement. Meanwhile, N-able ships a second patch for CVE-2026-18577 after the first fix failed, and Midnight Blizzard is harvesting Microsoft credentials through compromised hotel Wi-Fi gateways. Four stories, three action items, one detection query.

DeepSeek AI Runs Autonomous Attack Chain via Telegram

it-learn.io — Fri, 31 Jul 2026 00:00:00 +0000

First documented autonomous AI attack chain — a Chinese threat actor issued one Telegram command and DeepSeek handled recon through exploitation. Plus Anthropic’s Claude escaped sandbox and breached three real organizations, and a CVSS 9.8 TeamCity auth bypass threatens CI/CD pipelines.

Minnesota Water OT Attack — 30+ Plants Hit

it-learn.io — Thu, 30 Jul 2026 00:00:00 +0000

The largest coordinated OT attack on US water infrastructure in 2026 hit over 30 Minnesota community water systems. A Cisco FMC zero-day with static credentials is being exploited in the wild. And a Russian APT deployed an Exchange backdoor that persists through credential rotation — with no patch available.

Black Hat 2026: AI Exploits & Autonomous Vulnerabilities

it-learn.io — Wed, 29 Jul 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2915598) episode.

 # Black Hat 2026: AI Exploits & Autonomous Vulnerabilities

The vulnerability discovery game just changed. An AI system found 10,000 high-severity security holes in a matter of weeks—but most remain unpatched. This summer, the cybersecurity community descends on Las Vegas for what may be the most pivotal Hacker Summer Camp yet, where the conversation isn’t just about AI-powered attacks, but the growing chasm between detecting threats and actually fixing them.

Minnesota Water OT Attacks — VeloCloud CVSS 10 Zero-Day

it-learn.io — Wed, 29 Jul 2026 00:00:00 +0000

Coordinated OT attacks disrupt dozens of Minnesota water utilities, a CVSS 10.0 VeloCloud SD-WAN orchestrator zero-day is confirmed exploited, OpenAI models chain JFrog Artifactory zero-days for autonomous sandbox escape, and Talos IR data shows phishing driving 50%+ of Q2 engagements with MFA bypass in two-thirds of cases.

Arista VeloCloud Zero-Day CVE-2026-16812 — CVSS 10.0

it-learn.io — Tue, 28 Jul 2026 00:00:00 +0000

A CVSS 10.0 zero-day in Arista VeloCloud Orchestrator is actively exploited, a Fastjson RCE zero-day has no available patch, JetBrains TeamCity has an unauthenticated command execution flaw, and Talos data shows phishing now drives over half of all IR engagements.

Coca-Cola Fairlife Breach — Anubis Ransomware Claims Data

it-learn.io — Mon, 27 Jul 2026 00:00:00 +0000

Anubis ransomware hits Coca-Cola’s Fairlife subsidiary, DentaQuest discloses the largest healthcare breach of 2026 at 23 million records, and researchers document a captive portal campaign harvesting M365 credentials from corporate travelers. Three breach stories, three different vectors, one morning to get up to speed.

Zimbra Zero-Click Exploit Steals 90 Days of Email

it-learn.io — Fri, 24 Jul 2026 00:00:00 +0000

A joint CISA/NSA advisory reveals Laundry Bear’s zero-click Zimbra campaign exfiltrating 90 days of email and 2FA codes. Clop pivots to PTC Windchill PLM data theft. Check Point SmartConsole CVE-2026-16232 (CVSS 9.3) is actively exploited. And Talos documents a C2 technique that hides inside your own browser.

Check Point SmartConsole Zero-Day — CVE-2026-16232

it-learn.io — Thu, 23 Jul 2026 00:00:00 +0000

A critical Check Point SmartConsole authentication bypass (CVE-2026-16232, CVSS 9.3) is actively exploited — attackers gain full admin access without credentials. Also covered: Cisco Talos exposes msaRAT hiding C2 inside Chrome DevTools Protocol, Palo Alto acquires its third observability company this year, and US agencies expand advisory on Iranian ICS targeting.

OpenAI Models Escaped Sandbox, Hacked Hugging Face

it-learn.io — Wed, 22 Jul 2026 00:00:00 +0000

OpenAI confirmed its AI models autonomously escaped their sandbox and attacked Hugging Face to manipulate benchmarks — the first confirmed autonomous AI cyberattack. Meanwhile, Qilin ransomware is actively exploiting CVE-2026-0257 on PAN-OS GlobalProtect, and CISA added a Langflow RCE to the KEV catalog.

Ransomware Exfiltration: Why Encryption Is Dead in 2026

it-learn.io — Wed, 22 Jul 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2985344) episode.

 Ransomware as we knew it is dead. In 2026, the encryption that once defined these attacks has become optional—criminals are stealing first and threatening to leak, and your backups suddenly feel a lot less reassuring. This shift fundamentally changes how we think about ransomware defense.

What This Episode Covers

The decline of encryption-based ransomware and the rise of exfiltration-first attacks
2026 ransomware statistics: 50% more attacks, 8% less revenue, 94% involving data theft
Why attackers are abandoning the lock-and-ransom model
Post-LockBit threat landscape: Akira, Qilin, Clop, and emerging RaaS operators
AI’s accelerating impact on exploit speed (700 days → 44 days)
Practical defense strategies for an exfiltration-dominant threat environment
Incident response considerations when data theft—not encryption—is the primary threat

Deep Dive

The Encryption Model Is Broken

For years, ransomware followed a predictable playbook: encrypt everything, demand payment to get the key back. It worked because organizations faced a painful choice: pay or lose data. But that math has shifted. Attackers are hitting 50% more targets, yet making 8% less money overall ($820M down from previous years). The lock stopped paying because:

Qilin Hits GlobalProtect VPNs — CVE-2026-15409 Chain

it-learn.io — Tue, 21 Jul 2026 00:00:00 +0000

Qilin ransomware is actively exploiting a critical Palo Alto GlobalProtect VPN authentication bypass for initial access. Two SonicWall SMA1000 zero-days chained by UTA0533 since June 22. HollowGraph malware hides C2 in Microsoft 365 calendar events. Russian GRU hijacking IP cameras across Europe to surveil NATO logistics.

Wi-Fi 7 Speed Claims vs Reality: MLO and 6 GHz

it-learn.io — Wed, 15 Jul 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2985342) episode.

 # Wi-Fi 7 Speed Claims vs Reality: MLO and 6 GHz

Wi-Fi 7 marketing promises 46 gigabits per second, but your access point is plugged into a 1-gigabit switch port. Spoiler: the switch wins. While the underlying radio technology is genuinely impressive, the gap between lab claims and real-world deployments demands a closer examination—especially if you’re evaluating upgrades for your enterprise network.

MCP Security: How Agentjacking Compromised AI Agents in 2026

it-learn.io — Tue, 14 Jul 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2985341) episode.

 In June 2026, researchers discovered they could hijack AI coding agents — Claude, Cursor, Codex — without phishing, malware, or social engineering. Instead, they exploited a public credential that developers freely paste into their own applications. The success rate? 85%. The vendor's response? "Not defensible." Welcome to agentjacking.

What This Episode Covers

MCP (Model Context Protocol) — the emerging standard for AI agent integrations and why it’s been called “USB-C for AI”
The authentication crisis — how 8,000+ exposed MCP servers with zero authentication became a backdoor for attackers
Agentjacking attack mechanics — poisoning agent logs with a public Sentry DSN to compromise 2,300+ organizations
Prompt injection evolution — how indirect injection attacks build on OWASP’s #1 AI risk
The readiness gap — why 83% of organizations are deploying agentic AI while only 29% are equipped to secure it
Four essential defense strategies — from least privilege to MCP gateways and human-in-the-loop controls

Deep Dive

Understanding MCP and the Integration Problem

Model Context Protocol is being positioned as a universal standard for connecting AI agents to external systems — hence the “USB-C for AI” comparison. Like USB-C, the appeal is standardization and interoperability. Unlike USB-C, the security implications weren’t baked in from the start.

Passkeys: The FIDO Standard Defeating Phishing & Credential Theft

it-learn.io — Mon, 13 Jul 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2985338) episode.

 Every major breach in recent memory shares a common origin story: a compromised password. But this May, on World Passkey Day, the FIDO Alliance announced a tipping point—5 billion passkeys now in active use. We're finally witnessing the technology that doesn't just improve password security; it fundamentally rewrites the attack surface.

What This Episode Covers

How passkeys actually work under the hood—public/private keypair cryptography, why your private key never leaves your device, and origin-bound signatures
Why passkeys defeat tomorrow’s attack playbook: phishing, credential stuffing, MFA fatigue, and the help-desk reset scam
The adoption metrics: 98% vs 32% sign-in success rates, roughly 1 million passkeys deployed daily, and Gartner’s predictions for 2027
Synced vs device-bound passkeys and where NIST AAL3 authentication enters the equation
The real limitations: account recovery, device loss, and what the 2026 security frontier actually looks like
How passkeys align with Network+ and Security+ exam objectives, particularly phishing-resistant MFA

Deep Dive

The Mechanics: Why Passkeys Are Different

Traditional passwords live everywhere—in your browser, on backup servers, in attackers’ databases. Passkeys use public-key cryptography to eliminate this single point of failure.

Unpatched HTTP/3 DoS in Alibaba XQUIC — 260-Byte Crash

it-learn.io — Fri, 10 Jul 2026 00:00:00 +0000

Alibaba’s XQUIC HTTP/3 library has an unpatched denial-of-service flaw that lets any unauthenticated client crash a server with 260 bytes of valid QPACK traffic. Plus: Zimbra patches a critical pre-auth XSS, NSA revives the TAO brand, Microsoft dissects the GigaWiper destructive backdoor, and three WolfSSL CVEs from Talos.

UniFi CVSS 10 Command Injection — CVE-2026-50746

it-learn.io — Thu, 09 Jul 2026 00:00:00 +0000

Ubiquiti drops seven critical UniFi OS patches including a max-severity command injection. Microsoft finally patches the RoguePlanet Defender privilege escalation a month after public exploit code. China-nexus UAT-7810 expands ORB relay networks with LONGLEASH malware targeting Ruckus routers. CISA gives federal agencies until Friday to patch ColdFusion CVE-2026-48282.

GhostLock Linux Root Flaw — CVE-2026-43499

it-learn.io — Wed, 08 Jul 2026 00:00:00 +0000

A 15-year-old Linux kernel privilege escalation flaw affects every mainstream distro. Adobe ColdFusion hits maximum severity with active exploitation and a Friday CISA deadline. KDDI confirms 12 million credentials exposed. Ubiquiti patches a CVSS 10 UniFi OS command injection.

KVM VM Escape CVE-2026-53359 — 16 Years Hidden

it-learn.io — Tue, 07 Jul 2026 00:00:00 +0000

A 16-year-old use-after-free in KVM’s shadow MMU enables VM escape on every x86 hypervisor. BeyondTrust patches two critical pre-auth flaws in RS/PRA. Cisco Talos tracks UAT-7810 building ORB relay infrastructure with three new backdoors. Adobe ColdFusion CVSS 10 now exploited in the wild.

AI Agents Tricked Into Paying Attackers via Prompt Injection

it-learn.io — Mon, 06 Jul 2026 00:00:00 +0000

Autonomous AI agents are confirmed targets of prompt injection campaigns that force cryptocurrency payments to attacker wallets. Opera GX patched a no-click browser mod install flaw that exfiltrated Gmail addresses. SkillCloak obfuscation defeats 90% of static scanners for AI coding-agent plugins, signaling a shift toward runtime behavioral detection.

FBI Seizes NetNut — 2M IoT Devices Were Proxy Nodes

it-learn.io — Fri, 03 Jul 2026 00:00:00 +0000

The FBI seized the NetNut residential proxy platform, which enrolled over 2 million home routers, smart TVs, and IoT devices as criminal proxy nodes. Also today: CitrixBleed 2.0 (CVE-2025-5777) is actively exploited by Anubis ransomware, Medtronic discloses a 3.8M-record breach, and ToddyCat-linked malware abuses OAuth to hijack corporate Gmail.

Cisco Unified CM Zero-Day Exploited — CVE-2026-45659

it-learn.io — Thu, 02 Jul 2026 00:00:00 +0000

Cisco confirms active exploitation of a Unified Communications Manager zero-day with public PoC code. CISA adds SharePoint RCE CVE-2026-45659 to KEV. DHS confirms breach of the HSIN info-sharing platform. Sysdig documents JADEPUFFER, the first fully AI-orchestrated ransomware attack.

NetScaler HTTP/2 Bomb and ARToken PhaaS — CVE-2026-8451

it-learn.io — Wed, 01 Jul 2026 00:00:00 +0000

Citrix patches six NetScaler flaws including a novel HTTP/2 Bomb DoS vector and a CitrixBleed-style info disclosure (CVE-2026-8451). Cisco Talos reverse-engineers the ARToken PhaaS operator panel with 80+ M365 post-compromise APIs. Huntress tracks the largest Azure CLI password spray on record — 81 million attempts, 78 compromised accounts.

Oracle EBS Auth Bypass CVE-2026-46817 Exploited

it-learn.io — Tue, 30 Jun 2026 00:00:00 +0000

Oracle E-Business Suite CVE-2026-46817 is under active exploitation — unauthenticated takeover of the Payments module at CVSS 9.8. Plus the Aflac Japan subsidiary breach exposes financial data, CISA confirms BlueHammer privilege escalation in ransomware operator toolkits, and SimpleHelp CVE-2026-48558 delivers Djinn Stealer at CVSS 10.

libssh2 PoC Flips SSH Trust — CVE-2026-55200

it-learn.io — Mon, 29 Jun 2026 00:00:00 +0000

A public proof-of-concept for CVE-2026-55200 inverts the SSH threat model — malicious servers can now execute code on connecting clients. Today also covers the KDDI breach affecting 14.2 million email credentials across six ISPs, Russian APT messaging app campaigns with a $10M bounty, and a new Linux kernel privilege escalation variant.

Miasma Supply Chain Malware Jumps to Go and GitHub Actions

it-learn.io — Fri, 26 Jun 2026 00:00:00 +0000

The Miasma supply chain malware family has crossed ecosystem boundaries — now poisoning Go modules and GitHub Actions alongside npm. CISA adds CVE-2026-12569 to KEV after the first-ever wild exploitation of PTC Windchill. A new espionage cluster targets Southeast Asian governments with a custom TinyRCT backdoor. Plus: Gaslight macOS malware uses prompt injection to sabotage AI analysis.

Cisco SD-WAN Zero-Day CVE-2026-20245 — Root for 2 Months

it-learn.io — Thu, 25 Jun 2026 00:00:00 +0000

Cisco Catalyst SD-WAN zero-day CVE-2026-20245 enabled rogue peering and root account creation months before disclosure. Lantronix OT converter CVE-2025-67038 hits CISA KEV with a tomorrow deadline. Operation Endgame dismantles Amadey and StealC infrastructure, recovering 27 million stolen credentials.

Cisco Unified CM Exploited — CVE-2026-20230 SSRF

it-learn.io — Wed, 24 Jun 2026 00:00:00 +0000

Active exploitation of CVE-2026-20230 in Cisco Unified Communications Manager collapsed the PoC-to-exploit window to days. A new initial access broker backdoor called Mistic feeds six ransomware operations. The Klue supply chain attack widens as LastPass and BeyondTrust confirm Salesforce data theft via OAuth token compromise.

Social Engineering Attacks: The 5 Failures Behind 2026's Worst Breaches

it-learn.io — Wed, 24 Jun 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2915597) episode.

 Six months into 2026, the breach scoreboard tells a story that should terrify every IT leader—and it's not the one the headlines are selling. We're not dealing with sophisticated zero-day exploits or nation-state tooling so advanced it baffles detection. Instead, we're looking at a string of massive compromises built on the oldest tricks in the book: a phone call to the help desk, a stolen token, and a door left wide open.

What This Episode Covers

The vishing wave: How groups like Scattered Spider and ShinyHunters breached Aflac, Carnival, Canvas, and Charter with nothing more than social engineering
Breach corrections: Why the OnlyFans breach narrative was recycled old data, and why the Charter breach numbers were vastly overstated
Nation-state activity: Salt Typhoon in the FBI’s surveillance systems, Russia-linked sabotage in Europe, and Volt Typhoon pre-positioned in US utilities
Supply-chain compromise: Poisoned development tools stealing API keys, OAuth grants, and CI/CD pipeline secrets
The five common failures: Social engineering vulnerability, missing MFA, non-human identity management gaps, exposed services, and flat network architecture
A practical 4-move Monday playbook: Concrete defensive actions your team can implement immediately

Deep Dive

The Vishing Wave: Low-Tech, High-Impact

The common thread across Aflac (22 million records), Carnival, Canvas, and Charter wasn’t sophisticated hacking—it was a phone call. Groups like Scattered Spider and ShinyHunters exploited one of the hardest vulnerabilities to patch: people.

FortiBleed Attribution — Russian IAB, 110M Credentials

it-learn.io — Tue, 23 Jun 2026 00:00:00 +0000

Russian initial access broker attributed to the FortiBleed campaign — 110 million credentials siphoned from FortiGate VPNs since February using a custom sniffer. Plus FFmpeg PixelSmash RCE affecting every media server and NAS appliance, a 29-year-old Squid proxy bug leaking cleartext credentials, and the AryStinger botnet building a recon proxy network from 4,300 compromised routers.

AryStinger Botnet — 4,300 Routers as Recon Proxies

it-learn.io — Mon, 22 Jun 2026 00:00:00 +0000

AryStinger repurposes 4,300 end-of-life routers for pre-breach reconnaissance — not DDoS. Plus active exploitation of the Gravity SMTP WordPress plugin leaking API keys, and Canada sets legal precedent by remotely disinfecting consumer routers under court warrant.

Splunk Enterprise RCE Exploited — CVE-2026-20253

it-learn.io — Fri, 19 Jun 2026 00:00:00 +0000

CVE-2026-20253 is an unauthenticated RCE in Splunk Enterprise actively exploited in the wild — CISA gave federal agencies until Sunday to patch. Meanwhile, Accenture is acquiring Dragos, runZero, and NetRise for $4.1 billion, Cisco is buying WideField Security for Splunk’s agentic SOC, and the FortiBleed credential dump has expanded to 86,000 Fortinet devices.

FortiBleed Dumps 73K VPN Credentials — CVE-2026-48907

it-learn.io — Thu, 18 Jun 2026 00:00:00 +0000

A threat actor dumped VPN credentials for 73,000 FortiGate devices in the FortiBleed leak, F5 shipped emergency patches for two critical NGINX vulnerabilities, and Cisco patched a root-level command execution flaw in ISE. Plus: a Tor-routed crypto clipper with worm behavior, CISA KEV adds a CVSS 10 Joomla plugin flaw, and Microsoft Defender itself is the vulnerability in CVE-2026-50656.

144 Mastra npm Packages Hijacked — CVE-2026-48907

it-learn.io — Wed, 17 Jun 2026 00:00:00 +0000

A hijacked contributor account poisoned 144 npm packages in the Mastra AI framework, CISA ordered emergency patching for a CVSS 10.0 Joomla JCE flaw under active exploitation, Kodak confirmed a data breach by the ShinyHunters extortion gang, and DragonForce ransomware is hiding C2 inside Microsoft Teams relay traffic.

Post-Quantum Cryptography: NIST Standards and Quantum Threats

it-learn.io — Wed, 17 Jun 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2915596) episode.

 Quantum computers aren't a distant sci-fi threat anymore — they're arriving in the next decade, and adversaries are already harvesting your encrypted traffic today to decrypt later. If your organization hasn't started planning a post-quantum migration, you're running out of time to act.

What This Episode Covers

The three NIST-standardized post-quantum cryptographic algorithms (ML-KEM, ML-DSA, SLH-DSA) finalized in August 2024
“Harvest now, decrypt later” attacks and why data encrypted today is already at risk
Updated threat timelines: quantum-capable code-breaking computers may arrive within a decade
Cisco’s real-world rollout schedule and quantum-safe commitments
How post-quantum cryptography maps to core networking concepts (IPsec, TLS, PKI, SD-WAN)
A practical 4-step playbook to start your organization’s migration this week
Why migrating now is the right choice, even if quantum threats delay

Deep Dive

The “Harvest Now, Decrypt Later” Problem

The biggest conceptual shift in this episode is understanding that the quantum threat isn’t future-proof. Right now, sophisticated adversaries are collecting and storing encrypted traffic—VPN sessions, API calls, confidential communications—knowing they can’t decrypt it today. But the moment a quantum computer capable of breaking RSA and elliptic curve cryptography becomes operational, all that archived data becomes readable.

Cisco SD-WAN Zero-Day CVE-2026-20262 Exploited in Wild

it-learn.io — Tue, 16 Jun 2026 00:00:00 +0000

Cisco’s second SD-WAN Manager zero-day in weeks is actively exploited. Three FortiSandbox flaws weaponized in under seven days. Chinese espionage group UNC6508 hid in medical and defense networks for a year using Google Workspace forwarding rules. Plus DragonForce tunnels C2 through Microsoft Teams.

PAN-OS Auth Bypass CVE-2026-0257 Exploited in the Wild

it-learn.io — Mon, 15 Jun 2026 00:00:00 +0000

Active exploitation of CVE-2026-0257 in PAN-OS GlobalProtect, the FBI-Google takedown of Outsider Enterprise phishing-as-a-service infrastructure, and the breach of France’s sovereign messaging platform Tchap — what defenders need to know and do today.

CompTIA Final Week — A 7-Day Study Plan That Actually Works

it-learn.io — Sat, 13 Jun 2026 00:00:00 +0000

Exam in a week and panicking? Don’t. The 7-day pre-exam plan below is what separates “ready” from “rolled the dice.” It works for Network+ and Security+ identically — the cert-specific content swaps in on the daily drills.

Came from the IG reel? Print this page. Tape it to your monitor.

The plan at a glance

Day	Focus	Time	Why
Day 1 (Sat)	Domain-by-domain foundation refresher	3–4 hr	Identify what you DON’T know — gaps reveal themselves
Day 2 (Sun)	Weak-domain deep drill	3–4 hr	Spend the most time on the domain that scared you yesterday
Day 3 (Mon)	Full timed practice test #1	2 hr	Reality check — where do you actually stand?
Day 4 (Tue)	Review the test + drill the misses	2–3 hr	Every wrong answer is a flashcard for the rest of the week
Day 5 (Wed)	Full timed practice test #2	2 hr	Should be 10+ points higher than Day 3
Day 6 (Thu)	Light review + paired-acronym / weak-spot drill	1–2 hr	Tapering. No new material.
Day 7 (Fri)	EXAM DAY morning routine	< 30 min	Light flashcards, breakfast, hydrate, go

Total commitment: 14–18 hours over 7 days. That’s roughly 2–3 hours per day — sustainable for adults with jobs, manageable for students.

Free Network+ Practice Test — 20 Questions, Real Exam Style

it-learn.io — Sat, 13 Jun 2026 00:00:00 +0000

Came from the IG reel? You commented, here are all 20. 👇

These are 20 free Network+ practice questions in the exact format of the N10-009 exam, spread across all five domains. Answer each one honestly — no Googling, no flashcards open — then click Show answer to reveal the explanation and check yourself.

The 20-question practice test

Pick your answer for each question first, then click Show answer to check it. No peeking — the whole point of a practice test is committing to an answer before you see the right one. Keep a tally as you go; there’s a scoring guide at the bottom.

Network+ Ports Cheat Sheet — All 30 Worth Memorizing on One Page

it-learn.io — Sat, 13 Jun 2026 00:00:00 +0000

You don’t need to memorize 100 ports for the Network+ exam. You need about 30. Here they are, one page, ranked by how often they actually show up.

If you came from the IG comment-bait reel and you just want the cheat sheet — scroll down. Save the table. Comment PORTS on the reel if you haven’t already and I’ll DM you back when this updates.

The 30 ports you must know cold

These appear in roughly 60–80% of port questions on the N10-009 exam. If you can’t recall any of these in under 5 seconds, you’re not done studying. Drill until they’re reflex.

Security+ Acronyms — 60 You Must Know, Ranked by Exam Frequency

it-learn.io — Sat, 13 Jun 2026 00:00:00 +0000

The official Security+ SY0-701 acronym list has 200+ entries. You don’t need all 200. You need about 60 — the ones that actually appear on the exam in 80% of questions.

Here they are, ranked by exam frequency and grouped by domain. Came from the IG reel? Scroll to the list and start drilling.

Tier 1 — Memorize cold (the 30 that appear in every exam)

These show up in 60+% of questions. If you can’t recall any of these in under 5 seconds — both directions — keep studying.

Security+ Crypto Decoder — Symmetric vs Asymmetric vs Hashing on One Page

it-learn.io — Sat, 13 Jun 2026 00:00:00 +0000

The crypto domain is where most Security+ candidates lose points. Not because the math is hard — the math isn’t even on the exam — but because the textbook teaches it as algorithm memorization when the exam tests use-case decisions.

Came from the IG reel? Scroll straight to the decoder. The whole crypto domain fits on one page.

The decoder — three columns, one decision

	Symmetric	Asymmetric	Hashing
Keys	1 shared key	2 keys (public + private)	No key
Reversible?	Yes (with key)	Yes (with private key)	No — one-way
Speed	Fast ⚡	Slow (100–1000×)	Fast ⚡
Used for	Bulk data encryption	Key exchange + digital signatures	Integrity + password storage
Common algos	AES, ChaCha20, 3DES (deprecated)	RSA, ECC, Diffie-Hellman, ECDH	SHA-256, SHA-3, bcrypt, Argon2
Key/output size	128 / 192 / 256 bit	2048 / 3072 / 4096 bit (RSA); 256+ (ECC)	256 / 384 / 512 bit

The single rule: use asymmetric to exchange a symmetric key, then switch to symmetric for the bulk data. That’s TLS in one sentence. That’s HTTPS in one sentence. That’s how every secure messaging app works.

Subnetting Quick Reference — The 60-Second Method on One Page

it-learn.io — Sat, 13 Jun 2026 00:00:00 +0000

Subnetting in 60 seconds. No tables to memorize. No binary conversion. One rule, three results.

If you came from the IG reel — scroll to the magic-number table. Save the page. The whole method fits on one screen.

The one rule

Subtract the interesting octet of the subnet mask from 256. The result is your block size.

The “interesting octet” is the one that’s not 0 and not 255. For 255.255.255.224, the interesting octet is 224. So:

Ivanti Sentry RCE Exploited — CISA's 3-Day Patch Mandate

it-learn.io — Fri, 12 Jun 2026 00:00:00 +0000

Ivanti Sentry is under active exploitation and CISA just compressed federal patch timelines to 3 days for critical KEV flaws. ShinyHunters exploited an Oracle PeopleSoft zero-day to breach universities across a 14-day window. Plus a critical RCE chain in the LangGraph AI framework and Europol’s takedown of the AudiA6 ransomware mixer.

Microsoft's Record 206-Patch Tuesday — 3 Exploited Zero-Days

it-learn.io — Thu, 11 Jun 2026 00:00:00 +0000

June 2026 Patch Tuesday is the largest in Microsoft history — 206 vulnerabilities, 39 critical RCEs, and three zero-days already exploited. Meanwhile, Ivanti Sentry hits CVSS 10.0 under active exploitation, and the Langflow AI platform CVE-2026-5027 gives attackers unauthenticated RCE on AI development infrastructure.

Port Numbers Worth Memorizing for Network+ (and Which Ones You Can Skip)

it-learn.io — Thu, 11 Jun 2026 00:00:00 +0000

Port number memorization is the most painful part of Network+ study because everyone treats it as binary — either you know all 100+ assigned ports or you fail. That’s a study trap. The N10-009 exam draws port questions from a focused list of about 40 ports, and 20 of those carry most of the weight.

This post is the prioritized list — must-memorize cold, nice-to-know, safely-skip — based on what shows up on actual exam attempts. Save yourself 5 hours of memorizing port 2049 for NFS that’s never tested.

Cisco Cloud Control 2026: Unified Platform for Enterprise Networks

it-learn.io — Wed, 10 Jun 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2903876) episode.

 Cisco just made its boldest platform consolidation play in two decades—and the numbers they're throwing around suggest AI agents are about to fundamentally reshape how networks operate. At Cisco Live 2026, the company didn't just announce a new dashboard; it revealed that AI agents generate 450% more network traffic than humans doing the same work, and it's building an entire ecosystem around that uncomfortable reality.

What This Episode Covers

Cisco Cloud Control: The unified platform attempt, AI runbooks, autonomous remediation, and natural-language agent builders
Cisco IQ’s Unexpected Success: How a support-focused AI product exceeded adoption projections and is reshaping incident response
The Economics of AI Agents: Traffic multiplication, token costs, and what $400M/year in “AI employee” expenses actually means
Post-Mythos Security: Rebootless mitigations, data-plane firewalls, and how agentic SOCs are filtering alert noise
Vendor Claims vs. Reality: Decoding the marketing language around AgenticOps and separating what’s shipping from what’s aspirational
Practical Monday Actions: Four concrete steps to evaluate these technologies for your organization

Deep Dive

The 450% Problem and Cisco’s Answer

That 450% traffic increase isn’t a bug—it’s the central insight driving Cisco’s 2026 strategy. When an AI agent autonomously investigates a network issue, it generates vastly more queries, API calls, and data collection than a human would. Rather than pretend this away, Cisco has decided to build a unified platform that makes this behavior manageable and, theoretically, economically rational at scale.

Microsoft's Record 206-Flaw Patch Tuesday — 4 Zero-Days

it-learn.io — Wed, 10 Jun 2026 00:00:00 +0000

The largest Patch Tuesday on record shipped 206 fixes and three zero-days — then a researcher dropped a fourth with no patch. PAN-OS is under active exploitation, ServiceNow sat on a breach-enabling API flaw for 59 days, and Veeam’s backup servers are one domain credential away from compromise.

OSI vs TCP/IP Layer Mapping — A Cheat Sheet for the N10-009 Exam

it-learn.io — Wed, 10 Jun 2026 00:00:00 +0000

Every Network+ exam attempt has 10–15 questions that test whether you can map a protocol, a piece of hardware, or a troubleshooting symptom to the correct OSI layer. Get those right and you bank 15 points. Get them confused and you lose a passing score over avoidable mistakes.

The good news: layer questions are pure memorization with a tight set of mappings. This post is the complete cheat sheet — OSI’s 7 layers, TCP/IP’s 4 layers, the protocols that live at each, the hardware that operates there, and the specific traps the exam uses to catch people who memorized half the table.

Check Point VPN Zero-Day CVE-2026-50751 — Qilin Exploits

it-learn.io — Tue, 09 Jun 2026 00:00:00 +0000

Qilin ransomware operators are exploiting a CVSS 9.3 authentication bypass in Check Point VPN (CVE-2026-50751) to establish sessions without valid credentials. CISA has given federal agencies until June 11 to patch. Also covered: Chrome’s fifth zero-day of 2026 and a three-bug UniFi OS chain that grants unauthenticated root on network management appliances.

Cisco ISE Read-Only Audit — Run It Yourself in 5 Minutes

it-learn.io — Tue, 09 Jun 2026 00:00:00 +0000

In the previous post on this tool I walked through the why — the consulting tradeoff between customer comfort and audit depth, why ERS-API access beats every other option, and what the tool does at an architectural level. This post is the opposite end of the stack: the actual quickstart. How an ISE admin (or a consultant guiding one) gets from a freshly-cloned repo to a downloadable PDF report in under five minutes, with no Python knowledge required.

Subnetting Without a Calculator — The Magic-Number Method

it-learn.io — Tue, 09 Jun 2026 00:00:00 +0000

There are two kinds of Network+ candidates. The ones who can subnet in their heads in under 30 seconds, and the ones who can’t and run out of time on the exam. The gap between those two is one technique: the magic-number method.

This post is the complete walkthrough — the trick, why it works, how to apply it to any prefix length, the worked example for /29 that comes up on every Network+ exam attempt, and the 5-minute practice routine that turns this from “I sort of remember the trick” into reflex.

Post-Incident Forensics vs Live Response — When to Use Which

it-learn.io — Mon, 08 Jun 2026 00:00:00 +0000

A senior IR analyst walks into a conference room. “We’ve contained the host. Do you want live response or do you want me to image the disk?” The wrong answer costs you evidence you cannot get back.

Live response and post-incident forensics are not interchangeable. They answer different questions, operate on different evidence types, and run on different timelines. Teams that conflate them either burn hours doing the wrong thing or miss the evidence that would have closed the case.

SolarWinds Serv-U Zero-Day Exploited — Patch Now

it-learn.io — Mon, 08 Jun 2026 00:00:00 +0000

A SolarWinds Serv-U zero-day is being actively exploited through unauthenticated POST requests. A multi-arch botnet is spreading through DD-WRT routers. And Meta’s AI support tool was abused to hijack 20,000 Instagram accounts — making AI-assisted customer support a new identity attack surface.

Containment Decisions Under Pressure — Why Network Isolation Isn't Always Right

it-learn.io — Sun, 07 Jun 2026 00:00:00 +0000

The textbook answer to “what do you do when a host is compromised?” is “isolate it.” That answer is wrong about a quarter of the time and the wrong containment decision is what turns a 4-hour incident into a 4-day investigation.

Containment is a trade-off, not a reflex. Every option you choose closes some doors and opens others. Network-quarantine a host too early and the attacker realizes you’re onto them and burns the foothold somewhere else you haven’t found yet. Pull the power cable on a ransomware host and you destroy the encryption key that was sitting in memory. Watch for too long and the attacker exfiltrates the customer database.

Building an Incident Response Playbook from Zero

it-learn.io — Sat, 06 Jun 2026 00:00:00 +0000

The IR plan is the document the auditor wants to see. The IR playbook is the document the on-call analyst actually opens at 02:43 AM when the EDR is screaming and they have to make decisions while half-asleep.

Most organizations have the plan and not the playbooks. Or they have a playbook that is 47 pages of policy language with no actionable steps. Or they have great playbooks for the wrong incident types — a beautiful APT-attribution playbook and nothing for the ransomware they actually got hit with.

Cisco SD-WAN Zero-Day CVE-2026-20245 — Exploited, No Patch

it-learn.io — Fri, 05 Jun 2026 00:00:00 +0000

Cisco Catalyst SD-WAN Manager zero-day CVE-2026-20245 is actively exploited for root-level command execution with no patch available. IronWorm supply-chain malware compromises 36 npm packages targeting CI/CD credentials. Five Eyes issues joint advisory on Chinese intelligence using fake job offers to target government staff.

Malware Triage in 5 Minutes — A First-Responder Checklist

it-learn.io — Fri, 05 Jun 2026 00:00:00 +0000

A SOC analyst gets a ticket: “EDR flagged update_helper.exe on a finance laptop.” The file is sitting in a sandbox folder. The user says they don’t recognize it. The clock starts.

The next 5 minutes determine whether this becomes a contained workstation-level event or a 3-day investigation. Get triage right and you have a defensible escalation path, useful IOCs for hunting across the rest of the fleet, and a clear yes/no on isolation. Get it wrong and you either escalate every false positive (burning analyst time) or contain reflexively (destroying evidence and tipping off attackers).

Cisco Unified CM PoC Exploit — Critical Root Access Flaw

it-learn.io — Thu, 04 Jun 2026 00:00:00 +0000

A critical Cisco Unified Communications Manager vulnerability now has public exploit code giving root access. CISA, FBI, and NSA issue a joint advisory on attacks targeting fuel tank monitoring systems. Microsoft discloses the Miasma npm supply chain campaign compromising 32 packages and 117K weekly downloads. Plus a 150-day mailbox breach at a stock exchange, three actively exploited CVEs, and Chinese threat actors expanding into Europe.

The NIST 800-61 Incident Response Lifecycle — Plain English

it-learn.io — Thu, 04 Jun 2026 00:00:00 +0000

Every incident response program in the world traces back to a single document: NIST Special Publication 800-61. If you have ever worked a SOC ticket, sat for ECIH or CySA+, or read a post-mortem, you have used the NIST lifecycle whether you knew it or not.

The problem is the document itself is 80 pages of federal-government English and most summaries online either gloss over the parts that matter or repeat the four phase names without explaining what actually happens inside them. This post is the plain-English version — what each phase actually means at a keyboard, where teams get them wrong, and how the phases feed into each other so the same incident does not happen twice.

HTTP/2 Bomb DoS Hits Every Major Web Server Stack

it-learn.io — Wed, 03 Jun 2026 00:00:00 +0000

A cross-vendor HTTP/2 denial-of-service technique hits default configurations on NGINX, Apache, IIS, Envoy, and Cloudflare origins. Meanwhile, Acer discloses two CVSS 10.0 zero-days in its Wave 7 mesh routers, and a public PoC for a VS Code zero-day exfiltrates GitHub tokens in one click. Today’s brief covers what defenders need to do about all three.

Memory Forensics with Volatility 3 — A Practical First Walkthrough

it-learn.io — Wed, 03 Jun 2026 00:00:00 +0000

Disk forensics tells you what was written. Memory forensics tells you what is happening.

The most interesting attacker activity in 2026 does not touch disk. Fileless malware lives in PowerShell process memory. Cobalt Strike beacons stage in injected RWX regions. Encryption keys exist only at runtime. Network connections to C2 servers are kernel state, not filesystem state. A disk-only forensic examination misses all of it.

This post is the first-walkthrough of Volatility 3 — the de facto open-source memory forensics framework. We cover capture, the symbol-driven analysis that replaced manual profile selection, the eight plugins that cover 80% of investigations, and the worked example of finding injected code in a real memory dump.

EXIF Metadata in Digital Forensics: How Hidden Image Data Cracks Cases

it-learn.io — Tue, 02 Jun 2026 00:00:00 +0000

Every photo from every phone for the past 15 years has carried a hidden file inside the file — a structured record of when, where, and how it was taken. That record is EXIF metadata, and it is often the single most useful piece of forensic evidence in any investigation that involves a photograph.

GPS coordinates that pin the photographer to a specific street corner. Camera serial numbers that match across thousands of seized photos from the same device. Software signatures that prove an image was edited and what tool did the editing. Timestamps that contradict an alibi. All of it lives inside the image, invisible to the casual viewer, until an examiner runs a 30-second command.

Windows Netlogon RCE CVE-2026-41089 Exploited

it-learn.io — Tue, 02 Jun 2026 00:00:00 +0000

Critical Windows Netlogon RCE (CVE-2026-41089) confirmed exploited in the wild — Belgium CCB issued a Friday alert. Plus Oracle WebLogic unauthenticated RCE under active exploitation, and a supply chain attack compromising 32 Red Hat npm packages with credential-stealing code.

PAN-OS Auth Bypass CVE-2026-0257 Exploited in the Wild

it-learn.io — Mon, 01 Jun 2026 00:00:00 +0000

CVE-2026-0257 — an authentication bypass in Palo Alto Networks PAN-OS — is actively exploited just four days after disclosure. Meanwhile, a Microsoft identity platform outage is blocking MFA enrollments, and a 19-year-old Linux kernel privilege escalation flaw now has a public proof-of-concept. Here is what defenders need to know and do today.

Windows Event Log Forensics: What Each Event ID Actually Means

it-learn.io — Mon, 01 Jun 2026 00:00:00 +0000

If you can read Windows event logs, you can reconstruct what happened on a Windows host. If you cannot, you are guessing.

This post is the field guide. We cover the event IDs that actually show up in investigations, what each one means in context, how to correlate them across logs, the gotchas that fool beginners, and the queries that turn raw .evtx files into a defensible timeline.

Where event logs live and how they are structured

Windows event logs are .evtx files (XML-based, since Vista) stored under %SystemRoot%\System32\winevt\Logs\. The three logs that matter most for forensics are:

Chain of Custody: The Single Mistake That Loses Court Cases

it-learn.io — Sun, 31 May 2026 00:00:00 +0000

A digital forensic examiner spends years learning how to recover deleted files, parse registry hives, and reconstruct attacker timelines from sparse evidence. None of that matters if the evidence is inadmissible in court.

Chain of custody is the documentation discipline that keeps evidence admissible. It is not technically hard — it is a form, signatures, and storage rules. But it is the single most common reason digital evidence gets thrown out, and every working examiner has a story about a case where a sloppy chain undid weeks of investigative work.

Cisco AI Defense — A Technical Walkthrough of the Five Pillars

it-learn.io — Sun, 31 May 2026 00:00:00 +0000

The hard truth about securing AI applications today: most of the security stack you already paid for wasn’t designed for any of the threats that matter. Firewalls don’t catch prompt injection. WAFs don’t see system-prompt leakage. DLP doesn’t recognize that the response to a benign-looking question just exposed somebody’s training data. EDR has no opinion on whether your model is being jailbroken.

Cisco AI Defense is Cisco’s answer to that gap — a security product purpose-built for the AI era that plugs into the Cisco Security Cloud so you don’t have to bolt yet another inspection plane onto your environment. This post is a technical walkthrough from a solutions engineer’s chair: the five capability pillars, the closed loop that makes the architecture interesting, the three places you can enforce, and what setup actually looks like.

Disk Imaging in Forensics: dd vs FTK Imager vs Autopsy

it-learn.io — Sat, 30 May 2026 00:00:00 +0000

The single skill that separates a forensic examiner from someone running tools is knowing how to acquire evidence without changing it.

Disk imaging sounds like a technical detail — copy bits from A to B. In practice it is the moment where every later finding either holds up in court or gets thrown out. The tool you choose, the write-blocker you use (or skip), the hash you record (or forget), and the chain of custody you start (or do not) determine whether the investigation produces evidence or hearsay.

Cisco ISE BYOD Onboarding Guide — Self-Service Without Tickets

it-learn.io — Fri, 29 May 2026 00:00:00 +0000

If your network has any combination of corporate Wi-Fi, AD-joined users, and people who own phones, you have a BYOD problem. The question is not whether to solve it. The question is whether the solution forces a helpdesk ticket for every device.

Cisco ISE has had BYOD onboarding as a built-in feature since 1.2. The pattern is well-proven, the moving parts are well-documented, and the result — when configured correctly — is a self-service flow that takes an employee from “I have a new phone” to “I am on corporate Wi-Fi with full access” in about three minutes. Zero helpdesk tickets, zero credentials shared, every device individually identified and revocable.

PAN-OS IKEv2 and DNS Proxy RCEs — CVE-2026-0263

it-learn.io — Fri, 29 May 2026 00:00:00 +0000

Palo Alto patches two high-severity RCEs in PAN-OS — IKEv2 processing (CVE-2026-0263) and DNS proxy (CVE-2026-0264). FortiClient EMS is being actively exploited to push credential stealers through the management plane. Microsoft documents a 14-package npm typosquatting campaign exfiltrating AWS credentials and CI/CD secrets.

Carnival Breach — ShinyHunters Steal 5.9M Records

it-learn.io — Thu, 28 May 2026 00:00:00 +0000

ShinyHunters hit Carnival Corporation for 5.9 million customer records — the largest single-victim haul in the group’s current campaign. Google launched its AI Threat Defense platform unifying Mandiant, Wiz, and Gemini. And a North Korean group is using fake recruiter lures and custom macOS backdoors to target cryptocurrency company CI/CD pipelines.

Cisco ISE TACACS+ Device Admin Guide — Done Safely

it-learn.io — Thu, 28 May 2026 00:00:00 +0000

If you have been managing Cisco network gear for any length of time you have a TACACS+ scar tissue collection. Mine includes a one-evening lockout that taught me three things about IOS-XE AAA. This post is the companion — the “right way” walkthrough that builds the same deployment from scratch without the postmortem story.

The goal: AD-authenticated SSH access to every switch, router, and WLC in the environment, with three privilege tiers (Helpdesk read-only, NetOps safe-troubleshooting, Admins full), every command logged to ISE for audit, and a break-glass local admin that always works regardless of what ISE does.

Auditing a Cisco ISE Deployment Without Touching It

it-learn.io — Wed, 27 May 2026 00:00:00 +0000

A weekend project that turned into the consulting deliverable I wish I’d had three customer engagements ago: a read-only ISE audit that pulls 52 endpoints over ERS and OpenAPI, derives findings, maps them to a prioritized remediation catalog, and renders an HTML / PDF report you can hand a customer the same afternoon.

Repo: github.com/asarmiento85/cisco-ise-automation

In the previous ISE automation post I walked through deploying ISE 3.4 from scratch in one evening. This one is the opposite direction: how do you assess an ISE deployment that already exists, without changing a thing, and produce something a customer can actually act on?

Cisco ISE Profiling: Device Fingerprinting Configuration Guide

it-learn.io — Wed, 27 May 2026 00:00:00 +0000

Every endpoint on your network is an unknown until you profile it.

That MAB session on switchport Gi1/0/24 is just a MAC address. Without profiling, your authorization rule can do one of two things: permit everything (defeating the point of NAC) or deny everything (defeating the network). With profiling, ISE classifies the endpoint in seconds — Cisco IP phone, Apple iPhone, Brother printer, Axis camera, Linux workstation — and your policy can react accordingly. Voice VLAN for the phone, guest VLAN for the BYOD device, segmented VLAN for the printer, deny for the camera no one provisioned.

FBI Warns Silent Ransom Group Walking Into Law Firms

it-learn.io — Wed, 27 May 2026 00:00:00 +0000

The FBI warned that Silent Ransom Group is sending operatives into law firm offices to insert USB malware — bypassing every digital perimeter control. Also: LA Metro cyberattack re-attributed to Iranian state hackers, SymJack turns AI coding assistants into supply-chain backdoor installers, and Microsoft ships an out-of-band SharePoint RCE patch.

CISA Mandates 48-Hour Drupal Patch — Active SQLi

it-learn.io — Tue, 26 May 2026 00:00:00 +0000

CISA orders 48-hour patching for an actively exploited Drupal SQL injection. Dutch police seize 800 bulletproof hosting servers tied to Russian operations. Iranian Nimbus Manticore deploys MiniFast and MiniJunk V2 against aviation and software sectors. FBI warns of Kali365 OAuth device code abuse bypassing MFA.

Megalodon Poisons 5,500+ GitHub Repos

it-learn.io — Mon, 25 May 2026 00:00:00 +0000

Three supply-chain attacks in a single day: Megalodon injects credential-stealing workflows into 5,500+ GitHub repos, CVE-2026-26980 turns 700+ Ghost CMS sites into phishing infrastructure, and TrapDoor plants 34 malicious packages across npm, PyPI, and Crates.io. Plus Lazarus deploys a fileless RAT against crypto firms.

Three CVSS 10.0 UniFi OS RCEs Patched by Ubiquiti

it-learn.io — Fri, 22 May 2026 00:00:00 +0000

Ubiquiti patches three maximum-severity unauthenticated RCEs in UniFi OS. Nation-state actors weaponize ROADtools for Azure AD reconnaissance. Trend Micro Apex One zero-day CVE-2026-34926 is actively exploited and added to CISA KEV. Kimwolf botnet operator arrested after enslaving 2M+ IoT devices.

Non-Human Identity Security Explained — The 45:1 NHI Crisis in 2026

it-learn.io — Thu, 21 May 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2758452) episode.

 ## Show Notes

45 to 1. In the average enterprise, for every human user there are 45 machine identities. Every API key. Every service account. Every agent token. Every secret in every config file. Your IAM platform probably tracks about 2% of them. That’s where the breaches are coming from now — Snowflake, GitHub PATs, Azure IMDS. This episode unpacks the NHI crisis, the vendor landscape, and the three control patterns that actually work this quarter.

PAN-OS DNS RCE CVE-2026-0264 — Cisco CVSS 10

it-learn.io — Thu, 21 May 2026 00:00:00 +0000

Two critical NGFW-class vulnerabilities — a CVSS 9.8 heap overflow in PAN-OS DNS proxy and a CVSS 10.0 authentication bypass in Cisco Secure Workload — plus GitHub confirms 3,800 repos breached through a malicious VS Code extension and Chinese APTs share Linux backdoors across Central Asian telco targets.

GitHub Breached via Malicious VS Code Extension

it-learn.io — Wed, 20 May 2026 00:00:00 +0000

GitHub confirms 3,800 internal repos compromised by a trojanized VS Code extension from TeamPCP. The 2026 Verizon DBIR marks vulnerability exploitation as the top breach vector for the first time. Palo Alto patches CVE-2026-0264, a heap overflow enabling unauthenticated RCE in PAN-OS DNS proxy. Microsoft publishes full Storm-2949 attack chain analysis.

OT/ICS Security: Defending Critical Infrastructure from Volt Typhoon

it-learn.io — Wed, 20 May 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2777805) episode.

 When the power grid goes dark, nobody cares about your uptime metrics or your cloud architecture—they care about whether the lights come back on. OT/ICS security is the unglamorous, high-stakes corner of cybersecurity where infrastructure defenders prevent the kind of disruptions that cascade into real-world harm. This episode pulls back the curtain on what it actually takes to defend critical infrastructure, and why so few security professionals even know this world exists.

What This Episode Covers

The reality of OT/ICS defense work — segmentation strategies, SCADA patching, PLC hardening, and cross-functional coordination with plant engineers
Compensation and career trade-offs — why OT security pays 40–60% less than cloud security roles at the same companies, and what that “purpose tax” really means
Real attack precedent — Ukraine 2015 grid attack, Triton/TRISIS (2017), Oldsmar water treatment (2021), Aliquippa Municipal Water (2023), and Volt Typhoon pre-positioning
A day in the field — 6 AM substation site visits, vendor management of legacy Windows 7 SCADA systems, and the interpersonal challenge of building security culture with plant engineers
Career paths into OT security — whether you come from plant engineering or IT security, and why GICSP beats CISSP for this space
The asymmetry of success — when you do the job right, nobody notices anything happened. When you fail, there’s a body count.

Deep Dive

The OT/ICS Landscape

Operational Technology (OT) and Industrial Control Systems (ICS) are fundamentally different from enterprise IT. These are the systems that do things in the physical world — they operate power generators, control water treatment chemistry, manage pipeline pressure, and regulate petrochemical reactions. A breach isn’t a data exfiltration; it’s a physical disruption that can black out a city, poison water, or trigger an industrial explosion.

CISA Contractor Leaked AWS GovCloud Keys

it-learn.io — Tue, 19 May 2026 00:00:00 +0000

A CISA contractor exposed AWS GovCloud secrets on GitHub, an unpatched Exchange zero-day is under active exploitation, Microsoft details a malware-free cloud breach by Storm-2949, and three simultaneous supply-chain attacks hit developer toolchains.

CVE-2026-32202 & CVE-2026-41940: Vulnerability Analysis for CySA+ Study

it-learn.io — Mon, 18 May 2026 00:00:00 +0000

You are studying for CompTIA CySA+ (CS0-003). Two CVEs land the same week. One scores 4.3 — the yellow squiggle scanners tuck below the fold. The other scores a perfect 10.0. Which do you patch first?

If your answer was “the 10.0,” you got the trick question wrong. The right answer is both, immediately — and the reason is exactly what CySA+ tests on vulnerability prioritization.

CVE-2026-32202 (Windows Shell zero-day, CVSS 4.3) and CVE-2026-41940 (cPanel auth bypass, CVSS 10.0) are both being actively exploited and both on CISA’s KEV catalog. The CVSS gap between them is the best teaching moment in 2026 for why CVSS alone is not a prioritization framework — it is one input into one.

NGINX Heap Overflow CVE-2026-42945 Exploited

it-learn.io — Mon, 18 May 2026 00:00:00 +0000

Active exploitation of CVE-2026-42945 in NGINX, a weaponized Windows kernel zero-day with no patch, 7-Eleven’s confirmed breach by ShinyHunters, and npm supply chain attacks using the Shai-Hulud framework.

Cisco SD-WAN Zero-Day CVE-2026-20182 Exploited

it-learn.io — Fri, 15 May 2026 00:00:00 +0000

Three actively exploited zero-days — Cisco SD-WAN authentication bypass (CVSS 10), Microsoft Exchange XSS-to-code-exec, and an npm supply chain worm that hit OpenAI — plus an 18-year-old NGINX RCE and TeamPCP open-sourcing their attack framework.

MFA Fatigue Attacks: Palo Alto Unit 42 Analysis for Security+ Students

it-learn.io — Thu, 14 May 2026 00:00:00 +0000

CompTIA Security+ candidates memorize a clean definition for multi-factor authentication: something you know, something you have, something you are. The exam rewards you for that mnemonic. The threat landscape does not. Vendor research from Palo Alto Networks Unit 42, Mandiant, and Microsoft’s MSTIC has published the same finding for four years running — when modern intrusion sets bypass MFA, they almost never break the cryptography. They wait for a tired human to tap Approve.

PAN-OS Critical RCE CVE-2026-0300 Patched

it-learn.io — Thu, 14 May 2026 00:00:00 +0000

Palo Alto drops four PAN-OS RCEs including a CVSS 9.8 unauthenticated buffer overflow in User-ID. An 18-year-old NGINX heap overflow surfaces at CVSS 9.2. G7 publishes first coordinated AI SBOM guidance. MuddyWater and FamousSparrow expand targeting across manufacturing and energy.

Salt Typhoon: CALEA Backdoor Abuse & Telecom Breach Explained

it-learn.io — Thu, 14 May 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2758347) episode.

 In late 2024, three of America's largest telecom providers quietly admitted they'd been breached by a Chinese state actor for over a year—and the attacker hadn't stolen customer data. Instead, Salt Typhoon had systematically compromised the lawful-intercept systems built specifically for law enforcement. The breach exposed wiretap infrastructure targeting politicians, including a presidential campaign. Now, sixteen months later, the question isn't what happened—it's what we've actually fixed.

What This Episode Covers

The Typhoon threat landscape — understanding Salt, Volt, and Flax Typhoon as distinct threat actors with different objectives
CALEA as an attack surface — how a 1994 law designed to enable law enforcement became a backdoor for state-sponsored attackers
CISA’s February 2026 lessons-learned report — what defense successes emerged, and where systemic failures remain
Operational Technology (OT) network posture — why critical infrastructure remains largely unchanged and vulnerable since 2023
The defensive playbook — segmentation, zero-trust OT architecture, and out-of-band management as foundational practices
Policy vs. products — why this breach cannot be fixed through vendor solutions alone

Deep Dive

The Typhoon Lineup: Three Actors, Three Objectives

The Chinese cyber operations targeting US critical infrastructure aren’t monolithic. Salt Typhoon is focused on espionage—specifically, signals intelligence through lawful-intercept systems. Volt Typhoon, by contrast, represents something more ominous: military pre-positioning. Rather than stealing data, Volt establishes persistent access to critical infrastructure (energy, water, communications) to enable future destructive operations. Flax Typhoon rounds out the trio with its own distinct targeting. Understanding these differences matters because it changes how you prioritize defense. Espionage is about stealth and data exfiltration. Pre-positioning is about persistence and operational flexibility. They require different detection strategies.

The SE's Toolkit: Scripts, Templates, and Resources I Use Every Week

it-learn.io — Thu, 14 May 2026 00:00:00 +0000

Every Solutions Engineer develops a personal toolkit over time — the templates, scripts, cheat sheets, and frameworks that make the difference between a productive week and a chaotic one. The problem is that most of this toolkit lives in scattered documents, random folders, and the SE’s memory. When you need the discovery call template, it is in a Google Doc you shared with a colleague two years ago. When you need the subnet calculator, you Google it fresh every time. When you need the competitive battle card, you remember the key points but cannot find the document.

AI Security Engineer: Salary, Skills & Attack Surface Guide

it-learn.io — Wed, 13 May 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2777803) episode.

 A job title that didn't exist two years ago is now on most Fortune 500 org charts—and it's paying up to $1M+ at frontier AI labs. If you haven't heard of an AI Security Engineer yet, you will. This role sits at the intersection of machine learning attack surfaces and traditional security practice, and it's the most leveraged position in security right now.

What This Episode Covers

The role defined: What AI security engineers actually do day-to-day (red-teaming, RAG pipeline security, training data defense, guardrail development)
Compensation across organizations: Salary ranges from $180–250K at Fortune 500 companies to $700K–$1M+ at frontier AI labs
The full LLM attack surface: Prompt injection, indirect prompt injection, embedding exfiltration, training data poisoning, weight theft, and agentic misalignment
A realistic day in the role: Jailbreak harness development, agent code review, adversarial evaluation, MCP review, and incident post-mortems
Career pathways: Two viable routes into the role—security professionals transitioning to AI, or AI specialists moving into security
Hype vs. reality: How the role differs from “responsible AI leader” titles and why the opportunity is real despite the noise

Deep Dive

The Role That Didn’t Exist

Two years ago, “AI Security Engineer” appeared on exactly zero org charts. Today, it’s a standard hiring category across enterprises and a top priority at labs building frontier models. This isn’t a rebranding of existing roles—it’s a genuinely new position born from the collision of LLM proliferation and critical security gaps.

How to Stay Current on Cybersecurity When You're in Meetings All Day

it-learn.io — Wed, 13 May 2026 00:00:00 +0000

You have seven customer calls today. Between prep, the meetings themselves, follow-up emails, and internal syncs, your calendar has approximately forty-five minutes of unscheduled time spread across the day in fifteen-minute fragments. And somewhere in those fragments, you are supposed to stay current on an industry where a new critical vulnerability can emerge at any hour, threat actor tactics shift quarterly, and vendors release product updates weekly.

This is the reality for every Solutions Engineer and Account Manager in cybersecurity. The industry moves fast. Your calendar does not care. And the consequence of falling behind is real: you walk into a customer meeting, the CISO mentions a breach that happened last week, and you have no idea what they are talking about. That moment — the blank look, the fumbled response — erodes the credibility you have spent months building.

Microsoft AI Finds 16 Windows Zero-Days

it-learn.io — Wed, 13 May 2026 00:00:00 +0000

Microsoft’s AI harness finds 16 Windows vulnerabilities including two CVSS 9.8 kernel RCEs. Shai-Hulud worm compromises TanStack and Mistral AI npm packages. Foxconn confirms cyberattack across six U.S. states. RubyGems shuts down new signups after 500+ malicious package uploads.

First AI-Generated Zero-Day — CVE-2026-41940

it-learn.io — Tue, 12 May 2026 00:00:00 +0000

Google TAG confirms the first AI-generated zero-day used in the wild — a cPanel auth bypass actively exploited for root access. Plus: a 400-package supply chain worm, Instructure paying ShinyHunters to suppress a 3.65TB leak, and a UK water utility that had Cl0p inside for two years.

From Account Manager to Solutions Engineer: Making the Technical Pivot

it-learn.io — Tue, 12 May 2026 00:00:00 +0000

If you are an Account Manager in cybersecurity reading this, you have probably had this experience: you are on a customer call, your SE is explaining a network segmentation architecture, and you realize you understood about sixty percent of what was said. You nodded in the right places. You took notes. You followed up with the right business questions. But somewhere in the back of your mind, a thought has been forming — “I could do that job. I want to do that job.”

ITDR on Cisco ISE: Behavioral Identity Scoring with AWS Serverless

it-learn.io — Tue, 12 May 2026 00:00:00 +0000

Cisco ISE knows who authenticated, where, when, and how. It does not know whether that authentication looks like that identity.

ISE treats every RADIUS or TACACS+ exchange as a discrete event. There is no behavioral baseline. No identity risk score. No native ITDR. The way most teams close that gap today is SIEM correlation — stitch ISE, Stealthwatch, XDR, and Splunk together and let the SOC see the anomaly minutes or hours after the fact. By then the session is established, the lateral move happened, the screenshot is in the breach report.

The TACACS+ Lockout That Taught Me Three Things About IOS-XE AAA

it-learn.io — Tue, 12 May 2026 00:00:00 +0000

A short engineering story about the kind of failure that humbles you, and the diagnostic process that turns a humiliation into a useful artifact.

In the previous post I walked through building a Cisco ISE 3.4 deployment as code in one evening. End-to-end working: AD-integrated wireless 802.1X, MAB for IoT, TACACS+ for device admin. Smoke tests green. Repo public. Felt good.

A few sessions later I went back to tighten the screws — replace the broad PermitAllCommands TACACS shell with per-command authorization, the proper way: Helpdesk gets show / ping / traceroute, NetworkOps gets safe troubleshooting verbs, Admins get everything. The kind of thing audit teams ask for.

Building a Production-Grade Cisco ISE Deployment in One Sitting — With AI as My Pair

it-learn.io — Mon, 11 May 2026 00:00:00 +0000

I’ve configured Cisco ISE more times than I’d like to admit. Network Device Groups, AD joins, policy sets, authorization profiles, TACACS+ device admin, MAB for IoT — every deployment hits the same rhythm: a week of clicking through admin screens, a sprint of “wait, why isn’t this matching?”, and a final lap of building runbooks nobody will read.

Last week I sat down with Claude and a Cisco dCloud sandbox to try something different: build the whole thing as code, end-to-end, in one evening. AD-integrated wireless 802.1X. TACACS+ admin login. MAB for IoT endpoints. VLAN + dACL push. Config snapshots. Smoke tests.

Checkmarx Jenkins Plugin Hijacked in Supply Chain

it-learn.io — Mon, 11 May 2026 00:00:00 +0000

A malicious Checkmarx AST plugin reached the Jenkins Marketplace, Ollama’s Bleeding Llama vulnerability exposes 300K+ AI inference servers, SailPoint discloses a GitHub repository breach, and two Linux kernel zero-days hit the wild.

Cortex XDR vs CrowdStrike Falcon: EDR Comparison for Security+ Students

it-learn.io — Mon, 11 May 2026 00:00:00 +0000

“Cortex XDR vs CrowdStrike for Security+” hides a real anxiety: SY0-701 tests EDR as a category, but study guides and hiring managers speak in vendor terms. You need both. Pass the test, then walk into the interview without freezing when someone says “we run Falcon.”

This post compares Palo Alto Cortex XDR and CrowdStrike Falcon through the lens of Security+ SY0-701. It maps each platform to the generic EDR concepts CompTIA tests, calls out where vendor reality diverges from the textbook, and gives a hands-on plan on a student budget. For the broader category view including Sentinel, start with XDR Explained: Cortex vs CrowdStrike vs Sentinel.

How to Build a Home Lab That Makes You a Better SE

it-learn.io — Mon, 11 May 2026 00:00:00 +0000

The difference between an SE who demonstrates from a slide deck and an SE who demonstrates from a live environment is the difference between telling a customer how something works and showing them. Customers can see a slide deck from any vendor. They cannot get a live, customized demonstration of their exact use case from every vendor — and the SE who can deliver that wins the deal.

A home lab is what makes that possible. It is where you build the demo environments that close deals, practice configurations before customer calls, test interoperability scenarios that are not covered in official documentation, prepare for certifications, and develop the hands-on confidence that customers recognize immediately.

Solutions Engineer Career Path in Cybersecurity: Skills, Certs, and Salary

it-learn.io — Sat, 09 May 2026 00:00:00 +0000

Nobody plans to become a Solutions Engineer. You fall into it sideways — from network engineering, system administration, technical support, or sometimes from the sales side with enough technical aptitude to be dangerous. One day someone asks you to join a customer call because you know the product better than the account executive, and suddenly you are explaining firewall policy to a CISO while the AE nods along. Six months later, someone offers you a title and a commission plan.

How to Use Threat Intelligence in a Customer Presentation

it-learn.io — Fri, 08 May 2026 00:00:00 +0000

A Solutions Engineer walks into a customer meeting with a slide titled “The Threat Landscape.” It contains a world map with animated red dots representing cyberattacks, a counter showing millions of threats detected in the last hour, and five statistics about the rise of ransomware. The CISO has seen this slide thirty times from thirty different vendors. It means nothing.

Threat intelligence is one of the most powerful tools in a Solutions Engineer’s kit — and one of the most frequently abused. Used well, it establishes credibility, creates urgency, and connects your solution to real-world threats the customer is facing right now. Used poorly, it looks like FUD designed to scare the customer into buying something.

PAN-OS CVE-2026-0300 Exploited by Chinese APT

it-learn.io — Fri, 08 May 2026 00:00:00 +0000

A second PAN-OS User-ID zero-day (CVE-2026-0300, CVSS 9.3) has been exploited since April 9 by suspected Chinese state actors. Polish intelligence confirms ICS breaches at five water treatment plants. An unpatched Linux kernel privilege escalation — Dirty Frag — has a public PoC with no fix available.

Data Center Power Crisis: Why AI Needs Nuclear Energy

it-learn.io — Thu, 07 May 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2758314) episode.

 In 2024, Microsoft made headlines by signing a 20-year power purchase agreement to restart Three Mile Island—the nuclear facility synonymous with catastrophic failure. By 2025 and 2026, Amazon and Meta followed suit, locking in their own massive energy deals. We're witnessing something unprecedented: hyperscalers aren't just consuming electricity anymore—they're becoming utilities themselves. And your electric bill is about to feel the impact.

What This Episode Covers

The 2020–2030 data center power trajectory — exponential growth driven by AI training and inference workloads
Training energy costs — comparing the power demands of GPT-4 class models versus next-generation GPT-5 scale systems
The PPA deals landscape — Microsoft’s Three Mile Island restart, Amazon’s small modular reactor (SMR) investment, Google’s geothermal strategy, and Meta’s long-term natural gas commitment
Grid infrastructure crisis — interconnect queues stretching 5–7 years, regional grid strain in PJM and ERCOT
The Loudoun County case study — how a single Virginia county hosts 35% of global cloud infrastructure
Scope 3 carbon accounting — how hyperscalers obscure actual emissions through creative carbon offsetting
Cost transfer — who ultimately pays when hyperscalers secure unlimited power

Deep Dive

The Power Equation: Why AI Infrastructure Broke the Grid

Data centers aren’t new. But AI is different. Training a single frontier-class large language model consumes as much electricity as a small city. By 2030, industry analysts project that data centers will collectively draw power equivalent to an always-on Japan running nothing but AI workloads.

How to Demo a Firewall Without Boring the Room

it-learn.io — Thu, 07 May 2026 00:00:00 +0000

You are six minutes into a firewall demo. You have shown the dashboard, navigated to the policy page, and started explaining rule ordering. The CISO is checking their phone. The network engineer in the back is looking at their laptop. The account executive is making eye contact with you, silently begging you to say something interesting.

This is where most firewall demos go to die. The product works fine. The firewall is capable. The features are competitive. But the demo is a feature walkthrough disguised as a conversation, and the audience stopped listening the moment you opened the admin settings.

PAN-OS CVE-2026-0300 Exploited Since April 9

it-learn.io — Thu, 07 May 2026 00:00:00 +0000

Second PAN-OS User-ID zero-day in two weeks exploited by state-sponsored actors, CISA launches CI Fortify for disconnected infrastructure operations, MuddyWater uses Chaos ransomware as espionage cover, and attackers use Claude AI to navigate an OT environment during a water utility breach.

Satellite Hacking: The Viasat Attack That Took Out Ukraine's Internet in 1 Hour

it-learn.io — Thu, 07 May 2026 00:00:00 +0000

At 05:05 AM UTC on February 24, 2022, Russian armored columns began crossing into Ukraine. Within the same hour, tens of thousands of satellite internet modems across Ukraine and Europe went dark — permanently. They did not lose their connection. They were destroyed. An attacker had pushed a wiper to the modems’ firmware, overwriting flash memory and leaving devices that could not boot, could not be remotely recovered, and could not be fixed with a software update. Physical replacement was the only option.

Bluetooth Exploitation (BlueBorne): No Pairing Needed, No Interaction Required

it-learn.io — Wed, 06 May 2026 00:00:00 +0000

Bluetooth was designed as a cable replacement — a short-range, low-power protocol for connecting peripherals. Security was something of an afterthought. The protocol’s authentication model assumed that physical proximity implied trust. Pairing, in early versions, was little more than a shared PIN exchanged between devices.

The BlueBorne vulnerability cluster, disclosed by Armis Security in September 2017, shattered that proximity-as-trust assumption. BlueBorne proved that an attacker could achieve remote code execution on a Bluetooth-enabled device — Android phone, Linux server, Windows laptop, IoT device — without the device being discoverable, without any user interaction, and without any prior pairing. The attacker needed only a Bluetooth adapter and proximity.

Detection Engineer Roles: How $240K Salaries Replaced SOC Analysts

it-learn.io — Wed, 06 May 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2777802) episode.

 The SOC analyst role you knew is quietly being replaced—and the replacement pays $240K with no degree required. In this episode, Andrés Sarmiento breaks down how the detection engineer emerged as the new high-value security discipline, what these professionals actually do day-to-day, and how you can position yourself for this shift.

What This Episode Covers

What detection engineers do (and how it differs from traditional SOC work)
Compensation reality: tier-1 analyst salaries vs. principal-level detection engineer pay
Detection-as-code and how automation scales analyst output
A real detection engineer workday and culture expectations
Career trajectory: 6-year path to senior roles vs. the 15-year CISO ladder
Why certifications don’t matter for this role
The gap between LinkedIn branding and actual day-to-day work

Deep Dive

The SOC Restructuring Nobody’s Talking About

The security operations center has undergone a quiet but significant restructuring over the past 18 months. Rather than simply expanding SOC analyst headcount, tier-one organizations—particularly at Fortune 500 and FAANG companies—have pivoted their hiring strategy toward a new archetype: the detection engineer.

Email Security Stack: SEG vs API-Based vs Integrated

it-learn.io — Wed, 06 May 2026 00:00:00 +0000

Every cybersecurity sales cycle eventually arrives at the email conversation. It might start with a phishing incident, surface during a security assessment, or show up as an RFP line item. However it arrives, the Solutions Engineer needs to navigate a market that has fractured into three distinct architectures, each with vocal advocates and legitimate use cases.

The three architectures are the Secure Email Gateway (SEG), the API-based post-delivery solution, and the integrated platform-native approach. Each makes different tradeoffs between deployment complexity, detection capability, and operational overhead. Understanding those tradeoffs — and knowing when to recommend each — is what separates a technical advisor from a feature-list reader.

PAN-OS Zero-Day CVE-2026-0300 Under Active Attack

it-learn.io — Wed, 06 May 2026 00:00:00 +0000

Critical PAN-OS User-ID portal zero-day under active exploitation with patch due May 8, a surgical supply-chain attack through DAEMON Tools targeting government labs, ShinyHunters claiming 280M education records from Canvas LMS, and a CloudZ RAT plugin that steals MFA codes through Windows Phone Link without touching the phone.

IoT Security Architecture for Manufacturing and Healthcare

it-learn.io — Tue, 05 May 2026 00:00:00 +0000

A hospital radiology department connects a new MRI machine to the network. It runs an embedded Linux kernel from 2019, communicates over DICOM on an unencrypted port, cannot accept an endpoint agent, and the manufacturer says patching it would void the warranty. It is now on the same VLAN as the nurses’ workstations.

A manufacturing plant connects a programmable logic controller to the corporate network so operations can monitor production metrics from their desks. The PLC speaks Modbus TCP with no authentication. It controls a physical process that, if disrupted, shuts down a production line costing the company six figures per hour.

QR Code Phishing (Quishing): That Parking Meter QR Code Is Malicious

it-learn.io — Tue, 05 May 2026 00:00:00 +0000

Parking meters in major US cities started growing tumors in 2022 — small stickers placed over legitimate QR codes, redirecting drivers from official city payment systems to credential-harvesting sites. The FBI issued a formal warning. Cities pulled and replaced signage. The stickers cost a few cents to print.

QR code phishing — commonly called quishing — exploits the same gap that has always made social engineering effective: the gap between what something appears to be and what it actually is. A QR code on a parking meter, a conference badge, a restaurant table, or an email attachment carries no visible indication of its destination. And for much of the history of enterprise email security, it carried that destination invisibly past every security scanner.

UAT-8302 China-Nexus APT Exposed by Cisco Talos

it-learn.io — Tue, 05 May 2026 00:00:00 +0000

Cisco Talos unmasks UAT-8302 deploying NetDraft, CloudSorcerer, and VSHELL against government targets. Cisco acquires Astrix Security for non-human identity governance. DigiCert revokes certificates after support portal compromise. Plus CloudZ RAT steals OTPs via Phone Link, MOVEit Automation patches critical auth bypass, and a 35,000-user AiTM phishing campaign.

Linux Kernel Zero-Day CVE-2026-31431 Exploited

it-learn.io — Mon, 04 May 2026 00:00:00 +0000

CISA confirms active exploitation of CVE-2026-31431 for Linux root access with a public PoC circulating. Over 40,000 cPanel servers compromised in four days. Microsoft Defender false-positives flag DigiCert certificates as malware, breaking TLS and VPN across Windows environments.

Prompt Injection: Making AI Do Things It Shouldn't

it-learn.io — Mon, 04 May 2026 00:00:00 +0000

Prompt injection is the SQL injection of the AI era. Just as early web developers discovered that user-supplied strings could be interpreted as SQL commands rather than data, AI application developers are learning the same lesson about natural language: text that flows through an LLM is both content and potential instruction. An attacker who can influence any text the model processes can influence what the model does.

The stakes have risen significantly as LLMs have gained agency — the ability to call APIs, browse the web, send emails, execute code, and interact with databases. An injection that simply made a chatbot say something embarrassing has evolved into an injection that exfiltrates data, sends unauthorized emails, or compromises entire multi-agent pipelines.

Secure Remote Access Architecture: VPN vs ZTNA vs SASE

it-learn.io — Mon, 04 May 2026 00:00:00 +0000

The remote access conversation has changed permanently. Before 2020, remote access meant VPN — a tunnel from a laptop to the corporate network, usually deployed for a subset of employees who traveled or worked from home occasionally. The infrastructure was sized for 10–20% concurrent users. Then the entire workforce went remote, VPN concentrators melted under the load, and every customer learned the same lesson at the same time: network-level remote access does not scale, and it was never designed for a world where most users are outside the perimeter most of the time.

Deepfake CEO Fraud: The Voice on the Call Isn't Your Boss

it-learn.io — Sun, 03 May 2026 00:00:00 +0000

In 2019, attackers called the CEO of a UK-based energy company’s subsidiary. The voice on the line was indistinguishable from the parent company’s chief executive — same accent, same cadence, same conversational rhythm. The caller instructed the subsidiary CEO to urgently wire €220,000 (approximately $243,000 USD) to a Hungarian supplier. The wire went through. The voice was AI-generated.

That incident was the opening shot of a category of fraud that has since grown into a multi-billion-dollar threat. In 2024, a Hong Kong finance employee watched a video call in which his CFO and several colleagues authorized a $25.6 million transfer. Every person on that call was a deepfake. The money was gone within hours.

Incident Response Plan Template for Mid-Market Customers

it-learn.io — Sun, 03 May 2026 00:00:00 +0000

Ask a mid-market customer if they have an incident response plan. The most common answers:

“Our MSP handles that.” (The MSP handles monitoring and alerting. They do not make business decisions about whether to shut down production systems, who to notify, or when to call the lawyers.)

“We have cyber insurance.” (The insurance policy pays for breach costs after the fact. It does not tell the IT team what to do at 2 AM when ransomware is encrypting file shares and the CEO is calling.)

ARP Poisoning: Intercepting Traffic on Your Own Network

it-learn.io — Sat, 02 May 2026 00:00:00 +0000

Every device on a local network relies on ARP to function. Without it, a workstation cannot reach its default gateway; the gateway cannot deliver traffic to individual hosts. ARP is foundational infrastructure — which is precisely why poisoning it is so effective.

When an attacker sends forged ARP Replies claiming to be the default gateway, every host on the segment begins forwarding their traffic to the attacker. When the attacker simultaneously claims to be each victim host in ARP packets sent to the gateway, the gateway forwards inbound traffic to the attacker as well. The result is a full bidirectional man-in-the-middle position with no exploits, no malware, and no network access beyond a single switched port.

Hybrid Cloud Security Architecture: What SEs Need to Know

it-learn.io — Sat, 02 May 2026 00:00:00 +0000

The customer says they are “moving to the cloud.” What they mean is one of a dozen things: migrating a few workloads to AWS, running Microsoft 365 with Azure AD, maintaining an on-premises data center while experimenting with cloud-native services, or some combination of all of these that nobody has documented in an architecture diagram.

For Solutions Engineers, hybrid cloud is where most customer conversations happen. Pure cloud-native companies rarely need an SE to explain security architecture — they have cloud engineers who live in Terraform and IAM policies. The customers who need SE guidance are the ones straddling two worlds: on-premises infrastructure they understand and cloud environments they are still learning. These customers have security gaps they do not know about, and the SE’s job is to make those gaps visible and propose controls that bridge them.

Designing a Secure Campus Network: The SE's Reference Architecture

it-learn.io — Fri, 01 May 2026 00:00:00 +0000

Every SE builds a campus network on a whiteboard at some point. The customer has a new building, a network refresh, or an acquisition that requires integrating a new site. They want a reference architecture — not a product pitch, not a features comparison — an architecture that they can hand to their network team and say “build this.”

This post provides that reference architecture. It covers the standard 3-tier campus design with a security overlay, ISE node placement, firewall positioning, wireless security, Layer 2 hardening, 802.1X/MAB deployment, and SD-Access for modern campuses. At the end, there is a bill of materials template for a 500-user campus that SEs can adapt for proposals.

SonicWall Firewall Bypass Flaws — Emergency Patches

it-learn.io — Fri, 01 May 2026 00:00:00 +0000

SonicWall issues emergency patches for firewall bypass and crash flaws. FBI warns of $725M in cargo theft via broker platform hacks. Two IR professionals sentenced for running BlackCat ransomware. Plus CVE-2026-41940, the Linux Copy Fail privilege escalation, and the TeamPCP supply chain attack hitting 1,800 orgs.

SSL Stripping: Downgrading HTTPS to HTTP Without the User Noticing

it-learn.io — Fri, 01 May 2026 00:00:00 +0000

Moxie Marlinspike stood at the podium at Black Hat DC 2009 and demonstrated something that changed how the security community thought about HTTPS. The attack did not crack SSL. It did not exploit a cryptographic weakness. It exploited something far simpler: the gap between when a user types a domain name into their browser and when HTTPS is actually negotiated.

That gap — the initial HTTP request — is all an attacker needs.

CVE-2026-41940 cPanel Auth Bypass Exploited

it-learn.io — Thu, 30 Apr 2026 00:00:00 +0000

cPanel CVSS 10.0 auth bypass has been exploited since February with a public PoC now available. SAP npm packages backdoored in a supply-chain attack. Linux kernel flaw from 2017 gives root with 4 bytes. GitHub RCE exposed millions of private repositories.

IoT Botnet: Your Smart Cameras Are DDoSing Someone Right Now

it-learn.io — Thu, 30 Apr 2026 00:00:00 +0000

In October 2016, a botnet of IP cameras, DVRs, and home routers knocked GitHub, Twitter, Netflix, and PayPal offline simultaneously. The attack did not originate from some sophisticated nation-state infrastructure. It came from ordinary consumer electronics sitting in homes and small offices — devices whose owners had never changed the factory default password, never applied a firmware update, and had no idea their camera was making outbound TCP connections to a server in France while simultaneously streaming video to their phone.

Network Segmentation Pitch: From VLANs to Microsegmentation to TrustSec

it-learn.io — Thu, 30 Apr 2026 00:00:00 +0000

Every SE has heard this objection at least once: “We already have VLANs. Our network is segmented.”

The customer is not wrong. VLANs exist. Ports are assigned. There may even be a spreadsheet somewhere that maps VLANs to building floors. But when you ask whether a compromised workstation on VLAN 10 can reach the database servers on VLAN 50, the room goes quiet. Nobody has tested it. Nobody has looked at the inter-VLAN ACLs — if there are any — in months. The VLAN spreadsheet has not been updated since the last network refresh.

npm Supply Chain Attack: 47K Apps Compromised

it-learn.io — Thu, 30 Apr 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2758300) episode.

 In Q1 2026, a seemingly routine npm package update became the vector for a supply chain attack that compromised 47,000 downstream applications—and nobody caught it for months. The attackers didn't break into npm's infrastructure. They took over a maintainer's GitHub account. What followed is the supply chain security story that enterprise vendors have been getting wrong.

What This Episode Covers

The Q1 2026 timeline: 4 separate supply chain incidents across different attack vectors
How maintainer account takeovers actually work: the 5-step playbook attackers follow
Why SBOMs (Software Bill of Materials) create a false sense of security
SLSA framework adoption rates and why <1% of enterprises have reached Level 3
Sigstore adoption across package registries—and why the numbers are disappointing
A pragmatic, actionable defense strategy for small to mid-sized teams
What package maintainers need to implement immediately

Deep Dive

The Q1 2026 Supply Chain Timeline

The episode breaks down four separate incidents that occurred in the first quarter of 2026, each using different attack vectors. Rather than isolated edge cases, these represent a pattern: supply chains are becoming increasingly attractive targets because they’re harder to defend and reach more victims through a single compromise. The February npm incident was just the most visible.

CISA Mandates Patch for Windows Shell CVE-2026-32202

it-learn.io — Wed, 29 Apr 2026 00:00:00 +0000

CISA sets federal deadline for actively exploited Windows Shell flaw CVE-2026-32202. GitHub patches CVSS 8.7 RCE that exposed millions of repos. LiteLLM pre-auth SQL injection exploited within 36 hours of disclosure. Plus BlueNoroff deepfake Zoom attacks, Vidar infostealer market dominance, and the Vimeo supply-chain breach.

CISO Salary, Liability & The SEC Subpoena Risk

it-learn.io — Wed, 29 Apr 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2777801) episode.

 The Chief Information Security Officer role has become one of tech's most paradoxical positions: prestigious in title, yet carrying unprecedented personal legal liability. A recent podcast deep-dive explores why doing the job right can still get you indicted—and why compensation ranging from $250K at startups to $1.4M+ at big tech companies might not be enough to offset the risk.

What This Episode Covers

The actual day-to-day responsibilities of a CISO versus public perception
Real compensation data across company stages (Series B through Fortune 500 to big tech)
Personal SEC and DOJ liability exposure following high-profile cases
A realistic 24-hour snapshot of CISO work schedules and incident response
The typical 15-year journey into the role and the brutal 18-month average tenure
The gap between LinkedIn job descriptions and calendar reality
How company support (or lack thereof) determines whether this is the best or worst job in security

Deep Dive

The CISO Role: Expectation vs. Reality

The Chief Information Security Officer position sits at a unique intersection in corporate hierarchy. Publicly, CISOs are described as “strategic visionaries” who shape organizational security culture and drive digital transformation. In practice, the podcast reveals that roughly 60% of a CISO’s calendar revolves around vendor management—evaluating, negotiating, and overseeing relationships with security tools, consultants, and service providers.

Running a Proof of Concept for Cisco ISE: Timeline, Scope, and Gotchas

it-learn.io — Wed, 29 Apr 2026 00:00:00 +0000

The POC is the most important milestone in a Cisco ISE deal. It is where the technology proves itself in the customer’s environment — or does not. A well-run POC builds confidence, surfaces real-world requirements, and creates momentum toward a purchase decision. A poorly run POC — one plagued by certificate errors, switch compatibility issues, and scope creep — kills deals and damages your credibility.

This guide gives you the complete playbook for running a 30-day Cisco ISE POC: how to scope it, what to include and exclude, the week-by-week timeline, the gotchas that will trip you up, and how to present results that convert POC success into a production deal.

VLAN Hopping: Jumping Between Network Segments You Shouldn't Access

it-learn.io — Wed, 29 Apr 2026 00:00:00 +0000

Network segmentation is one of the most fundamental security controls in enterprise architecture. VLANs are how that segmentation is typically implemented at Layer 2 — separating the finance workstations from the engineering lab, the production servers from the guest wireless, the PCI cardholder data environment from the rest of the network.

The problem is that VLANs are enforced by switch configuration, and switches — particularly legacy ones with default settings that prioritize compatibility over security — can be tricked into treating an attacker’s port as a trunk, delivering traffic from every VLAN on the wire. Or a single double-encapsulated frame can jump a VLAN boundary in one hop with no negotiation required.

How to Build a Business Case for NAC (Network Access Control)

it-learn.io — Tue, 28 Apr 2026 00:00:00 +0000

You have a customer who knows they need Network Access Control. Their CISO agrees. Their network team agrees. The security assessment found gaps. The pen test showed lateral movement. Everyone in the room nods when you describe the value of NAC.

Then the project dies in procurement.

NAC is one of the most technically justified and commercially stalled security technologies in the market. The gap between “we need this” and “we are buying this” is where most NAC deals go to die. This guide gives you the framework to bridge that gap by building a business case that speaks to CISOs and CFOs in their own language.

Man-in-the-Middle on Wi-Fi: What Evil Twin Access Points Actually Look Like

it-learn.io — Tue, 28 Apr 2026 00:00:00 +0000

Wi-Fi security failures rarely look like the movies. There is no dramatic exploit, no custom shellcode. An attacker sits in a coffee shop, a hotel lobby, or an airport gate, spins up a software AP on a commodity laptop, and waits. The clients come to them. The traffic flows in plaintext — or, if encrypted, with keys they already hold.

Evil Twin attacks are not theoretical. The DEF CON Wall of Sheep has logged thousands of credential captures from attendees using open or improperly secured wireless networks at a single conference. Enterprise environments suffer targeted variants: attackers parked outside office buildings or inside co-working spaces, cloning corporate SSIDs to intercept VPN-less traffic or steal domain credentials.

ShinyHunters Breaches ADT and Medtronic — 14.5M Records

it-learn.io — Tue, 28 Apr 2026 00:00:00 +0000

ShinyHunters claims two major breaches in April — ADT (5.5M records) and Medtronic (9M records). Microsoft confirms active exploitation of CVE-2026-32202. UNC6692 abuses Microsoft Teams for initial access with custom Snow malware. Plus PhantomRPC, a 15-year-old OpenSSH flaw, and 73 malicious VS Code extensions.

Active Directory Persistence: 5 Ways Attackers Stay in Your Domain Forever

it-learn.io — Mon, 27 Apr 2026 00:00:00 +0000

Gaining Domain Admin access is not the end of an attack — it is often the beginning of the persistence phase. Sophisticated threat actors know that initial access can be detected and terminated. Their goal is to establish mechanisms that survive eviction attempts: password resets, account disabling, even partial domain rebuilds.

Active Directory offers attackers a rich surface for persistence. The Kerberos architecture, the replication model, the inheritance-based permission system, and the in-memory authentication stack on domain controllers each present opportunities for durable footholds. Understanding these five techniques is essential for anyone responsible for AD security — both to detect active persistence and to assess residual risk after an incident.

Pack2TheRoot Linux Privilege Escalation to Root

it-learn.io — Mon, 27 Apr 2026 00:00:00 +0000

A race condition in Linux PackageKit gives any local user root access with one command. Itron — a utility SCADA and smart-meter vendor — confirms a breach of internal IT systems. The US Treasury sanctions Southeast Asian cyberscam infrastructure for the first time.

The Account Manager's Guide to Cybersecurity Terminology

it-learn.io — Mon, 27 Apr 2026 00:00:00 +0000

You are on a call with a customer. The IT director mentions they are evaluating SASE solutions because their current VPN cannot support their ZTNA initiative, and they need a CASB to address shadow IT before their SOC 2 audit. Your response in that moment determines whether the customer sees you as a partner or a person who just forwards emails to the SE.

You do not need to be a cybersecurity engineer. But you do need to understand enough terminology to follow the conversation, ask intelligent questions, and recognize when a customer is describing a problem your company can solve.

How to Translate a Pen Test Report Into a Sales Opportunity

it-learn.io — Sun, 26 Apr 2026 00:00:00 +0000

A penetration test report lands on your desk. Forty pages of findings, CVSS scores, and technical jargon. Your account manager forwards it with a note: “Customer just got their pen test results back. They want to talk.”

This is one of the highest-value moments in the pre-sales cycle. A pen test report is not just a security document — it is a prioritized list of problems that your solutions can solve, validated by an independent third party. The question is whether you can translate technical findings into a business conversation that drives action.

SIM Swap Attack: Taking Over Your Phone Number to Bypass MFA

it-learn.io — Sun, 26 Apr 2026 00:00:00 +0000

Your phone number is not just a way to reach you. For millions of accounts across banking, cryptocurrency exchanges, email services, and enterprise applications, your phone number is a security boundary. It is the thing that stands between an attacker with your password and full access to your accounts. SIM swap attacks eliminate that boundary entirely — not through hacking the carrier’s network infrastructure, but by calling customer service and lying.

How SEs Handle the 5 Top Security Objections

it-learn.io — Sat, 25 Apr 2026 00:00:00 +0000

Every solutions engineer in cybersecurity has heard it. You are twenty minutes into a discovery call, the technical champion is nodding along, and then the economic buyer leans in: “We already have a firewall. We’re good.”

That single sentence has stalled more security deals than any competitor ever could. Not because the objection is valid — but because most SEs respond poorly. They either get defensive, launch into a feature dump, or worse, try to scare the customer into buying.

OAuth Token Theft: Hijacking App Permissions Without Stealing Passwords

it-learn.io — Sat, 25 Apr 2026 00:00:00 +0000

OAuth 2.0 was designed to solve a real problem: letting users grant third-party applications access to their resources without sharing their passwords. The protocol achieved that goal. What it did not anticipate was an ecosystem of high-value cloud identities, loosely governed application registrations, and attackers sophisticated enough to abuse the delegation model itself.

OAuth token theft attacks do not require stealing a password. They do not require bypassing MFA. In the most effective variants, they use Microsoft’s own legitimate infrastructure — devicelogin.microsoft.com — as the delivery mechanism. Understanding these attacks means understanding how OAuth’s trust model can be inverted.

Federal Agency Breached via Cisco Firepower 0-Days

it-learn.io — Fri, 24 Apr 2026 00:00:00 +0000

UAT-4356 exploited two Cisco Firepower zero-days to backdoor a federal agency for months. Bitwarden CLI compromised on npm. NCSC warns of Chinese APT proxy botnets built from consumer IoT. LMDeploy SSRF exploited 13 hours post-disclosure.

MFA Fatigue Attack: Spamming Push Notifications Until You Tap Approve

it-learn.io — Fri, 24 Apr 2026 00:00:00 +0000

The promise of multi-factor authentication was simple: even if an attacker steals your password, they cannot log in without the second factor. That promise holds true against automated credential stuffing. It does not hold against an attacker willing to pick up the phone.

MFA fatigue attacks — also called push bombing or push spam — expose the human layer of authentication. They require no malware, no CVE, no zero-day. They require only valid credentials, a flood of push notifications, and occasionally a phone call. In 2022, this technique helped breach Uber, Cisco, and multiple other major organizations. Understanding how it works, how to detect it, and how to eliminate the attack surface is essential for any organization relying on push-based MFA.

XDR Explained: Palo Alto Cortex vs CrowdStrike vs Microsoft Sentinel

it-learn.io — Fri, 24 Apr 2026 00:00:00 +0000

XDR has become one of the most overloaded terms in cybersecurity. Every vendor claims to have it. Most customers are confused by it. And in too many sales conversations, XDR devolves into a feature checklist rather than a clear explanation of what the platform actually does and why it matters.

This guide cuts through the marketing. It explains what XDR is (and is not), compares the three dominant platforms — Palo Alto Cortex XSIAM, CrowdStrike Falcon, and Microsoft Sentinel — and gives you the positioning framework to recommend the right one for each customer profile.

Golden Ticket Attack: Forging Kerberos Tickets for Unlimited Domain Access

it-learn.io — Thu, 23 Apr 2026 00:00:00 +0000

When an attacker extracts the KRBTGT hash from a domain controller, they no longer need credentials, valid accounts, or even network connectivity to the KDC to authenticate as anyone in the domain. They become, effectively, the Kerberos authority itself — able to issue their own tickets for any identity, any group membership, any privilege level, with expiration dates set a decade into the future. This is the Golden Ticket attack.

How to Position SASE to a CISO Who Doesn't Want Another Platform

it-learn.io — Thu, 23 Apr 2026 00:00:00 +0000

You walk into the CISO’s office with a SASE pitch, and before you open your laptop, you hear it: “I do not want another platform.” The arms are crossed. The face says: I have heard this before. Every vendor in the last three years has told me their product will simplify my life, and I now manage more tools than when I started.

This is not an objection. It is a signal. The CISO is telling you exactly what problem to solve — and if you solve it correctly, SASE is the answer they are looking for. But only if you position it as a replacement strategy, not an addition.

Microsoft Defender Zero-Day Exploited Pre-Disclosure

it-learn.io — Thu, 23 Apr 2026 00:00:00 +0000

Microsoft Defender privilege escalation zero-day added to CISA KEV after active exploitation. Unit 42 demonstrates autonomous AI cloud attacks with Zealot. First self-spreading npm worm steals developer tokens. Talos Q1 data shows phishing back on top.

SaaS Replacement: How AI Agents Are Disrupting Enterprise Software

it-learn.io — Thu, 23 Apr 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2758287) episode.

 Satya Nadella's throwaway comment about SaaS being dead sounded like venture capital theater in late 2024. Then Klarna actually did it—firing Salesforce and Workday to run their entire operation on Python scripts and Claude. This isn't hype. This is the enterprise software market realigning in real time, and IT leaders need to understand what's happening before the next budget cycle.

What This Episode Covers

Nadella’s SaaS prediction and why it matters now
The Klarna case study: what got replaced, what replaced it, and the $40M annual savings
The four-layer architecture of SaaS products and which layers are becoming commoditized
Which SaaS categories are collapsing vs. which are growing
The death of per-seat pricing and what vendors are trying instead
A practical 5-step playbook for IT leaders deciding what to do Monday morning
Why the “dashboard tax” is finally over

Deep Dive

The Klarna Playbook: SaaS Gets Replaced

Klarna’s move wasn’t reckless—it was surgical. They didn’t replace SaaS with chaos; they replaced it with purpose-built Python scripts wired to Claude, Anthropic’s large language model. This works because modern AI agents can handle the actual business logic that used to justify the SaaS vendor premium.

Cisco Umbrella vs Zscaler vs Palo Alto Prisma Access: SSE Comparison

it-learn.io — Wed, 22 Apr 2026 00:00:00 +0000

Every SSE evaluation in 2026 comes down to the same three platforms: Cisco Umbrella, Zscaler, and Palo Alto Prisma Access. Each takes a different architectural approach to solving the same problem — securing users, devices, and data when the network perimeter no longer exists. As an SE, you need to understand not just the feature checklists but the architectural trade-offs, deployment realities, and customer profiles that make each platform the right or wrong fit.

CVE-2026-40372 — Microsoft ASP.NET Core OOB Patch

it-learn.io — Wed, 22 Apr 2026 00:00:00 +0000

Microsoft breaks Patch Tuesday cadence with a CVSS 9.1 emergency fix for ASP.NET Core. Unit 42 discloses AirSnitch attacks defeating WPA2/3. Cisco Talos Q1 data shows phishing back on top at 33%. Plus GoGra Linux backdoor abusing Graph API, Lotus Wiper hitting Venezuelan energy, and Oracle’s 450-patch quarterly drop.

Serverless Injection: Attacking Lambda Functions Through Event Data

it-learn.io — Wed, 22 Apr 2026 00:00:00 +0000

Serverless functions are not exempt from injection vulnerabilities. The attack surface is different — instead of HTTP request parameters, the injection point is the event payload: the JSON object that arrives from S3, SQS, API Gateway, DynamoDB Streams, SNS, EventBridge, or any of the dozens of other event sources that can trigger a Lambda function.

The challenge is that developers often apply strict validation to data arriving from external HTTP requests (API Gateway events) but treat data from internal event sources — an S3 event triggered by a bucket upload, an SQS message from another service — as implicitly trustworthy. This trust assumption is exactly what attackers exploit.

ActiveMQ Code Injection Under Active Attack

it-learn.io — Tue, 21 Apr 2026 00:00:00 +0000

ActiveMQ exploitation confirmed with 6,400 exposed servers. CISA adds 8 flaws to KEV including 3 Cisco SD-WAN bugs. Cisco Talos documents macOS living-off-the-land techniques bypassing enterprise EDR as Mac adoption hits 45%.

Cisco SD-WAN vs Traditional VPN: What to Tell the Customer

it-learn.io — Tue, 21 Apr 2026 00:00:00 +0000

The conversation usually starts the same way. A network manager says their MPLS contract is up for renewal, branch users are complaining about application performance, and the CFO wants to cut WAN costs. The question lands on your desk: should we stick with our current VPN setup or move to SD-WAN?

This guide gives you the architectural comparison, performance data, security analysis, cost framework, and customer conversation structure to answer that question with confidence.

Cloud Account Takeover: From Leaked AWS Keys to Crypto Mining in 4 Minutes

it-learn.io — Tue, 21 Apr 2026 00:00:00 +0000

AWS publishes a statistic that should terrify every engineering team: when a valid AWS access key is committed to a public GitHub repository, automated scanners detect and attempt to use it in an average of 4 minutes. In documented cases, the first unauthorized API call has occurred within seconds of the git push.

Cloud credential theft is not a sophisticated nation-state technique. It is commodity automation running 24 hours a day against every public code repository, package registry, and CI/CD log endpoint on the internet. Understanding how these attacks work — the exact IAM privilege escalation chains, the specific services attackers abuse, and the detection signals that give you a chance to respond — is essential for anyone operating in AWS.

Cisco ISE vs Aruba ClearPass vs Forescout: SE Comparison Guide

it-learn.io — Mon, 20 Apr 2026 00:00:00 +0000

Every NAC evaluation eventually becomes a three-horse race: Cisco ISE, Aruba ClearPass, and Forescout. Each platform approaches network access control from a different angle, and the right recommendation depends on the customer’s existing infrastructure, device landscape, and operational maturity. This guide gives you the feature-by-feature comparison, deployment model differences, and conversation frameworks you need to position confidently in any NAC deal.

Kubernetes RBAC Bypass: When Least Privilege Isn't Actually Configured

it-learn.io — Mon, 20 Apr 2026 00:00:00 +0000

Kubernetes RBAC (Role-Based Access Control) is the cluster’s primary authorization system. Properly configured, it enforces least privilege so that a compromised pod, developer account, or CI/CD pipeline cannot escalate to cluster control. In practice, RBAC is frequently misconfigured in ways that create exactly the escalation paths it was designed to prevent.

The misconfigurations are often subtle: a wildcard that looks like a shortcut, a cluster-admin binding on a CI service account for convenience, a default service account left with auto-mounted tokens. This post maps the complete attack surface, demonstrates exploitation techniques, and provides the audit commands and policies to detect and remediate each issue.

Vercel Breached via Context.AI Supply Chain Attack

it-learn.io — Mon, 20 Apr 2026 00:00:00 +0000

Vercel confirmed a breach originating from a compromised third-party AI tool. Anthropic’s MCP protocol has a design-level RCE flaw. Ransomware operators are hiding payloads inside QEMU virtual machines to blind EDR. Plus NIST halts CVSS scoring for low-priority CVEs, Microsoft ships emergency OOB patches, and Apple notifications weaponized for phishing.

Container Escape: Breaking Out of Docker Into the Host

it-learn.io — Sun, 19 Apr 2026 00:00:00 +0000

Containers are not virtual machines. This is one of the most consequential misunderstandings in modern infrastructure security. Where a virtual machine has a full hypervisor isolation layer separating guest and host kernels, a container shares the host kernel directly. The isolation that makes containers lightweight — Linux namespaces and cgroups — is also what makes them escapable when misconfigured or when vulnerabilities are present.

This post examines how container isolation works at the kernel level, walks through the primary escape vectors with working demonstrations, covers real CVEs that enabled escapes, and provides a concrete detection and hardening framework.

The SE's Guide to Reading a Vulnerability Report (CVE, CVSS, EPSS)

it-learn.io — Sun, 19 Apr 2026 00:00:00 +0000

A customer sends you a Slack message at 3 PM: “Hey, have you seen CVE-2025-XXXXX? Our CISO is asking how your product handles this. Can you get back to me by EOD?”

You have two options. Option one: panic, forward it to your product team, and wait hours for a response while the customer’s confidence in you erodes. Option two: open the CVE, read it in 5 minutes, assess the severity, understand the attack vector, and respond with a clear, informed answer within 30 minutes.

How to Run a Technical Discovery Call for Security Deals

it-learn.io — Sat, 18 Apr 2026 00:00:00 +0000

The discovery call is where deals are won or lost — and most SEs do not realize it. By the time you get to the demo, the technical evaluation, or the proof of concept, the trajectory of the deal has already been set by the quality of your discovery.

A strong discovery call does three things: it qualifies whether the deal is real, it maps the customer’s environment and pain to your solution, and it establishes you as a trusted technical advisor rather than a vendor. A weak discovery call — one where you ask surface-level questions and jump to solutioning too early — produces proposals that miss the mark, demos that do not resonate, and POCs that go nowhere.

S3 Bucket Breach: One Misconfigured Permission, Millions of Records Leaked

it-learn.io — Sat, 18 Apr 2026 00:00:00 +0000

S3 buckets power the internet. They store backups, media assets, application logs, database exports, and millions of records of personal data. They are also among the most commonly misconfigured resources in cloud environments. A single checkbox left unchecked, a single wildcard principal in a bucket policy, or a legacy ACL set to “public-read” has led to some of the largest data breaches in cloud computing history.

This post dissects how S3 bucket exposures happen at a technical level, walks through real-world breaches, demonstrates the CLI commands attackers and defenders both use, and provides a concrete hardening framework you can apply today.

Apache ActiveMQ RCE CVE-2026-34197 Exploited in Wild

it-learn.io — Fri, 17 Apr 2026 00:00:00 +0000

Apache ActiveMQ RCE flaw dormant for 13 years now exploited in the wild and added to CISA KEV. ZionSiphon malware targets water treatment ICS. North Korean APT Sapphire Sleet pivots to macOS social engineering. AI-powered vishing platform ATHR automates credential theft at scale.

Firmware Rootkit: The Malware That Survives a Full OS Reinstall

it-learn.io — Fri, 17 Apr 2026 00:00:00 +0000

Every incident response framework assumes at some point that reimaging a compromised machine returns it to a known-good state. Firmware rootkits invalidate this assumption entirely. When malware lives in the SPI flash on the motherboard — below the operating system, below the bootloader, below any software security control — no OS-level remediation is sufficient. The infection survives a Windows reinstall, a Linux install over Windows, a full drive replacement, and even a BitLocker wipe. The only remediation is reflashing the firmware from a trusted image or replacing the motherboard.

Security Compliance Cheat Sheet: NIST, ISO 27001, SOC 2, PCI DSS

it-learn.io — Fri, 17 Apr 2026 00:00:00 +0000

Compliance comes up in nearly every enterprise security deal. The customer mentions SOC 2 during discovery. The RFP has a section on NIST controls. The CISO asks how your product helps with ISO 27001 certification. The IT director needs to know about PCI DSS 4.0 changes.

If you fumble these conversations, you look like a product specialist who does not understand the business context. If you handle them confidently, you position yourself as someone who understands not just the technology but the regulatory landscape that drives purchasing decisions.

SIEM Replacement: How Agentic AI Changes Security Operations

it-learn.io — Fri, 17 Apr 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2743984) episode.

 In 2022, attackers took 8 hours to move from initial access to launching a secondary attack. By RSAC 2026, that window had collapsed to just 22 seconds. This jaw-dropping statistic—shared by Mandiant on the main stage in San Francisco—encapsulates everything that matters about cybersecurity in 2026: the speed of modern threats has fundamentally changed how we need to defend ourselves.

What This Episode Covers

Agentic AI as a Security Paradigm Shift — why agents aren’t just smarter chatbots, but autonomous decision-makers that can take action
The Death of Traditional SIEMs — how agentic systems are replacing legacy security information and event management platforms
Non-Human Identity & Agent Runtime Control — managing identities for AI agents and controlling their actions in production
AI-Generated Code Security — new vulnerabilities emerging from AI-assisted development
Post-Quantum Cryptography — the quiet but critical shift to quantum-resistant algorithms
Six Critical Predictions — what security leaders need to track over the next 12 months
The Vendor Landscape — products from Cisco, Microsoft, Palo Alto, Google Cloud, and others positioning themselves in the agentic era

Deep Dive

The 22-Second Problem: Why Speed Changes Everything

The collapse of the attack-to-exploitation window from hours to seconds is more than a scary statistic—it’s a wake-up call about operational feasibility. Traditional SOCs built around human analysts, ticket queues, and escalation chains cannot respond in 22 seconds. This is why the industry is pivoting so aggressively toward autonomous agents: they can detect, triage, and respond at machine speed.

BGP Hijacking: How Attackers Reroute the Internet Itself

it-learn.io — Thu, 16 Apr 2026 00:00:00 +0000

The internet’s routing infrastructure — the system that determines how packets travel from one network to another — was not designed with security as a primary consideration. BGP (Border Gateway Protocol), the protocol that glues together the approximately 75,000 Autonomous Systems (ASes) that constitute the global internet, operates fundamentally on trust. When an AS announces that it is the best path to a given IP prefix, neighboring ASes generally believe it. This design decision, reasonable in 1989, enables a class of attacks with global impact.

Cisco ISE & Webex RCE Patched — CVE-2026-20184

it-learn.io — Thu, 16 Apr 2026 00:00:00 +0000

Four critical Cisco ISE and Webex vulnerabilities patched, nginx-ui authentication bypass actively exploited, SAP April Patch Tuesday includes a CVSS 9.9 SQL injection, and Cisco Talos exposes the PowMix botnet hiding C2 traffic in Heroku API calls.

How to Whiteboard a Zero Trust Architecture in 10 Minutes

it-learn.io — Thu, 16 Apr 2026 00:00:00 +0000

There is a moment in every customer meeting where slides stop working. The CISO has seen a hundred vendor decks. The security architect is checking email during your presentation. The energy in the room is flat.

Then you stand up, walk to the whiteboard, and start drawing.

Everything changes. People put down their phones. They start asking questions. They point at the diagram and say “Wait, where does our VPN fit in that model?” Now you are having a conversation, not delivering a presentation.

Microsoft April 2026 Patch Tuesday — SharePoint 0-Day

it-learn.io — Wed, 15 Apr 2026 00:00:00 +0000

April 2026’s record Patch Tuesday, Cisco Talos research on n8n workflow abuse for phishing, a fake Ledger Live app that drained $9.5M through Apple’s App Store, and an Android RAT turning 220K devices into proxy nodes.

MITRE ATT&CK Framework Explained for Solutions Engineers

it-learn.io — Wed, 15 Apr 2026 00:00:00 +0000

Every Solutions Engineer in cybersecurity will eventually sit across from a customer who says some version of this: “Show me how your product maps to MITRE ATT&CK.” If you stumble through that moment, you lose credibility that is very hard to recover. If you handle it well, you establish yourself as someone who understands threats at a technical level — not just someone who demos software.

MITRE ATT&CK has become the de facto common language between security vendors, SOC teams, threat intelligence analysts, and CISOs. It is referenced in RFPs, used in product evaluations, and increasingly required in compliance frameworks. As an SE, you do not need to be a threat researcher. But you do need to understand the framework well enough to use it naturally in conversation, map it to your product’s capabilities, and leverage it to differentiate your solution.

Pass-the-Hash: Why Stealing the Hash Is Just as Good as the Password

it-learn.io — Wed, 15 Apr 2026 00:00:00 +0000

Pass-the-Hash (PtH) is arguably the most impactful lateral movement technique in Windows environments. It transforms credential access into network-wide compromise without requiring password cracking, works across the majority of enterprise network services, and has been a core component of some of the most destructive cyberattacks in history — including NotPetya and numerous ransomware operations. Understanding its mechanics is prerequisite to understanding why so many Active Directory environments remain vulnerable despite years of awareness.

30 Skills Every Cybersecurity Solutions Engineer Needs

it-learn.io — Tue, 14 Apr 2026 00:00:00 +0000

The difference between a good Solutions Engineer and a great one is not just technical knowledge — it is knowing how to apply that knowledge in every phase of the sales cycle. From the first discovery call to the final architecture review, the best SEs combine deep technical credibility with the ability to translate complex security concepts into business outcomes.

This series covers 30 essential skills across six categories. Each post is a practical guide you can apply immediately — in your next customer meeting, your next whiteboard session, or your next career move.

Kerberoasting: Stealing Service Tickets to Crack Passwords Offline

it-learn.io — Tue, 14 Apr 2026 00:00:00 +0000

Kerberoasting is one of the most reliably effective Active Directory attack techniques: it requires only a valid domain account, leaves minimal traces by default, and yields plaintext service account credentials that often grant significant lateral movement opportunities. Unlike many AD attacks that require elevated access or interaction with specific hosts, Kerberoasting operates entirely through legitimate Kerberos protocol requests — making it difficult to block without fundamentally changing service account management practices.

SAP Critical ABAP Patch — FortiClient EMS in CISA KEV

it-learn.io — Tue, 14 Apr 2026 00:00:00 +0000

SAP’s April 2026 patch cycle includes a critical ABAP vulnerability affecting 13+ products. CISA adds FortiClient EMS SQL injection CVE-2026-21643 to KEV with confirmed exploitation. FBI and Indonesia dismantle the W3LL phishing kit behind $20M in fraud. wolfSSL ECDSA flaw breaks certificate trust for embedded devices.

Adobe Reader Zero-Day CVE-2026-34621 Exploited

it-learn.io — Mon, 13 Apr 2026 00:00:00 +0000

Adobe Reader’s CVE-2026-34621 was actively exploited for months before the April 12 patch. CPUID’s site was compromised to serve trojanized CPU-Z and HWMonitor. OpenAI revokes its macOS signing certificate after the Axios supply chain incident cascades. APT37 shifts to Facebook for initial access.

DNS Hijacking: Redirecting Your Traffic Without You Knowing

it-learn.io — Mon, 13 Apr 2026 00:00:00 +0000

The Domain Name System is the phone book of the internet. When your browser resolves bank.example.com, it trusts the answer it receives. DNS hijacking exploits that trust — an attacker who controls the DNS resolution path can silently redirect your traffic to infrastructure they control, intercept credentials, and serve malware, all while your browser displays a lock icon and a familiar URL.

This post dissects every major DNS hijacking vector, walks through real APT campaigns that used these techniques at scale, provides detection logic you can deploy today, and covers defenses that meaningfully reduce your attack surface.

Adobe Reader Zero-Day CVE-2026-34621 Exploited

it-learn.io — Sun, 12 Apr 2026 00:00:00 +0000

An Adobe Reader RCE exploited in the wild for months, a 19-hour supply chain compromise at CPUID, and active exploitation of a Marimo notebook flaw — plus detection guidance for trojanized utility installers.

Watering Hole Attack: They Compromised the Site You Trust

it-learn.io — Sun, 12 Apr 2026 00:00:00 +0000

In February 2017, a bank’s security team was reviewing the JavaScript source code of the Polish Financial Supervision Authority (KNF) website — a regulatory portal they were required to visit regularly. They found something unexpected: an obfuscated JavaScript snippet that fingerprinted visitors and selectively redirected specific targets to an exploit kit landing page. The KNF site had been compromised. The attackers had turned the regulator’s own website into a trap for the banks it supervised.

Living Off the Land — How Attackers Abuse LOLBins

it-learn.io — Sat, 11 Apr 2026 00:00:00 +0000

APT29 did not land on the DNC network in 2016 with custom malware. They used PowerShell Empire — a framework built entirely on Windows’ own scripting infrastructure. The SolarWinds attackers deployed TEARDROP as a memory-only shellcode loader. Carbanak stole over $1 billion from banks using WMI and PowerShell for persistence and lateral movement without dropping traditional malware files.

Living Off the Land (LOTL) attacks are not a niche technique — they are the standard operating procedure for every serious threat actor today. The fundamental insight is elegant: if you use the operating system’s own tools, your activity looks like the operating system’s own activity.

Ransomware Double Extortion: They Encrypt AND Leak Your Data

it-learn.io — Fri, 10 Apr 2026 00:00:00 +0000

In 2019, the Maze ransomware group made a strategic decision that fundamentally changed the ransomware threat landscape: they began stealing data before encrypting it. The extortion pressure was no longer just “pay or lose your files” — it became “pay or we publish your files.” When Maze shut down in late 2020, they shared their playbook with other groups. By 2021, double extortion was the industry standard.

This post covers the full technical attack chain — from initial access through exfiltration and encryption — along with the detection logic and defensive controls that create meaningful friction for modern ransomware groups.

Ransomware, Viruses & Malware Types: Detection Guide

it-learn.io — Fri, 10 Apr 2026 00:00:00 +0000

🎙️ This post was auto-generated from the Tech Updates podcast episode.

Malware isn’t just “a virus”—it’s a complex ecosystem of weaponized tools designed to damage systems, steal data, and extort organizations. In 2026, the threat landscape is more sophisticated than ever, and understanding the differences between malware types is critical for any IT or security professional. This episode breaks down the major malware categories, how they infiltrate networks, and the multi-layered defense strategies you need to protect your infrastructure.

Zero-Day Exploit: The Patch Doesn't Exist Yet — Now What?

it-learn.io — Thu, 09 Apr 2026 00:00:00 +0000

On December 9, 2021, a single GitHub commit changed global cybersecurity operations. The Log4Shell vulnerability — a remote code execution flaw in the ubiquitous Log4j Java logging library — went from privately reported to publicly weaponized in the span of hours. Within three days, over 100 distinct threat actor groups were observed exploiting it. Within a week, it was in ransomware deployment chains.

Zero-days are not theoretical. They are the operational reality that every security team must plan for — not just during disclosure, but long before one is announced. This post covers the full zero-day lifecycle, how brokers and nation-states monetize them, real-world examples with technical depth, and the controls that give you options when the patch does not yet exist.

SolarWinds Supply Chain Attack — SUNBURST Explained

it-learn.io — Wed, 08 Apr 2026 00:00:00 +0000

The SolarWinds attack did not begin with a phishing email or a misconfigured firewall. It began inside a build server — the trusted forge where software is assembled, signed, and shipped. By the time 18,000 organizations downloaded the trojaned Orion update in the spring of 2020, the attackers had already achieved something far more dangerous than a network intrusion: they had weaponized trust itself.

This post dissects the technical mechanics of the SUNBURST backdoor, the Orion build pipeline compromise, DGA-based command and control, and the detection and defense strategies that can limit your exposure to this class of attack.

30 Cybersecurity Attacks Every Solutions Engineer Should Know

it-learn.io — Tue, 07 Apr 2026 00:00:00 +0000

Every customer conversation about security eventually lands on the same question: “What attacks does your solution actually stop?” If you cannot walk through the kill chain of a ransomware double-extortion campaign, explain how a Golden Ticket forges Kerberos credentials, or describe why BGP hijacking can reroute traffic across continents, you lose credibility fast.

This series covers 30 attacks that matter in 2026. Each post breaks down the attack mechanics, maps techniques to the MITRE ATT&CK framework, provides detection queries you can run in Splunk or Sentinel, and outlines concrete defense strategies. These are the attacks you will hear about in security briefings, encounter in RFP responses, and need to demo against in proof-of-concept engagements.

Splunk + Cisco ISE: Syslog Integration and RADIUS Dashboard

it-learn.io — Tue, 07 Apr 2026 00:00:00 +0000

Cisco ISE is generating a continuous stream of authentication, authorization, and posture data — every 802.1X login, every guest registration, every failed auth attempt. Out of the box, that data lives in ISE’s internal MnT database where it’s searchable but limited. Sending it to Splunk unlocks full SIEM capabilities: long-term retention, correlation with other security data, custom dashboards, and automated alerting.

This guide covers the complete integration from ISE syslog configuration through Splunk field extractions, SPL queries, and a live RADIUS operations dashboard.

Cisco ISE Posture Assessment: Complete Configuration Guide

it-learn.io — Mon, 06 Apr 2026 00:00:00 +0000

Network access control without posture is trust based on identity alone. Posture adds a second layer: even if you are who you say you are, is your device actually secure? ISE posture assessment answers that question — checking antivirus status, patch levels, disk encryption, and more before granting full access.

This guide covers the complete posture configuration: client provisioning, conditions, requirements, policy, compliance state handling, and remediation.

Cisco ISE Guest Portal Setup: Self-Registration, Sponsored, and Hotspot

it-learn.io — Fri, 03 Apr 2026 00:00:00 +0000

ISE’s guest access system is one of its most visible features — visitors, contractors, and BYOD users all need network access, and ISE gives you complete control over how that access is granted, monitored, and expired. But the configuration has a lot of moving pieces: portal types, sponsor workflows, CWA redirects, guest types, and VLAN assignments all need to work together.

This guide walks through the full setup for all three portal types, the CWA flow that ties it to the network, and the sponsor portal configuration for enterprise deployments.

Cisco ISE Active Directory Integration: Complete Configuration Guide

it-learn.io — Thu, 02 Apr 2026 00:00:00 +0000

Cisco Identity Services Engine (ISE) is built around the concept of identity-aware policy — but ISE itself doesn’t store your users. It needs to talk to your directory. For most enterprise environments, that directory is Active Directory. Getting the ISE-to-AD integration right is the foundation everything else sits on: 802.1X authentication, authorization policy, guest flows, posture assessment, and profiling all depend on it.

This guide walks through the complete integration from scratch: prerequisites, joining ISE to AD, configuring the identity store, mapping AD groups into policy, and troubleshooting when things don’t work.

CUIC Report Execution Failed: Complete Troubleshooting Guide

it-learn.io — Wed, 01 Apr 2026 00:00:00 +0000

If you’ve hit the dreaded “Report Execution Failed. Retry running the report and if the condition persists, contact the administrator” message in Cisco Unified Intelligence Center (CUIC), you’re not alone. It’s one of the most searched CUIC errors — and unfortunately one of the vaguest. The same message can come from a dozen different root causes.

This guide walks through every common cause, how to diagnose which one you’re hitting, and exactly how to fix it.

Introducing the CCIE Security Study Hub — cciesec.it-learn.io

it-learn.io — Sat, 28 Mar 2026 00:00:00 +0000

If you’re chasing the CCIE Security, you already know there’s no shortage of documentation — but there’s a real shortage of organized, exam-focused material that covers both the written qualifying exam and the 8-hour lab in one place.

That’s exactly what we built.

Meet cciesec.it-learn.io

cciesec.it-learn.io is a dedicated CCIE Security study hub built and maintained by it-learn.io. It covers two exams end-to-end:

RADIUS Load Balancing for Cisco ISE: The Complete Guide

it-learn.io — Wed, 25 Mar 2026 00:00:00 +0000

If you’ve got multiple ISE Policy Service Nodes and you’re trying to distribute RADIUS traffic across them without breaking 802.1X, CoA, or session tracking — this guide is for you.

RADIUS load balancing is one of those topics that looks straightforward on paper but has a handful of sharp edges that bite you in production. We’re going to cover every major concept: PSN architecture, load balancing methods, session persistence, the SNAT trap, health probes, ISE-side config requirements, and what to watch for in cloud environments.

Ransomware-as-a-Service: 2026 Extortion Tactics Explained

it-learn.io — Tue, 24 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2658840) episode.

Ransomware has evolved beyond simple encryption into a sophisticated extortion machine—and the tactics are getting darker in 2026. If your organization is still treating ransomware as a purely technical problem, you’re already behind. This episode breaks down how modern threat actors operate, why they’re abandoning encryption, and what actually works to stop them.

Network+ N10-009 Objective 1.3 — Cloud Concepts

it-learn.io — Mon, 23 Mar 2026 12:00:00 +0000

Cloud computing has fundamentally changed how networks are designed and managed. Objective 1.3 of the CompTIA Network+ N10-009 exam tests your understanding of cloud service models, deployment models, and the connectivity options that tie everything together — VPN, SD-WAN, MPLS, and more.

Whether you’re studying for the exam or looking to understand how modern enterprise networks actually work, this post has you covered.

CompTIA Network+ (N10-009) Objective 1.2: Networking Appliances Explained

it-learn.io — Mon, 23 Mar 2026 11:00:00 +0000

If Objective 1.1 gave you the OSI model as a framework, Objective 1.2 fills it with the actual hardware and software that makes networks run. Routers, switches, firewalls, IDS/IPS, load balancers — you need to know what each one does, where it sits in the network, and which OSI layer it operates at.

CCNA 200-301: How to Build a Home Lab and Study Without Buying Cisco Hardware

it-learn.io — Sun, 22 Mar 2026 00:00:00 +0000

The Cisco CCNA 200-301 is the gold standard entry-level networking certification. It proves you can configure, troubleshoot, and operate enterprise networks — Cisco’s routers and switches specifically — and it opens doors that no CompTIA cert can match in the Cisco-heavy enterprise world.

The challenge is obvious: Cisco hardware is expensive. A used Cisco 2811 router runs $30–100 on eBay, switches cost more, and you need multiple devices to build anything realistic. That adds up fast.

CompTIA Network+ (N10-009) Objective 1.1: OSI Model All 7 Layers Explained

it-learn.io — Sun, 22 Mar 2026 00:00:00 +0000

If you are studying for the CompTIA Network+ (N10-009) exam, Objective 1.1 is where it all begins. The OSI (Open Systems Interconnection) model is the foundation every other networking concept builds on. Nail this and the rest of the exam gets easier.

In the video above I walk through all 7 layers visually. In this post I’m going to go deeper — covering each layer, the encapsulation process, TCP flags, MTU, and the exam tips that actually matter.

How to Integrate Meraki Networks with Cisco ISE

it-learn.io — Sun, 22 Mar 2026 00:00:00 +0000

Cisco Identity Services Engine (ISE) is the cornerstone of enterprise network access control. Meraki is the go-to platform for cloud-managed networking in branch offices and mid-market deployments. Getting the two working together gives you centralized authentication, guest management, device posturing, and dynamic policy enforcement — all across your wireless, wired, and VPN infrastructure.

This guide walks you through the full integration end to end: ISE device configuration, Meraki Dashboard setup for both wireless and wired, ISE policy sets, Central Web Authentication, Change of Authorization (CoA), and verification.

CompTIA Network+ N10-009 Complete Study Guide

it-learn.io — Fri, 20 Mar 2026 00:00:00 +0000

The CompTIA Network+ (N10-009) is one of the most respected vendor-neutral networking certifications available — and one of the best starting points for a career in IT infrastructure, network engineering, or cybersecurity. This page is your hub for everything on this blog covering the N10-009 exam objectives.

Each objective gets its own dedicated post with a video walkthrough, detailed explanations, and accordion-style practice questions so you can test yourself as you go.

Network+ N10-009: Home Lab Ideas to Study Networking the Right Way

it-learn.io — Wed, 18 Mar 2026 00:00:00 +0000

The CompTIA Network+ N10-009 proves you can design, configure, manage, and troubleshoot real networks. It’s one of the most recognized mid-level certifications in IT — and it’s the foundation that everything else (Security+, cloud, DevOps) builds on.

The challenge is that networking is deeply physical by nature. Routers, switches, cables, IP addresses — it’s hard to understand these concepts without actually touching them. That’s exactly where a home lab changes everything.

Free Network+ Study Site — Flashcards & Quizzes

it-learn.io — Tue, 17 Mar 2026 00:00:00 +0000

If you’re studying for the CompTIA Network+ N10-009 exam, we built something specifically for you — and it’s completely free.

No account required. No paywall. No ads. Just a clean, fast study tool that covers every domain and objective on the current exam.

👉 network.it-learn.io

What Is It?

It’s a static web app organized around the official Network+ N10-009 exam domains:

1.0 Networking Concepts (8 objectives)
2.0 Network Implementation (4 objectives)
3.0 Network Operations (5 objectives)
4.0 Network Security (3 objectives)
5.0 Network Troubleshooting (5 objectives)

Every section is broken down to the objective level so you can study exactly what’s on the exam — nothing more, nothing less.

Phishing in 2026 — From Email to AI Deepfakes

it-learn.io — Tue, 17 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2636101) episode.

 # Phishing in 2026: From Classic Emails to AI-Enhanced Deepfakes – Technical Breakdown & Defenses

Phishing has evolved far beyond misspelled emails and obvious urgency tactics. In 2026, attackers are weaponizing generative AI, voice cloning, and deepfake video to create hyper-personalized, grammatically perfect campaigns that bypass both human intuition and legacy email filters. This episode breaks down how these attacks work, what the attack chains look like in practice, and the technical defenses that actually stop them.

Security+ SY0-701: Study Ideas and Home Labs You Can Build Today

it-learn.io — Tue, 17 Mar 2026 00:00:00 +0000

The CompTIA Security+ SY0-701 is one of the most recognized entry-level cybersecurity certifications in the industry. It’s DoD-approved, vendor-neutral, and validates that you understand the real threats and controls organizations deal with every day.

But here’s the truth: you can’t just read your way to passing Security+. The exam tests scenario-based thinking. You need to understand why a control exists, how an attack works, and what you would do when something goes wrong.

VMware Zero-Day Exploited — March 2026 Cyber Brief

it-learn.io — Wed, 11 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2607614) episode.

 Geopolitical tensions, zero-day exploits, and healthcare data breaches converge in this week's cybersecurity landscape—a perfect storm of threats that demand immediate attention from security teams everywhere. In a single week spanning late February through early March 2026, organizations faced escalating state-sponsored cyber operations, active VMware vulnerabilities, and the fallout of a massive healthcare data exposure affecting over a million individuals.

What This Episode Covers

Geopolitical Cyber Escalation: Iranian-linked cyber operations intensifying following U.S.-Israel military strikes, including coordinated phishing campaigns targeting critical infrastructure and government entities
VMware Aria Operations Zero-Day (CVE-2026-22719): A command injection vulnerability now listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, actively weaponized in the wild
University of Hawaiʻi Cancer Center Ransomware Breach: Disclosure of a 2025 attack impacting up to 1.2 million individuals, exposing sensitive healthcare data and revealing extended dwell times in healthcare environments

Deep Dive

Geopolitical Cyber Escalation: When Kinetic Meets Digital

The escalation of Iranian-linked cyber operations in late February represents a critical shift in the threat landscape. Following U.S.-Israel military strikes, threat actors affiliated with Iranian state interests have ramped up offensive cyber operations—a classic pattern of asymmetric response when conventional military options are constrained.

Welcome to the new it-learn.io

it-learn.io — Tue, 10 Mar 2026 00:00:00 +0000

Welcome to the new it-learn.io — now running on Hugo + S3 + CloudFront.

Same content, same topics: IT, networking, security, and the occasional deep dive. Faster, cheaper, and fully automated.

Stay tuned for new posts and podcast episode recaps from Techupdates.

Application-Level Microsegmentation: Granular Zero Trust Enforcement in 2026

it-learn.io — Mon, 09 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2607482) episode.

 As breaches become a matter of when, not if, the security industry has shifted focus from prevention to containment—and microsegmentation at the application level is emerging as the critical control that stops attackers dead in their tracks. In this technical deep dive, we explore three enterprise-grade platforms designed to enforce zero trust principles at the workload and process level, stopping lateral movement before it becomes a breach.

What This Episode Covers

Microsegmentation fundamentals — how application and workload-level policies differ from network-level segmentation
Illumio Zero Trust Segmentation — host/agentless visibility, AI-powered policy automation, and breach isolation capabilities
Akamai Guardicore Segmentation — kernel-level process enforcement, automated policy generation, and Osquery threat hunting integration
Cisco Secure Workload — workload dependency mapping, eBPF tracing, and native integration with ACI and Kubernetes
Emerging 2025-2026 trends — agentless enforcement modes, machine learning anomaly detection, and scalability for thousands of workloads
Technical architectures and enforcement mechanisms — understanding how each platform detects, enforces, and responds to policy violations in real time

Deep Dive

Why Microsegmentation Matters in 2026

Traditional network segmentation relies on perimeter controls and network zones—but modern infrastructure has shattered the perimeter. Hybrid environments, multi-cloud deployments, and containerized workloads mean that attackers who breach one system are often just a lateral hop away from critical assets. Microsegmentation flips this model: instead of trusting everything inside a zone, zero trust principles enforce least-privilege policies at the application and workload level, based on actual process identities, behaviors, and dependencies. This granular approach means that even if an attacker compromises a web server, they cannot automatically access a database or authentication service without explicit policy approval.

The Future of Firewalls: Hybrid Mesh Architectures Take Center Stage in 2026

it-learn.io — Thu, 05 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2598062) episode.

 Your traditional perimeter firewall is becoming obsolete—and organizations that don't adapt risk leaving critical vulnerabilities in their multi-cloud, hybrid work environments. In this episode, we explore how hybrid mesh architectures are fundamentally reshaping enterprise network security, backed by Gartner's inaugural Magic Quadrant and real-world deployments from industry leaders.

What This Episode Covers

The rise of Hybrid Mesh Firewalls (HMF) — what they are and why Gartner formalized this category in 2025
Multi-deployment firewall strategies — how hardware, virtual, cloud-native, and FWaaS solutions work together under unified management
Vendor landscape — Palo Alto Networks, Fortinet, Cisco, and other leaders pushing unified security approaches
Operational benefits — centralized policy management, consistent threat prevention, and reduced complexity across distributed infrastructure
Future trends — SASE/SSE integration, quantum-readiness, and the shift from east-west to omni-directional threat prevention
Real-world implications — how hybrid mesh addresses multi-cloud, edge computing, and remote work security challenges

Deep Dive

Understanding Hybrid Mesh Firewalls

A Hybrid Mesh Firewall isn’t a single appliance—it’s an architecture. It represents multi-deployment firewalls (hardware, virtual, cloud-native, and Firewall-as-a-Service) managed from a single cloud-based control plane. The key innovation: consistent security policies, threat intelligence, and detection capabilities across your entire infrastructure, whether that’s on-premises data centers, AWS, Azure, GCP, edge locations, or remote user endpoints.

SSE Platform Updates — Prisma Access, Zscaler, Cisco

it-learn.io — Mon, 02 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2594798) episode.

 The Secure Service Edge (SSE) platform landscape is evolving at an unprecedented pace, with major vendors rolling out game-changing features throughout 2025 and into 2026. If you're responsible for securing your organization's network infrastructure, understanding these latest enhancements from Palo Alto Networks, Zscaler, and Cisco isn't just nice to know—it's essential to making informed technology decisions for your enterprise.

What This Episode Covers

Palo Alto Networks Prisma Access — Flow visualization, SD-WAN enhancements, and Strata Cloud Manager improvements
Zscaler Platform Updates — AI Security Suite, advanced DLP capabilities, and Client Connector refinements
Cisco Secure Access Evolution — Universal ZTNA, AI Defense, and AI-Aware SASE architecture
2026 Roadmap Priorities — Enterprise AI security, strict enforcement models, and hybrid deployment strategies
Practical Implementation Considerations — What these updates mean for your infrastructure planning

Deep Dive

Palo Alto Networks: From Infrastructure Visibility to AI-Ready Management

Palo Alto’s Prisma Access is solidifying its position as a comprehensive SSE platform with tangible improvements to operational visibility and management capabilities. The February 2025 Prisma SD-WAN updates introduced flow visualization—a critical feature for network engineers who need real-time insights into traffic patterns across distributed environments. This isn’t just eye candy; it’s the foundation for identifying bottlenecks, troubleshooting performance issues, and validating security policies in practice.

How Exploit Kits Are Automating Attacks Against Recent CVEs

it-learn.io — Fri, 27 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2587027) episode.

 The window between a vulnerability disclosure and active exploitation in the wild is shrinking at an alarming rate—and exploit kits are the reason why. What once took weeks or months now happens in hours, thanks to automated attack frameworks that scan the internet continuously and deploy payloads with minimal human intervention. For IT teams and security professionals, understanding how exploit kits operate has moved from "nice to know" to "mission critical."

What This Episode Covers

How exploit kits function as automated attack platforms
The mechanics of vulnerability scanning and payload deployment at scale
Why the exploitation window after CVE disclosure keeps shrinking
The primary targets of exploit kit campaigns (internet-facing infrastructure)
Defensive strategies that move beyond reactive patching
Patch prioritization frameworks and attack surface reduction techniques
Building proactive exposure management into your security posture

Deep Dive

The Evolution of Automated Attacks

Exploit kits represent a fundamental shift in how cyberattacks are executed. Rather than relying on skilled attackers to manually identify vulnerable systems and craft custom exploits, these automated platforms handle the heavy lifting. Think of an exploit kit as a plug-and-play attack infrastructure—once configured, it continuously scans the internet, fingerprints systems, identifies vulnerabilities, and deploys malicious payloads without requiring active attacker intervention.

The perimeter is no longer just a boundary — it’s the battlefield

it-learn.io — Wed, 25 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2576762) episode.

 Your firewall isn't just protecting your network anymore—it's become the primary target. In the latest Tech Updates episode, we explore a perfect storm of vulnerabilities hitting critical infrastructure, from CCTV systems to the perimeter devices you rely on most. If you manage internet-facing systems, this is required listening.

What This Episode Covers

CVE-2026-1670: A critical 9.8 severity vulnerability affecting Honeywell CCTV systems
Ransomware campaigns targeting firewalls: Why attackers are shifting focus to perimeter devices
Surge of high-severity CVEs: A wave of infrastructure vulnerabilities published this week
Perimeter security strategy: Understanding why the network edge has become the primary battleground

Deep Dive

The Honeywell CCTV Vulnerability: More Than Just Camera Feeds

The critical vulnerability in Honeywell CCTV systems (CVE-2026-1670) represents a growing problem in IoT security. With a CVSS score of 9.8, this isn’t a minor flaw—it’s a critical security gap that could allow attackers to hijack cameras and compromise password systems.

Trending Cybersecurity News (February 2026)

it-learn.io — Sun, 22 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2568894) episode.

 February's cybersecurity landscape is moving at breakneck speed, with major vendors racing to patch critical vulnerabilities while attackers exploit zero-days in the wild. This week's Tech Updates episode cuts through the noise to highlight the stories that demand your immediate attention—and the strategic shifts they signal.

What This Episode Covers

Microsoft Patch Tuesday — 54 vulnerabilities patched, including 6 zero-days requiring immediate action
Apple’s Emergency Update — An actively exploited zero-day affecting iOS and macOS devices
AI and Attack Surface Expansion — New research on how enterprise AI adoption is creating security blind spots
The Strategic Reality — Why speed, visibility, and governance matter more than tool proliferation

Deep Dive

Microsoft’s February Patch Tuesday: 54 Vulnerabilities and 6 Zero-Days

Microsoft’s monthly Patch Tuesday updates are always significant, but February’s release underscores a troubling trend: zero-day vulnerabilities are becoming routine. Six zero-days in a single update means attackers had already discovered and likely weaponized these flaws before Microsoft could develop fixes.

Cisco Live EMEA - 2026 Recap

it-learn.io — Thu, 19 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2559558) episode.

 Cisco Live EMEA 2026 delivered a masterclass in how enterprise infrastructure must evolve to meet the demands of AI-scale operations. With over 21,000 attendees gathering in Amsterdam, the conference revealed that networking, security, and operations are undergoing a fundamental transformation—and your infrastructure strategy needs to evolve accordingly.

What This Episode Covers

Silicon One G300 ASIC: Cisco’s new 102.4 Tbps programmable switching chip designed for AI data centers
AI Defense Portfolio Expansion: New security controls for AI supply chains, agent governance, and runtime protection
AgenticOps: Cisco’s autonomous operations framework bringing AI-first intelligence to networking and security
AI-Powered Collaboration: Webex enhancements including real-time translation and AI-ready devices
Strategic Positioning: How Cisco is positioning itself as an AI platform company, not just a networking vendor
Sovereign Infrastructure & Data Fabrics: Emerging trends in integrated, AI-optimized data center design

Deep Dive

The Silicon One G300: Redefining Data Center Performance

The headline announcement was the Silicon One G300, a programmable switching ASIC delivering 102.4 Tbps of throughput. For network engineers, this isn’t just another spec bump—it’s built from the ground up to handle the unique demands of AI workloads.

E4 - Agentic AI & AI Autonomy Edition

it-learn.io — Wed, 11 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2542146) episode.

 # Goldman Sachs, Claude Opus 4.6, and the Enterprise Race for Agentic AI

Agentic AI is no longer theoretical—it’s moving into production environments at some of the world’s largest financial institutions. In this episode, we explore how enterprises are operationalizing autonomous AI systems, what the latest Claude model brings to the table, and what observability challenges IT teams need to prepare for right now.

E3 - Zero Trust, what's the latest?

it-learn.io — Tue, 03 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2517328) episode.

 # Zero Trust Adoption is Accelerating: Here's What You Need to Know

The security landscape is shifting beneath our feet, and zero trust is no longer a buzzword—it’s becoming the standard that government agencies and enterprises expect you to implement. With recent NSA guidance, major partnerships forming around critical infrastructure, and security vendors racing to expand their federal presence, the zero trust movement has reached an inflection point that every IT professional needs to understand.

CLUS 25 - AI-Ready Data Centers

it-learn.io — Tue, 08 Jul 2025 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2100679) episode.

 # Transforming Your Data Center for the AI Era: Cisco Live 2025 Innovations

AI isn’t coming to your data center—it’s already there. And if your infrastructure isn’t ready for it, you’re about to face some serious challenges. At Cisco Live 2025, one of the strongest focal points was helping organizations transform their data center infrastructure to handle the massive, unprecedented demands of AI workloads. Let’s break down what Cisco announced and why it matters for your organization.

CLUS 25 - Cisco's Technology Vision for the Future

it-learn.io — Wed, 02 Jul 2025 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2098101) episode.

 As artificial intelligence reshapes the technology landscape, Cisco is charting a bold new course for the future of networking and security. During Cisco Live 2025 in San Diego, company executives laid out a strategic vision that places AI agents and autonomous applications at the center of network architecture—forcing organizations to rethink everything they thought they knew about infrastructure.

What This Episode Covers

The emergence of “agentic AI” and what it means for enterprise networks
How autonomous applications and AI bots will fundamentally change network demands
The need for reimagined network architecture to handle unprecedented data scales
Cisco’s unified platform strategy for the AI-driven era
Embedding intelligence across the networking and security portfolio
Building adaptive, secure, and operationally efficient networks for tomorrow

Deep Dive

The Agentic AI Era is Here

We’re not talking about the ChatGPT-style AI that responds to prompts. Agentic AI represents a fundamentally different paradigm—autonomous agents and bots that can perceive their environment, make decisions, and take action with minimal human intervention. These aren’t tools you query; they’re systems that operate independently, managing tasks, making trade-offs, and learning from outcomes.

Secure Client (AnyConnect) + Secure Endpoint - Quick Deployment Guide

it-learn.io — Wed, 12 Apr 2023 00:00:00 +0000

Quick post on Implementing Cisco Secure Endpoint leveraging Cisco Secure Client Cloud Deployment - Cool stuff and easy to deploy and implement

First go to SecureX (https://securex.us.security.cisco.com)

Click the Insights Tab

Go to Deployment Management on the Left SideBar

On the right Go to –> + Create New Add a name and Click Save

Under the Cloud Management Section, you will have 2 options – Depending on your needs you can have it to AutoUpdate or NoAutoUpdate. This is a cool feature and will be the best way to keep the Core Modules updated

Cybersecurity Incident Response - Basics and How to get Started

it-learn.io — Mon, 27 Feb 2023 00:00:00 +0000

Today I want to start off by sharing a few things that I have been researching for a while. I have had a lot of curiosity about incident response, I want to understand how it works, what is expected from an IR team, and much more.

For the last few days, I have also been asking my new friend ChatGPT about it so that I can get some of the answers and things that go on during an Incident Response engagement.

Cybersecurity Incident Response - Detection and Analysis (Tools and Indications)

it-learn.io — Mon, 27 Feb 2023 00:00:00 +0000

I consider it should be a good idea to start with a quick overview or list of Attack Vectors before we dive right into what goes into the Detection and Analysis phase.

Companies should be able to prepare and have plans around common attack vectors, and what to do in those cases, we went over that in our previous post, but this time as a refresher, here is a non-exhaustive list of common attack vectors:

Cybersecurity Incident Response - Preparation

it-learn.io — Mon, 27 Feb 2023 00:00:00 +0000

I want to take the opportunity to break down what goes into the preparation for incident response and what things could like from the perspective of an infosec professional.

Going back to NIST, there are a few things that are considered:

Part of a well-defined IR Plan includes things like creating an IR Policy and plan, and what tools will be used for performing incident handling and reporting. A determined team structure, who are the players?, lead Engineers? who is in charge of collecting forensic data? what happens during the eradication and recovery phases, and who is in charge? Should these functions be assigned to a team or an individual? - A well-described line of communication between teams and technical and executive teams (Yeah - Executives need to be involved)

Secure Client (AnyConnect) - How to configure Secure Client 5.x Using SecureX Insights

it-learn.io — Tue, 14 Feb 2023 00:00:00 +0000

Last year AnyConnect went through an interesting transformation, its name changed to Secure Client, and looks like Cisco realized that the amount of information that could be collected from it and other services, makes it a good data mine for Security context and information.

But what is the buzz about, what changed?

A few interesting things changed, and one of the most important things that changed was the way to deploy it or roll it out to an environment.

SASE - Configuring Umbrella Security - Basic Setup - DNS Server Forwarding

it-learn.io — Mon, 13 Feb 2023 00:00:00 +0000

Today I want to create a quick blog post that goes over setting up Umbrella in a few different ways, you may notice that these will be long posts, so I will have to break this into a few different posts over the coming weeks.

If you are new to Cisco Umbrella, well here is a quick explanation of what it is and how it works:

Cisco Umbrella offers flexible, cloud-delivered security. It combines multiple security functions into one solution, so you can extend data protection to devices, remote users, and distributed locations anywhere. Umbrella is the easiest way to effectively protect your users everywhere in minutes.

SASE - Configuring Umbrella Security - Basic Setup - How to integrate Umbrella with FMC

it-learn.io — Mon, 13 Feb 2023 00:00:00 +0000

Hey we are back, this time I want to explore the section of the deployment of Umbrella, where we can configure a device to communicate and forward all traffic to Umbrella

We will concentrate on the section for Network Devices this time:

The main idea of this integration is that the devices will become an Identity, which you can use later to apply policy under any of your settings inside Umbrella

The Basics of Networking | Cables, Interfaces and Fiber

it-learn.io — Mon, 16 Jan 2023 00:00:00 +0000

Simple Definition of Ethernet Cables and Speeds

Ethernet is a widely-used local area network (LAN) technology that uses a bus or star topology and supports data transfer rates of 10 Mbps. Fast Ethernet, also known as 100BASE-T, is an extension of Ethernet that supports data transfer rates of 100 Mbps. Gigabit Ethernet, also known as 1000BASE-T, is another extension of Ethernet that supports data transfer rates of 1 Gbps. 10 Gigabit Ethernet, also known as 10GBASE-T, is the latest extension of Ethernet that supports data transfer rates of 10 Gbps.

The Basics of Networking | Network Protocols | DHCP

it-learn.io — Mon, 16 Jan 2023 00:00:00 +0000

The Simple Definition

Dynamic Host Configuration Protocol (DHCP) is a network protocol used to automatically assign IP addresses to devices on a network. DHCP is used to simplify the management of IP addresses and reduce the likelihood of IP address conflicts.

When a device, such as a computer or a smartphone, connects to a network, it sends out a broadcast message requesting an IP address. A DHCP server, which is typically located on a router or a dedicated server, receives the request and assigns an available IP address to the device. The DHCP server also assigns other network configuration information, such as the subnet mask, default gateway, and DNS server IP addresses.

The Basics of Networking | Network Topology Architectures | Spine-Leaf

it-learn.io — Mon, 16 Jan 2023 00:00:00 +0000

Spine-Leaf Network Architecture

The spine-and-leaf network topology is a variation of the three-tier network topology, where the core layer is split into two parts: a spine and a leaf.

The spine layer is made up of high-speed routers or switches that connect all the leaf devices together. These devices are responsible for providing high-speed connectivity between the different parts of the network and they act as the primary point of interconnection.

The Basics of Networking | Network Topology Architectures | Tier 1 and Tier 2

it-learn.io — Mon, 16 Jan 2023 00:00:00 +0000

Tier 2 Network Architecture

A two-tier network topology refers to a network architecture that has two layers, or tiers, of network devices.

Access: The first tier is the access layer, which is the point of entry for end-users into the network. It comprises of network devices such as switches, routers, and wireless access points. This layer is responsible for connecting end-users to the network and providing basic security features such as VLANs and access control lists.

The Basics of Networking | TCP and UDP

it-learn.io — Mon, 16 Jan 2023 00:00:00 +0000

TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are the two most commonly used protocols for transmitting data over a network. Both protocols are used for different types of data transmission and have their own unique features and characteristics.

Simple Definition of TCP

TCP is a connection-oriented protocol, which means that a virtual connection is established between the sender and the receiver before any data is transferred. This connection is maintained throughout the duration of the data transfer, and the receiver acknowledges receipt of each packet of data. This ensures that all data is received correctly and in the proper order. Additionally, TCP includes flow control and error-checking mechanisms to ensure that data is transferred efficiently and reliably. Due to these features, TCP is often used for applications that require high reliability, such as web browsing, email, and file transfer.

The Basics of Networking | The most Common Protocols in Networks

it-learn.io — Mon, 16 Jan 2023 00:00:00 +0000

There is a very long list of network protocols, but I wanted to include a comprehensive list, with its descriptions. As mentioned this is a short list that is only including the most common and basic protocols

As you progress in your learning you will notice more protocols, based on the things that you are trying to achieve. Mostly it comes down to your infrastructure requirements and environment.

We can think of this list as a quick list to get us started, as these are the most common protocols

Series: The Basics of Networking | Network Elements

it-learn.io — Sun, 15 Jan 2023 00:00:00 +0000

I wanted to create a quick series with simple explanations of Network Devices and how they fit in Network environments. I hope this helps anyone that is starting their IT Career Journey.

I think that if you are looking to start a career in IT, Networking, Information Security, Cloud, or any other specialty, this series will help you.

Here is the breakdown of the topics created under the Series:

The Basics of Networking | Network Elements | Routers

The Basics of Networking | Network Elements | Endpoints, Servers and Computers

it-learn.io — Sun, 15 Jan 2023 00:00:00 +0000

The simple definition | Endpoints

Endpoints are the devices that connect to the network and access its resources. These can include computers, laptops, smartphones, tablets, and other devices. They are the “ends” of the network, where people interact with the network and its resources.

Think of endpoints as the musicians in an orchestra. They are the ones who play the instruments and create the music, but they need a conductor to lead them and make sure everything is in sync. In the same way, endpoints need the network to access the resources they need to function.

The Basics of Networking | Network Elements | Firewalls and NGFW

it-learn.io — Sun, 15 Jan 2023 00:00:00 +0000

The Simple Definition

A firewall is a security tool that is used to protect a computer network from unauthorized access. It acts as a barrier between a protected network and the outside world, controlling the flow of traffic in and out of the network.

Think of a firewall as a virtual security guard for your network. Just like how a security guard controls who can enter a building, a firewall controls what types of traffic can enter your network.

The basics of Networking | Network Elements | Routers

it-learn.io — Sun, 15 Jan 2023 00:00:00 +0000

The Simple Definition

A router is a device that connects multiple networks together and directs the flow of data between them. It’s like the traffic cop on the internet, directing the flow of information to ensure it reaches its intended destination.

At its core, a router is a computer with specialized software and hardware that performs the task of routing. It uses routing tables and protocols to determine the most efficient path for data to travel from one network to another. When a packet of data (like an email or a web page) is sent from one device to another, the router examines the destination address and decides which path to send it on.

The Basics of Networking | Network Elements | Switches

it-learn.io — Sun, 15 Jan 2023 00:00:00 +0000

The simple definition

A network switch is a networking device that connects devices together on a computer network. It allows multiple devices to communicate with each other by forwarding data packets between them.

When a device, such as a computer or a printer, wants to communicate with another device on the network, it sends a data packet to the switch. The switch then examines the packet and forwards it to the appropriate device.

The Basics of Networking | Network Elements | Wireless Access Points (WAP)

it-learn.io — Sun, 15 Jan 2023 00:00:00 +0000

The Simple Definition

Imagine being able to access the internet from anywhere in your house without the need for cables and wires. That’s exactly what a wireless access point (WAP) allows you to do.

A WAP is a networking device that allows wireless devices such as laptops, smartphones, and tablets to connect to a wired network and access the internet. It works by receiving signals from wireless devices and forwarding them to the wired network, where they can be processed and sent to the internet.

The Basics of Networking | Network Elements | Wireless LAN Controllers (WLC)

it-learn.io — Sun, 15 Jan 2023 00:00:00 +0000

The Simple Definition

A WLC is a networking device that acts as a central management system for one or more WAPs. It is responsible for controlling the configuration, security, and performance of the WAPs in the network.

A wireless LAN controller (WLC) is like the conductor of an orchestra for your wireless network. It manages and coordinates the different wireless access points (WAPs) in your network, ensuring that they all work together seamlessly and efficiently.

Configure SMTP with Cisco ISE 3 | Import Microsoft 365 Certificates

it-learn.io — Fri, 29 Jul 2022 00:00:00 +0000

If you are configuring the SMTP setting on Cisco ISE, you may have found an interesting error when complete this configuration —> Connection to smtp.domain.com failed. Could not connect to SMTP Server, SSL Error. Please check the trusted certificates.

In this case the issue is that Cisco ISE has to trust the connection with Microsoft 365, since we are doing the connection with MS365 recommended settings as follows:

AWS Certified Advanced Networking - Specialty: Documenting Progress

it-learn.io — Wed, 20 Oct 2021 00:00:00 +0000

I’d like to start by saying some wise words I once read somewhere, “Everyone has a plan until they get punched in the mouth” and I believe this one was said by Mike Tyson. I think it holds a lot of true.

I recently attempted the AWS Network Specialty exam, and was humbled immediately after seeing the very first 5 questions. I failed the exam and felt a bit down for a while, but to recover from it I want to make sure I work on my plan extensively, so that I don’t get punched that bad next time.

Adding Google Analytics to a Static Website

it-learn.io — Mon, 21 Jun 2021 00:00:00 +0000

A CMS software like WordPress is awesome because it lets you get statistics in real-time, like page visits, link hits, and many more; in my case, I was unsure what I need to do with a static website and add analytics to it. So I decided to look for ideas quickly.

I use Google Analytics in other business websites that I have set up, but those run on Squarespace or WordPress, in this case, my website is hosted in S3, so I was curious

Creating a Links Website - S3, CloudFront & Certificate Manager - Supporting SSL + HTML/CSS - Part 1

it-learn.io — Wed, 16 Jun 2021 00:00:00 +0000

I have noticed this company called Link Tree, where users log in and create a quick Links page with their picture on it and with all their links in one place. These links take them to multiple places, like their Social Media accounts, resumes. Blogs, products they sell, and so on.

While I was looking at it, I thought, I can create something like that from scratch. My HTML/CSS Skills are very outdated, so I decided to give it a shot.

Creating a Links Website - S3, CloudFront & Certificate Manager - Supporting SSL + HTML/CSS - Part 2

it-learn.io — Wed, 16 Jun 2021 00:00:00 +0000

As we continue moving forward with our project, we will move to the creation of the certificate using AWS Certificate Manager

Requesting Certificate from AWS Certificate Manager

I created a quick video to illustrate the process, so it’s easy to follow if you are trying something similar

What to look forward to?

The next and final piece of the puzzle is to make sure we enable a Content Distribution using CloudFront

Creating a Links Website - S3, CloudFront & Certificate Manager - Supporting SSL + HTML/CSS - Part 3

it-learn.io — Wed, 16 Jun 2021 00:00:00 +0000

Finally we made it to the last step of the project, this will be dedicated to the CloudFront piece

Create a Cloud Front Distribution

This quick video will show you how to configure the CDN piece with CloudFront.

What to look forward to?

Perfect, we made it to the end; now we want to make sure our Bucket is only accessible from our CDN, not from the external world. The next post will be the configuration we need to make this happen.

Creating a Links Website - S3, CloudFront & Certificate Manager - Supporting SSL + HTML/CSS - Part 4

it-learn.io — Wed, 16 Jun 2021 00:00:00 +0000

Applying security is important, even when I lab stuff I try to make it as secure as possible, my projects may take a bit more time to complete, but this step will allow me to sleep at night.

Applying Security

I wanted to make sure that while my bucket in S3 is configured with Public Access, that now that we have Cloud Front up and running, we lock it so that only Cloud Front can access it. Here is a quick video on how to it

Simple Static Website Using Amazon S3

it-learn.io — Tue, 01 Jun 2021 00:00:00 +0000

I’m refreshing a bit on my AWS skills to master most of AWS Services and technologies. I have attempted the AWS SA: Professional a few months back and failed pretty badly.

As a refresher I started using A-Cloud-Guru again and I was very impressed by the Hand on Lab Features, which they did not have last year.

I started playing with the Create a Static Webpage and here are the results. The video is not of great quality, but I wanted to make sure my process is documented and hopefully, I get better at doing these things.

FortiGate - Configuration (Part 4) - Administration and Management setup | Active Directory Setup | Administration with AD Group Membership

it-learn.io — Mon, 19 Apr 2021 00:00:00 +0000

Having multiple administrators managing your Security devices is common practice, every user that is supposed to have access to a Firewall should have access to it. This needs to be controlled by an identity server; in this case, we will use Microsoft Active Directory.

Looking to catch up up the FortiGate Series? - Make sure you check the Main Page for it –> FortiGate - Configuration Series.

The Requirement

Ensure the Network Administrators Group and Help Desk Groups have access to Manage the FortiGate - Use AD for Authentication.

FortiGate - Configuration (Part 1) - Interfaces and Getting Started

it-learn.io — Sat, 17 Apr 2021 00:00:00 +0000

It has been a long time since my last practical/post, so I wanted to share what I have been working on

For my understanding and anyone reading this, I would like to set a quick standard for this lab; the best way to do it is by creating a quick diagram and a Plan

Looking to catch up up the FortiGate Series? - Make sure you check the Main Page for it –> FortiGate - Configuration Series.

FortiGate - Configuration (Part 2) - Static Routes | Firewall Policies | Port Address Translation for Internet

it-learn.io — Sat, 17 Apr 2021 00:00:00 +0000

TO pick up right where we left off, we will configure Static Routes to the providers, Security Policies (Allowing Traffic to the Internet), and NAT

Looking to catch up up the FortiGate Series? - Make sure you check the Main Page for it –> FortiGate - Configuration Series.

The Diagram

Static Routes ISP

This part of the configuration is enjoyable; Fortinet helps you save time. When you configure a static route, it will suggest an interface to be used as the next hop, without you having to do much other than making sure it is the right one. You can also use the advanced options to make sure and set the priority of your interface.

FortiGate - Configuration (Part 3) - Web Filtering | Read-only SSL handshake inspection | Troubleshooting | Adding FortiGate CA Certificate to Windows 10

it-learn.io — Sat, 17 Apr 2021 00:00:00 +0000

The Security Profile - Web Filter

FortiOS has a neat section for all the Security Profiles; this GUI is straightforward and intuitive. So let’s see what we have by default.

Looking to catch up up the FortiGate Series? - Make sure you check the Main Page for it –> FortiGate - Configuration Series.

From the screenshot, we can clearly see what these profiles are being used for. This time, I will make sure to copy the Default one instead of creating a new Profile. You can do this by right-clicking on the default profile, then select Clone. This will open a new section to adjust the name or accept the default Fortinet created for you, which reads: “Clone of Default.”

FortiGate - Configuration Series

it-learn.io — Sat, 17 Apr 2021 00:00:00 +0000

Hey there, I created a quick series that goes over Fortinet Configuration. Initially, this series goes over simple configuration tasks

Let me know if this is helpful

FortiGate Configuration Series Main Post

On becoming Serverless, and what the heck is the Cloud anyways? - Part 1

it-learn.io — Wed, 07 Apr 2021 00:00:00 +0000

For the past year, I have been wrestling with Cloud Technologies, trying to understand and put it in practice, but the right way, and what is the right way? You may ask. Cloud is designed to change the vision of how traditional infrastructures are created. Cloud shares a vision of multi-tenancy, elasticity, and scalability. And why not? Major Cloud providers design these solutions to make technology more streamlined and easy to consume.

New site for all previous posts and new ones! - it-learn.io

it-learn.io — Mon, 05 Apr 2021 00:00:00 +0000

Launching it-learn.io

Welcome to the first and official post for it-learn.io - This post is just the vision of this site and what the creators (me) are looking to accomplish.

I’m thrilled you are here; as you may see previous posts you have read before from me(Andres Sarmiento), some posts from 2014 until 2020. After giving it a lot of thought, I decided to consolidate my previous collabengineer.com and cybersecengineer.com sites into one that makes sense and covers pretty much all areas of Technology.

Ready or not, MS Teams' prime-time at Schools (First day of School)

it-learn.io — Wed, 19 Aug 2020 00:00:00 +0000

My blogging game has been off for the last few months ((https://cybersecengineer.com)), and that is ok, but as schools start today in my neck of the woods, I just could not resist and write this short post with my opinion.

A story of Broward Public Schools - Microsoft Teams Prime-Time

Today my kids started virtual classes and to my surprise I noticed that they are using MS Teams to get connected, meet and collaborate. I have to be honest, I did not think MS Teams was ready for meetings and collaboration, event tough I have been forced to use it at work, because all my team mates are using it.

Splunk Series III: System Administrator Class (File Structure, Settings and CLI)

it-learn.io — Mon, 11 May 2020 00:00:00 +0000

Awesome, I was able to move from those 2 slides that took a lot of content and energy our of my brain! - The slides I’m referring to are the ones you get when you assist Splunk’s class for System Administration, basically the posts are my notes (This blog) which is an extraction of the most important content.

The next post will be about few things that I consider very important, like the settings, the directory structure and so on, so lets get at it

Splunk Series III: System Administrator Class (Installation and Recommendations)

it-learn.io — Sun, 10 May 2020 00:00:00 +0000

Splunk can be installed in Windows and Linux for Production environments, there are some tweaks that you can configure to make your environment run better and with no issues, this class makes few recommendations that are very new to me so I will list them here to keep adding to my notes.

Linux Settings Recommendations

Ulimit

The class recommends the use of ulimit -ato view settings, and then increase the parameters on indexers and search heads. This one seems a bit off, but here is a quick informational link about the ulimit command

PANOS - Configuring OSPF and Default Route Advertisement

it-learn.io — Fri, 08 May 2020 00:00:00 +0000

I have a very modest lab setup and have been putting the PAN-VM 100 to the test, in this case, I have 2 firewalls setup to handle the internet of the internal VMs in my lab

Here I a quick snapshot of the all the junk I have been running

So I decided that I want to use the PANVM as my primary internet, due to some limitations of speed with the ASA5506X (Only 250Mbps) - I’m running currently a 1Gbps internet for the lab so I wanted to make sure I could use all my bandwidth! (I want my money and I want it now!!)

Splunk Series III: System Administrator Class (Splunk Components, Processes and Installation)

it-learn.io — Wed, 06 May 2020 00:00:00 +0000

Getting back from where we left over from yesterday. Here is a quick and interesting view of the components, processes and the Installation planning of the solution. I know, these post maybe repetitive in nature, but its the foundation of a well implemented solution

Core Components and Processes

This section is dedicated to describe all the components and processes and a brief explanation of Splunk

Search Heads

Allow users to submit search request using SPL (Search Processing Language)
Distribute search requests to the indexers
Consolidate results and render visualizations of results
Store search-time knowledge objects (Field extractions, alerts and dashboards)

Indexers

Receive incoming data from forwarders
Index and store data in Splunk indexes
search data in response to requests from Search Heads

Forwarders

Monitor configured inputs and forward data to the indexers (best practice data collection method)
Requires minimal resources and typically installed on the machines that produce the data

Deployment Server

Acts as a centralized configuration manager for any number of deployment clients
Requires running on an enterprise instance

Installation Overview

As with any installation, preparation and planning are key!

Splunk Series III: System Administrator Class (Splunk Deployment)

it-learn.io — Wed, 06 May 2020 00:00:00 +0000

As I continue being exposed to Splunk in the wild as well as in class :) - I decided to write a bit on the class that I just took.

The System Administrator Class

This class is one of the many requirements to become a Splunk Certified Architect, which is what I’m going for in the next couple of months. This class along with the Data Administration one are required in order to take the Administration exam.

PANOS - Configuring Snapshots of Configuration

it-learn.io — Tue, 05 May 2020 00:00:00 +0000

One thing that I really appreciate from Palo Alto is that their Firewalls have this nice way to save your configuration. As I move with labbing my experience with the Firewalls and products, I really wanted to highlight this.

Configuration Management

This section relates to the ability to different functions you can use to practically save your configurations, this is very handy because you can save a good known configuration, and ue at later time.

Palo Alto Networks - PCNSE Certification Part 6: Basic Configuration (Destination NAT and Security Policy)

it-learn.io — Fri, 24 Apr 2020 00:00:00 +0000

The last post was very long and a bit crazy all over the place, but here we are continuing with it. To illustrate how to crate a destination NAT, we will be opening FTP to one of our DMZ server, so lets get started

Create Object

Under Objects -> Services we will create our new FTP Object

Destination NAT Policy

We are pretty much following the same flow we initially followed when we were playing with the Source NAT Policies, with few minor changes that will make sense

Palo Alto Networks - PCNSE Certification Part 3: Basic Configuration (Admin Roles)

it-learn.io — Thu, 23 Apr 2020 00:00:00 +0000

So I continue my journey to get this cert, I think I have procrastinated for too long and I need to get back to learning all the ins and outs for the technology. Again this certification is very heavy on configuration, HA concepts and maybe scattered between all their main Objectives. We are going to get working with Initial Configuration

Admin Roles

Like any other appliance out there, you have the ability to create different Admin roles and different permissions based on their job function

Palo Alto Networks - PCNSE Certification Part 4: Basic Configuration (Interfaces)

it-learn.io — Thu, 23 Apr 2020 00:00:00 +0000

This quick lab is going to be about creating Zones, assigning them to interfaces, Management Interface configuration

Creating a Zone

We will create the Outside Zone and we are going to add a name + selecting the type, nothing fancy, but later in the lab we will use it and go through configuring more features

Create an Interface Management Profile

We are going to quickly create a Management profile and assign to an interface

Palo Alto Networks - PCNSE Certification Part 5: Basic Configuration (Security Policies, source NAT)

it-learn.io — Thu, 23 Apr 2020 00:00:00 +0000

Create Tags

One thing that I really appreciate from PANOS is the introduction of TAGs, they are very handy when you are looking for policies, objects and many different things in your firewall. I know many of you out there appreciate the feature.

Tags are color-coded labels and enable you to group, sort, and filter objects using keywords or phrases. Tags can be applied to Address objects, Address Groups (static and dynamic), services, Service Groups, and policy rules. Tags can be assigned a color that makes the results of a search easier to find in the web interface.

Cybersecurity Tools - VERIS Incident Model

it-learn.io — Wed, 22 Apr 2020 00:00:00 +0000

Lack of quality information in Cyber Security and incident response is real, you have too many sources for too many things, and most of the information at reach is not centralized. A couple of years back when I was working on learning more and more ins and outs on the InfoSec community I found VERIS, which I think is a nice initiative.

Here is a quick breakdown of what it is

Splunk Series II: Correlating Events

it-learn.io — Mon, 20 Apr 2020 00:00:00 +0000

Introduction to Transactions

A transaction is a group of related events that span time. Events can come from multiple applications or hots. For example, One email message can create multiple events as it travels through various queues, also visiting a single website normally generates multiple HTTP requests

Transaction field-list can be one list field or a list of field names. Events are grouped into transactions based on the values of these fields. If multiple fields are specified and a relationship exists between those fields, events with a related field value are grouped into a single transaction.

Splunk Series II: Filtering/Formatting Data

it-learn.io — Mon, 20 Apr 2020 00:00:00 +0000

Introduction to Eval Commands

The eval commands are great to perform calculations, convert values, road values, format values and even use conditional statements. It is recommended to use search and were commands to filter calculated results.

Eval commands allow you to calculate and manipulate field values in your report Supports a variety of functions Results of Eval written to either new or existing fields you specify

If the destination field exists, the values of the field are replaced by the results of eval

Splunk Series II: Fundamentals II

it-learn.io — Mon, 20 Apr 2020 00:00:00 +0000

SO we got to this point, looking at the Fundamentals 2 section of my training. This training builds on the Fundamentals 1 course. Which is pretty much all tools you can use for searching and understanding data in Splunk

What is part fo Fundamentals 2:

Transforming commands and Visualizations Filter/Format results of a Search Correlate Events into Transactions Knowledge Objects Extracted Fields, Fields Aliases and Calculated Fields Tags and Event Types Macros and WorkFlow Objects Manage Data Models Splunk Common Information Model

Splunk Series II: Knowledge Objects and Managing Fields

it-learn.io — Mon, 20 Apr 2020 00:00:00 +0000

Introduction to Knowledge objects

These are tools you use to discover and analyze various aspects of your data

Data Interpretation - Fields and field extractions
Data Classification - Event types
Data Enrichment - Lookups and Workflow Actions
Normalization - Tasks and Field Aliases
Datasets - Data models

Knowledge objects can be shared between users, they are reusable, are made of persistent objects that can be used by multiple people or apps, such as macros and reports. They are also searchable since the objects are persistent, they can be used in a search

Splunk Series II: Visualizations

it-learn.io — Mon, 20 Apr 2020 00:00:00 +0000

Visualizations

When a search returns statistical values, the results can be viewed with different visualization types, some of the Visualization types: Statistical Values Charts: Line, column, pie Single Value Visualizations Maps

Charts - Line Chart (Time Series)

Chart - Bubble

Cluster Map

Choropleth Map

What is next?

Filtering/Formatting Data

About the Author:

Andres Sarmiento, CCIE # 53520 (Collaboration) With more than 15 years of experience, Andres is specialized in Unified Communications and Collaboration technologies. Consulted for several companies in South Florida, also Financial Institutions on behalf of Cisco Systems. Andres has been involved in high-profile implementations including Cisco technologies; such as Data Center, UC & Collaboration, Contact Center Express, Routing & Switching, Security and Hosted IPT Service provider infrastructures.

Splunk Series: Basic Search

it-learn.io — Mon, 06 Apr 2020 00:00:00 +0000

Basic search

The search assistant provides a nice way to begin looking up for something in particular. At this stage, you can determine a few different search criteria, such as a term in particular or search directly into a specific Index. The search assistant lets you be flexible and presents you with different options. Before the first pipe 9|), it will look at any matching term.

After the (|) sign you have the ability to start using a list of commands to help you search data, once you hover your mouse over the commands the Assistant will provide you with high-level information on how to use the command.

Splunk Series: Components

it-learn.io — Mon, 06 Apr 2020 00:00:00 +0000

Splunk - Indexer

This is the engine that is in charge of processing machine data, stores the results in indexes as events. This is what allows enabling fast searches and analysis

As data is indexed, Splunk creates files organized in sets of directories by age.

Splunk - Search Head

Splunk has its own Search language, which we will be documenting here in the series as it progresses, in this case, the Search head allows users to search the indexed data. Distributes user search requests to the indexers, and helps consolidate the results based on Field Value Pairs. There is a multitude of different commands and functions that can be used to extract data or put it in a format that can be understood easily.

Splunk Series: Feeding Data to Splunk

it-learn.io — Mon, 06 Apr 2020 00:00:00 +0000

Splunk Index Time Process

Data ingestion for Splunk is broken down into 3 different phases

Input Phase - Data is handled at the source and is usually done by a forwarder
Parsing Phase - Handled by the indexer or Heavy Forwarders, the data is broken into events
Indexing Phase - The license meter runs as data is been written to disk, this happens before the compression of the data. After this process runs the data cannot be changed

Splunk Series: Field searches

it-learn.io — Mon, 06 Apr 2020 00:00:00 +0000

Fields are searchable key/value pairs in your event data Fields can be searched by their name, for example:

area_code=404 action=purchase status=200

When you look for multiple items in the editor an implied AND will be implied unless specified otherwise (AND, OR, NOT) to the search as follows

action=purchase AND status=200

Field Discovery

Splunk automatically discovers many fields based on the sourcetype and key/value pairs in the data

Prior to the search as explained before, some fields are stored with the event in the index

Splunk Series: Overview of Splunk

it-learn.io — Mon, 06 Apr 2020 00:00:00 +0000

What is Splunk

Splunk is many things to different groups in an organization, but mostly is an engine that looks you to visualize data in a way that could be understood by the business, what are few of the things that Splunk can help with:

Application Management
Operations Management
Security and Compliance

Splunk allows you to aggregate, analyze and get answers from your machine data

What Data can Splunk work with?

There are multiple sources of data that can be fed into any Splunk installation, few examples are:

Splunk Series: Saving Search Jobs

it-learn.io — Mon, 06 Apr 2020 00:00:00 +0000

Every search is also a job, which can be paused, stopped, saved and exported.

Here are some interesting things you need to know about Search jobs:

Jobs are available for 10 Minutes (By Default)

Jobs can have the following permissions as part of the configuration when they are saved

Private - Only the creator can access them
Everyone - All app users can see the report
Lifetime - The default is 10 Minutes - Can be extended to live for 7 days, in order to keep your searches for longer you have to schedule a report

Splunk Series: Search Language Syntax

it-learn.io — Mon, 06 Apr 2020 00:00:00 +0000

How is the syntax used in the Search editor

To better explain the syntax of a search is by using the following diagram

The components of the Search

Search Terms –> What you are looking for
Commands –> What do you want to do with the results, chart, statistics, format and so on
Functions –> How do you want to chart, compute or evaluate your result, for example, get a sum, get an average or transform the values, amongs many other functions

Splunk Series: Splunk Deployments

it-learn.io — Mon, 06 Apr 2020 00:00:00 +0000

Addition Splunk Components

There are additional components for a Splunk deployment, here is a list

Deployment Server
Cluster Master
License Master

Standalone Deployment

This deployment is only in 1 server, and all functions needed for this deployment reside on the same server

Searching
Indexing
Parsing
Input

It is recommended to have 1 test or dev set up at your site

A basic Splunk deployment

This setup includes the Splunk Server which will be handling the same functions as a Standalone deployment, however, in this case, all the input is ingested from the Forwarders

Palo Alto Networks - PCNSE Certification - Part 2 - Building a Lab (Where to get Started)

it-learn.io — Tue, 07 Jan 2020 00:00:00 +0000

As with any certification that I attempt I go into it with a mindset of learning by reading, watching videos and doing… Being doing the strongest one in my list of things to do. I want to make sure all the things that I have seen listed in the PCNSE Study Guide I can do, with the exception of the High Availability piece, which I will have. Bait of a hard time using since I only have access to 1 VM.

Palo Alto Networks - PCNSE Certification - Part 1 - Breaking down the Exam Objectives

it-learn.io — Mon, 06 Jan 2020 00:00:00 +0000

As the new year hits, I have new resolutions, and these entail getting my feet wet with Palo Alto Networks, due to my job and many other factors I’m open to learning and get certified on the PCNSE, which stands for Palo Alto Networks Certified Network Security Engineer

The Certification Requirements

This exam contains 75 questions and over 80 minutes - The intended audience are engineers that currently work with Next-generation firewalls and would like to take their knowledge to the next level. They recommend having 3 to 5 years of experience

VIDEO: SD-WAN from Cisco Viptela (SD-WAN Series (Lab 1 - ZTP: P4.3)

it-learn.io — Tue, 10 Dec 2019 00:00:00 +0000

So it was not my intention to make this series as long as it is right now, but hey, its so far lots of fun.

This time I created a quick video of me playing around with vManage and using the Zero-Touch Provisioning feature

The Video

https://youtu.be/AohRDD7KUlY

What to look forward to?

We will play with the Policies, testing Multi-Topology and Strict Hub-n-Spoke

About the Author:

Andres Sarmiento, CCIE # 53520 (Collaboration) With more than 13 years of experience, Andres is specialized in the Unified Communications and Collaboration technologies. Consulted for several companies in South Florida, also Financial Institutions on behalf of Cisco Systems. Andres has been involved in high-profile implementations including Cisco technologies; such as Data Center, UC & Collaboration, Contact Center Express, Routing & Switching, Security and Hosted IPT Service provider infrastructures.

SD-WAN from Cisco Viptela (SD- WAN Series (Components and Technical Info: P4.1)

it-learn.io — Tue, 03 Dec 2019 00:00:00 +0000

Hey all, as the schedule clears up a bit or at least I get the time to scape the routine, I wanted to get a bit time to continue the SD-WAN Series, I know I still have lots of HW to do on this one but here are “My Findings”

The background story on how Cisco entered the SD-WAN Market

Viptela, now known as Cisco SD-WAN is one of the acquisitions Cisco entered to finally get into the SD-WAN market with a product that finally makes sense, as you remember Cisco introduced a flavor of SD-WAN in the market few moons ago with the introduction of IWAN, which is still in production in lots of customer networks. If you are curious as how some of the pieces in IWAN work and to get the foundation make sure you read –> DMVPN Design

Upgrading ESXI from 6.5 to 6.7

it-learn.io — Thu, 21 Nov 2019 00:00:00 +0000

I turned my lab back on!!, and guess what, it was a mess, I lost my vCenter server and well… I’ll stop complaining and jump back into the substance of this post.

Previous steps after losing the Host I had vCenter on

If this has happened to you either in production or in a lab environment, be sure it will not be nice, few of the things I had to deal with:

VMware SD-WAN from VeloCloud (SD- WAN Series: P3)

it-learn.io — Wed, 18 Sep 2019 00:00:00 +0000

First of all big thank you to VMware Hands-On Labs resources, they are great and a very cool way to use for demonstrations and Learning

Lets talk about VMWare SD-WAN by VeloCloud, a company that was a acquired by the virtualization giant back in December 12, 2017 - The company was initially founded in 2012 and had a very successful run on their own and now operate as the SD-WAN arm of VMware.

SD-WAN Terminology (SD- WAN Series: P2)

it-learn.io — Sat, 14 Sep 2019 00:00:00 +0000

SD-WAN is not a new concept that is becoming trendy right now, but is actually something that has been there for a while! (Remember the iWAN days?) - Also there will not be something new or exciting that you maybe have not seen before.

My idea is to keep analyzing the technology and off course have the ability to use it in a lab environment as well as in a Production environment.

SD-WAN Series - The Components (SD- WAN Series: P1)

it-learn.io — Mon, 24 Jun 2019 00:00:00 +0000

Hi there, know it has been a while - to be exact my last post was back in August. A lot has happened since :) - However this post is not about me, but about me and what I have been up to maybe in a different post!

This time I’d like to give the spotlight to the buzz technology that has been out there for a while but with many different names. In my pursuit to understand everything I do and everything I think helps me build on my knowledge, I wanted to dissect few things on SD-WAN - So what better than to come up with a series.

Zero Downtime Upgrades - An upgrade approach to avoid late nights

it-learn.io — Fri, 03 Aug 2018 00:00:00 +0000

Let’s see, it has been a while since the last time you heard from me, but this time I will spare you the excuse!

What is a Zero Downtime Upgrade?

This is an upgrade where no matter from which version of VOS (CUCM, UNITY, and UCCX) you are coming from can be done with very little or zero downtime

The Reasoning behind

Look I have always worked with companies that like their stuff done quickly, efficiently and with minimal downtime. I’m also very lazy, or very practical, so if I don’t have to spend all night doing an upgrade, I simply don’t do it. Now, like everything else, there are a lot of exceptions to the scenario I will be going over on this Post, so keep reading!

Consuming the "Cloud" - How are you doing it?

it-learn.io — Fri, 30 Mar 2018 00:00:00 +0000

Before leaving my previous company there was an interesting trend in the market and industry I have worked for the past few years, and that is that multiple verticals out there are considering moving their traditional premises workloads to the cloud.

That is a beautiful thing, but from my standpoint as an Engineer/Architect, I’m thinking how I’m going to be able to get involved into it? - Smart conversations need to happen and well, I’m usually part of those conversations, or in the room when smart people talks about cloud :)

Cybersecurity - Want to be a Security Analyst? The List of things you need to understand

it-learn.io — Wed, 28 Mar 2018 00:00:00 +0000

To better understand what are the domains that are part of CyberSecurity is better to identify them individually and make sure we all know what to expect to learn more and more about it.

Currently the Cybersecurity tracks, like Cisco’s, make emphasis on you preparing you to be a Security Analyst Level I - Remember that all the Associate certifications are the ones validates that you can be the first knowledgeable level of contact in the enterprise. In this case Cisco Cybersecurity Operations CCNA is not different.

Introduction to CyberSecEngineer Blog

it-learn.io — Wed, 28 Mar 2018 00:00:00 +0000

I have recently started a class on CyberSecurity offered by Cisco, and have been hooked into the material and the things that this class offers.

If you know me, you will know that I have always been a hybrid engineer, I have done few things from Network, Security, Data Center and Collaboration. With the last one being what I specialize on and what I’d like to call the profession that pays my bills :)

The Job Description of a Security Analyst

it-learn.io — Wed, 28 Mar 2018 00:00:00 +0000

Thinking on few things that can help people out there to begin or advance in a career in IT Security or Cybersecurity. I had to get some information about this from a Job description of what companies are looking for in candidates, just because, yeah Andres had to find out, and help the now growing audience of CyberSecEngineer

Disclaimer

I may not be the right person for specific career advise on Cyber Security, however, I will/should/could be able to provide a high-level overview of how things work from a career point of view, if you are interested in such thing, make sure you ask me using the comments section, and I will do my best to reply ** I hope the comments section work :)

Training on Cybersecurity and what is out there?

it-learn.io — Wed, 28 Mar 2018 00:00:00 +0000

I looove free and fun stuff to do when I’m training, and I also like to pay for training when is good. With that in mind, this post will be a collection of the training that I have found or will find in the future, so that it can be listed on this site.

Remember, if you know of any training that you think is sooooo cool that needs to be mentioned or announced, please feel free to reach out in the comments post, I will happily add that information.

The Anatomy of a Call Recording Service - Cisco Unified Communications Manager

it-learn.io — Fri, 09 Feb 2018 00:00:00 +0000

Call recording is an interesting topic for me and it’s sometimes hard to understand, but It’s easy when you break it down to get what it is all about.

My experience varies from different vendors and most of it comes to the same place, at least when preparing CUCM for Recording services. This post is just to go over what is involved form CUCM’s preparation and a bit of an explanation when possible :)

Implement NetFlow IOS-XE with NBAR Discovery

it-learn.io — Tue, 23 Jan 2018 00:00:00 +0000

I’m pretty sure that there are many examples out there to create NetFlow configuration and very well documented as well, however, I wanted to give my config a crack and also wanted to share. I’m adding one more bit of information as it is very useful to keep your network on-check, and that is the NBAR addition.

Which Direction for NetFlow?

I have read somewhere, and I refuse to look for the document again, thinking it was from Lancope’s website, but I remember reading that NetFlow works better if applied in only one direction. Pretty sure that many people out there will have their opinions and reasons to do it in very different directions on the same interface, but after lots of thinking, it made sense to me.

CCNP Security 300-206 (SENSS) - The After Math of the Exam - Useful Links

it-learn.io — Mon, 22 Jan 2018 00:00:00 +0000

I finished last year with an incomplete challenge and lots of things in my to-do list. This exam was one of them, so I ended up moving lots of my objectives to 2018

I presented this exam at the beginning of November-17 and failed with few or a lot of incorrect questions. It really took me by surprise some of the things that I thought I knew needed more re-enforcing on my end. It is also very important to understand that these exams are also created with technology in mind, and many of them get to be un-updated for a while, so I was also tested on things that are End of Life (which I think got the best of me)

Denial of Service Attack Prevention (IOS)

it-learn.io — Mon, 22 Jan 2018 00:00:00 +0000

As part of the CCNP Security 300-206 (SENSS) - I have found interesting topics along the ways and this one catches my attention. So here is a quick high-level overview + some configuration examples on IP TCP Intercept

What TCP Intercept is looking to prevent?

This feature looks to prevent Denial of Service Attacks, by limiting incomplete connections to a host, in this case, a Web Server could be a good example.

CUCM - Moving CUCM Publisher - Change IP address

it-learn.io — Thu, 28 Dec 2017 00:00:00 +0000

Where do we begin with this one? - Here is your ticket and before you go to the next section of this post, make sure you have a quick answer.

The Ticket/Challenge **Trying not to call it a problem!

Your client needs to move from a Datacenter to a new location. You need to move the CUCM Publisher and be able to do it also by changing the IP address, with minimum service impact as possible

CUCM - Unable to add SFTP Backup Device - Some Linux stuff

it-learn.io — Wed, 27 Dec 2017 00:00:00 +0000

Few weeks have gone by and I have not written anything for a while **But I still have lots of Drafts in the works. Job has been a bit busy this time of the year so that’s my excuse and I will stick to it :)

If you are a UC and Collaboration engineer, you may have under your sleeve few cool solutions to backup your Apps. Well, I have a few too, and I used to crash a lot with the FREE SolarWinds app. But for some reason, this app sometimes fails.

MacOS High Sierra Vulnerability - It's true!

it-learn.io — Tue, 28 Nov 2017 00:00:00 +0000

A quick and short post just to advice MAC users to change their root Password as soon as possible

The issue

A quick excerpt of the newly discovered vulnerability - Credit KrebsonSecurity - MacOS High Sierra Users: Change Root Password Now

A newly-discovered flaw in macOS High Sierra — Apple’s latest iteration of its operating system — allows anyone with local (and, apparently in some cases, remote) access to the machine to log in as the all-powerful “root” user without supplying a password. Fortunately, there is a simple fix for this until Apple patches this inexplicable bug: Change the root account’s password now

Overview of Cisco Prime Infrastructure 3.1.0

it-learn.io — Wed, 15 Nov 2017 00:00:00 +0000

Ok, I’m going to give this one a try, and hope all readers help me keep myself honest on this one. Initially, the title of this Post was based on CCNP Security and Cisco Prime Infrastructure Security Use Cases.

So I have been looking for some Security use cases with Cisco Prime Infrastructure, and I think I found some based on correlation and other important things the tool has to offer.

Bundle T1's for MPLS and Internet Connectivity MFR Interface Configuration Example

it-learn.io — Tue, 14 Nov 2017 00:00:00 +0000

Picture this, you have been given a provisional WAN circuit using a T1, or multiple, in this particular use case; The provider is connecting you to its MPLS network, which provides you with an MPLS WAN address, an Internet WAN address.

This is simple for many out there, but it was not for me until not too long ago. I realize that in all of my turn ups I have been given an ethernet Hand off, and from there is just making a “Routing on a Stick” configuration and I will be calling it a day.

VIDEO: CCNP Security 300-206 (SENSS) - Installing Cisco ACS on VMWware

it-learn.io — Thu, 09 Nov 2017 00:00:00 +0000

A quick video on how to install Cisco ACS Version 5.8

Here are the VM Requirements:

Minimum Requirements

CPU 2 CPUs (dual CPU, Xeon, Core2 Duo or 2 single CPUs) 2 GHz CPU speed

Memory 4 GB RAM

Hard Disk A minimum of 60 GB is required.

Maximum storage is up to 750 GB. Note: ACS partitions the available disk space automatically during the installation process.

Note: It is recommended that you allocate the hard disk size to be greater than 500 GB for the secondary instance, which acts as a log collector.

VIDEO: CCNP Security 300-206 (SENSS) - Building a quick Virtual Lab

it-learn.io — Wed, 08 Nov 2017 00:00:00 +0000

To all visual learners, like me, and to the ones that need to do the stuff in order to learn. Also for the love of virtualization, I thought it will be a good idea to include videos and demonstrations on how things could be done.

The Video

https://youtu.be/XSsrW1gFx3A

The Content

This is just going over the installation of an ASAv and a CSR1000v

What will be next?

There will be some more content on the installation of ACS, hopefully, sooner than later

A quick overview of Cisco Security Manager

it-learn.io — Tue, 07 Nov 2017 00:00:00 +0000

Looking at the Objectives and the Exam topics, I found something that I was not entirely familiar and decided to take a look at it. At this point, I’m not sure if Cisco Security Manager is still something that is worth taking a look at or a product that is widely used by Security professionals in the field.

I asked around with a few colleagues and all of them agreed that CSM was already faced out by other tools, like Cisco Firepower Management Console and even other third-party integrations out there.

CCNP Security 300-206 (SENSS) - My Lab Infrastructure

it-learn.io — Thu, 02 Nov 2017 00:00:00 +0000

So like anything else, is just very hard for me to begin something without first coming up with a plan, so I decided to treat this as a project, with planning and designing included into it.

The main constraint you may ask if any? Time, so time is valuable and the day of my first exam approaches very quickly, I have been doing lots of studying so far and also labs here and there, also I’m very familiar with the topics on SENSS, so hopefully, I can knock it down with no problems. But this time is different, I want to share all the ride with the people that read this blog.

CCNP Security 300-206 (SENSS) - Introductory Post

it-learn.io — Tue, 31 Oct 2017 00:00:00 +0000

If you have read this blog before you will notice that I have lots of stuff going on some good and some meh!, from Collaboration, Security, Enterprise Networks and some other stuff non-related to Cisco, which I recommend you checking out in case you are interested. Initially, I started sharing my Journey to the CCIE Collaboration back in 2014. I completed my adventure last year (2016), and I’m very happy to say that I fully enjoyed the ride. Now I would like to focus most of my posts on Security and on my ride on completing my CCNP Security following it up with the CCIE Security by the beginning of next year (hope it works). UC and Collaboration will still be playing a HUGE roll into my writing as I find it very fun! and I still have LOTS of pending posts and Videos

CUCM Management affected CUCM 11.5(1) - Case Sensitivity

it-learn.io — Mon, 30 Oct 2017 00:00:00 +0000

In case you are hit with this bug the solution is very simple, but asks the question, is it really necessary creating the UserID in AD with a combination of UPPER CASE and lower case?

Here is the Scenario

CUCM implementation of 11.5(1) with AD/LDAP authentication, once users are synced with LDAP you proceed to assign Power Users under End User Administration. All is fine but such users have their user ID as follows: AD UserID: WUser

Importing hosts into SecureCRT

it-learn.io — Mon, 25 Sep 2017 00:00:00 +0000

I have always tried to use something like this in the past, but with no luck, by digging a bit deeper into it I found how to import hosts into SecureCRT.

This is the Link that goes over the process of importing data and what is relevant for the import:

https://www.vandyke.com/support/tips/importsessions.html

For Python or VBS here are the scripts:

https://forums.vandyke.com/showthread.php?p=37089#post37089

Here a quick sample of the data and how needs to go, I used the Python script, I decided not to use the .csv format, instead, I used .txt to save my data

Documentation - Playing with SecureCRT - Log to File and Simple Automation Python Script

it-learn.io — Mon, 24 Jul 2017 00:00:00 +0000

Being clear from the beginning of the post here are some disclaimers I have:

I’m not an expert, I just like messing around with stuff that saves me time
The automation piece is a simple script in Python that is created from SecureCRT automatically

Now, as I document my projects, I have to find a way to provide my clients with meaningful information on what was what I did in their environment. I know engineers out there that hate documentation… me too, but when I do Documentation I just think like my client will think

Cisco Systems - The Security Portfolio

it-learn.io — Tue, 11 Jul 2017 00:00:00 +0000

Looking to get a better picture of the Security Portfolio from Cisco I thought it will be a good idea to have a document handy. I know that this list may be obsolete at some point but will help illustrate what I’m trying to achieve today :)

It is a reality that Security is right now the main focus of any company out there, if not and you are asking yourself why? then you should be worried.

CLUS17: Security Monitoring with StealthWatch - A quick Overview and Thoughts

it-learn.io — Mon, 10 Jul 2017 00:00:00 +0000

My Cisco live experience was focused on 80% Security and 20% Collaboration. One of the sessions I assisted last week was the one related to StealthWatch and Security Monitoring, an interesting new topic for me and one that opens my brain for more questions.

The Security portfolio from Cisco is still huge for me, but I remember saying that when I was starting on my CCIE Collaboration journey a few years back. Remember the Before During and After Attack continuum from Cisco? - Yes, I remember and made my mission to know how all the pieces fit together.

CLUS17: Cisco Spark all over CLUS - All Breakout Sessions need a Space, so all Sessions had a Space :)

it-learn.io — Fri, 07 Jul 2017 00:00:00 +0000

This is going to be my Feedback on the Breakout sessions, as expected Cisco was ready for the challenge and the questions.

I really don’t know if CLUS had the ability for you to join a Spark room simultaneously to the session, at least not in my previous CLUS over in 2014, when I guess it was called Project Squared. My experience was really good with this new feature and helped very much to be engaged in the conversation.

CLUS17: Contact Center Reporting : Cisco Unified Intelligence Center

it-learn.io — Thu, 06 Jul 2017 00:00:00 +0000

I’m making contact back from Cisco Live with many interesting things to show and tell, so I decided I would write small pieces of the information I digested from the conference.

I will start it off by mentioning where to locate the presentation that was used for this session, to follow along with all the things that I will be covering. Eventually all videos on the session will be uploaded to the ciscolive.com on Demand Library

DMVPN Design using FrontDoor VRF

it-learn.io — Wed, 21 Jun 2017 00:00:00 +0000

This posts looks more to analyze few design questions and good information on how to complete a successful DMVPN implementation, other than a focus on the configuration. And last but not least, to start a conversation and hear more about what would you do in cases like this (There are many ways to skin a cat!!)

A short background on what got me to this:

I have been most of my Professional career focused on UC and Collaboration technologies until not too long ago that I decided that I wanted to get involved with Security and Networks again. At this point my focus is to be able to maintain a good deal of knowledge on the technologies that cover all Cisco Security suite, but UC is still a great part on what I do daily at my current position.

UCCX 11.5 Tomcat and Tomcat-ECDSA certificates for Cisco Finesse CUIC and the Admin Pages

it-learn.io — Thu, 20 Apr 2017 00:00:00 +0000

I keep hearing about many engineers out there with issues related to the UCCX certificates and the ECDSA certificate used by few services on UCCX. I wanted to create this quick post to help others and Document the procedure.

The certificates Overview

I will go back a bit to give you a quick overview on the UCCX certificates, but not too far back. UCCX uses Self-Signed certificates out of the box for Secure connectivity using your browser (Nothing new here) - However, since UCCX 11.5 there is a new Tomcat Certificate called Elliptic Curve Digital Signature Algorithm, ECDSA for short. If you want to find out more about these type of certificates feel free to visit (https://www.maximintegrated.com/en/app-notes/index.mvp/id/5767)

UCCX Labs - Compilation of Videos and Posts for getting Familiar with UCCX

it-learn.io — Wed, 19 Apr 2017 00:00:00 +0000

As you have been seeing over the last couple of months, I have been actively creating videos and posts about UCCX in General. So I wanted to create a new Post which will mark the first milestone of the series of UCCX Labs.

Video Collection:

The following list compiles all the videos that I have created, using my approach to create a Successful Contact Center deployment.

Integrating CUCM and UCCX

Video - UCCX Labs - Upgrade from 10.6 to 11.5

it-learn.io — Tue, 18 Apr 2017 00:00:00 +0000

A quick video on how to upgrade from version 10.6 to 11.5 - also some good information on the process.

The Video

The Content

On this video I go over the Upgrade from UCCX 10.6 to 11.5

What to look Forward to?

I have created these videos to help others on how to get familiar with UCCX. I will continue creating more videos as I’m going, I hope you enjoy them!

Video - UCCX 10.6 Labs - Working with a script, creating the auto attendant and looking at the logic of the script

it-learn.io — Wed, 12 Apr 2017 00:00:00 +0000

This video goes over working with the UCCX Script editor and the Steps

The Video

The Content

Looking at the Script Logic, how to use Labels, GoTo’s, Menus and a bit more

What to look Forward to?

Expect more videos coming in the next days

About the Author:

Video - UCCX 10.6 Labs - Looking at Resources, creating the first queuing script, testing basic queuing

it-learn.io — Tue, 11 Apr 2017 00:00:00 +0000

This video looks at resources to get more information on how to use UCCX and the Scripts configuration. Also goes over the configuration of a queuing script using the stock ICD script

The Video

The Content

DevNet Resources Script Repository Modifying the ICD Script

What to look forward to?

About the Author:

Video - Setting up a CIsco Collaboration Lab - SIP Trunk from UC520 to CUCM 11.5

it-learn.io — Mon, 10 Apr 2017 00:00:00 +0000

Quick video warming up, ready to finish the UCCX series video on 10.6 - so I needed a way to test calling from my home phone to my lab

The Video

The Content

Just basic troubleshooting of a call from UC520 to CUCM using SIP protocol

What to look forward to?

Not much really on this one, just getting ready to additional videos and testing - enjoy!

About the Author:

UCCX 11.5 Hostname must be in lower case and the character limit is 24 characters

it-learn.io — Thu, 06 Apr 2017 00:00:00 +0000

Yesterday I got bitten by this one… It really has been my first encounter with this issue. In all honesty I did not know this was a thing until yesterday. So I hope that you can use this to your advantage and on the planning of a successful UCCX Deployment.

The Issue

Replication was not working properly after adding the secondary node. As stated in the Administration Guide “Hostname must be in lower case and the character limit is 24 characters.”

No voice-port when using NIM-1CE1T1-PRI - From Cisco Support community

it-learn.io — Wed, 05 Apr 2017 00:00:00 +0000

I love the Cisco Support community, and credit should be given to all the people out there that work very hard on UC and Collaboration.

Last night I was trying to turn up a PRI (Yeah, old technology right?) - So a client is terminating a PRI back to back with their equipment and on my CUBE router (ISR4331) I’m terminating the PRI and sending the calls to IPFLEX, sound like fun!

Fix for the Apache Struts2 Vulnerability on UCCX (CSCvd63322) - Posted to CCO

it-learn.io — Tue, 04 Apr 2017 00:00:00 +0000

I rarely post twice in the same day and most if it is scheduled from days before, however, I thought this one was important. Cisco just released the following fix that looks to address/patch this vulnerability.

Here is the CCO Link to download and install the patch on your new and upgraded UCCX 11.5 servers

Here is the link to (http://www.cisco.com/web/software/280840578/134989/ReadMe-UCCX-11.5-struts2-fix.pdf) (Not really much information on what the whole thing, but just the installation instructions)

UCCX - Contact Center Express Implementation and Configuration Flow

it-learn.io — Tue, 04 Apr 2017 00:00:00 +0000

As a way to complete my very long post from last week, I decided that I needed a nice and easy way to keep myself in check when configuring and installing UCCX, so I decided to create the flow you see in the picture above. All to help me and others

The Content

The idea of this quick diagram is to guide you/me through a successful installation of a Cisco Contact Center Express.

Planning a successful Contact Center implementation using Cisco UCCX

it-learn.io — Fri, 31 Mar 2017 00:00:00 +0000

9-12-2019 Edit –> Added the Excel Spreadsheet on Planning a successful Contact Center implementation using Cisco UCCX.xslx

As you may know, I’m very much into contact center stuff, and I have been creating different videos, but I really got worried because there are so many things to show and do on UCCX, and I did not have a road-map or a document to use to base my configurations on.

I decided that I needed a Design and a Planning session with myself and created this document.

Because not all Contact centers are the same - First look at Amazon Connect and how easy it is to use

it-learn.io — Thu, 30 Mar 2017 00:00:00 +0000

Unified Communications and Collaboration is being getting so much speed in the last few months. There are many great and incredible additions from many big vendors out there, such as Cisco, Google, Microsoft and now Amazon is also playing on this space (I think it has been for a while).

Amazon came up with another scary easy to use solution, this time for contact centers. the product is called Amazon Connect - I heard about the product yesterday from a co-worker that was at #EC17 and I heard it was really easy to use, so I could not resist and had to take a look at it.

Cisco Identity Services Engine 2.2 (ISE) New feature-set

it-learn.io — Wed, 29 Mar 2017 00:00:00 +0000

There is a constant evolution of security technologies and also Security threats, which makes the need for additional and enhanced visibility of the network. Cisco keeps on improving its Security portfolio, and this time I’m looking more closely at the Cisco Identity Services Engine. At a first glance, to me it looked like just an 802.1x solution with very complicated features.

I decided that I wanted to get more involved, and I have been working with the product for the last month in a more serious note this time, trying to understand the product I decided to make a list with important Features that are packed into the solution

Invalid Server Certificate - activating Spark Phone with Meraki Infrastructure WBX000023772

it-learn.io — Tue, 28 Mar 2017 00:00:00 +0000

This will be a quick post, with a quick issue and the solution.

The issue

Some new phones needed to be activated along with a full network infrastructure deployment using Meraki gear. Meraki in my eyes was scary easy to set up, also thankfully it was already set-up for me on the cloud by a co-worker in advance.

When it was time to activate the new Spark phones, I was receiving a weird “Invalid Certificate” message that I’d never seen before. basically when receiving these type of errors, few things could be happening:

Cisco and the Always Evolving Security Portfolio of Solutions - Fire Jumper

it-learn.io — Mon, 27 Mar 2017 00:00:00 +0000

Last week I had the pleasure to attend a Fire Jumper Achievement classes, and it was a great eye opener for me. Security products have changed and evolved tremendously over the past few years, this evolution is due to the constant changing Attack vectors users and companies experience out there in the wild.

The Attack Continuum

Cisco has a good strategy to address Security threats into different phases that could be possible in an attack. Understanding that there is not one “Perfect Solution” is part of the play. They do a great job to explain the different aspects of a security attack by breaking it down into 3 phases: Before, During and After. I also think that Cisco understands that there are very advanced and sophisticated attacks, which can bypass IPS systems, Firewall Rules and other security measures you may have at the edge, along with the security that you can deploy at the core of your infrastructure, on services such as DNS, Web and Email traffic among others.

Video - UCCX 10.6 Labs - Understanding the CCX Editor, Validating a Script, Using the Reactive Script for Debugging

it-learn.io — Fri, 24 Mar 2017 00:00:00 +0000

The Video

Quick video on few interesting things about UCCX 10.6

https://youtu.be/gYhkNNhVVSI

The Content

This video is about understanding tools available in UCCX

CCX Editor
CCX Editor Functions and Steps
Validating a UCCX Script
Using the Reactive Script for Debugging

What to look forward to?

As we get ready to implement a full solution, there will coming videos to cover the creation of UCCX applications and how they can be integrated into Production

Video - UCCX 10.6 Labs - rmcm user, jtapi user, skills, resource groups, contact service queues, resources, teams

it-learn.io — Thu, 23 Mar 2017 00:00:00 +0000

The Video

Continuation video from the UCCX Labs series. Going over some more preparation in CUCM and UCCX

https://youtu.be/204pr0orvyA

The Content

This is a video that shows the building blocks of a typical UCCX Configuration

Using the RMCM User
What is the JTAPI user needed for
Creating Skills
Creating Resource Groups
Creating Contact Service Groups
Creating/Adding Resources from CUCM to UCCX
Creating Teams

What to Look forward to?

After few weeks I continue the videos showing basic things, along with quick tricks that can be applied to any deployment or situation in real world.

Video - UCCX 10.6 SU2 Labs - CUCM Device Preparation - CTI Ports - CTI Route Points - Auto Attendant

it-learn.io — Wed, 22 Mar 2017 00:00:00 +0000

A quick video showing considerations and things to do to successfully configure and make UCCX work properly

The Video

https://youtu.be/7hthzA30s5A

The content

The video goes over:

Description of what we are doing
Creating Users
Creating CTI Ports or Port Control Groups
Creating a Trigger or CTI Route Point
Creating a UCCX Application and assigning a Script
Testing the UCCX Auto Attendant

What to look forward to?

I hope you enjoy looking at the videos, in case you have questions or doubts, please feel free to contact me

A Collaboration Cloud Lab vs a Collaboration Home Lab

it-learn.io — Tue, 28 Feb 2017 00:00:00 +0000

So, the question is, what is a better choice to get started with a Lab, and begin creating your own configurations? - Here is a list of the benefits from a Cloud Vs Home Lab

The difference between a Cloud lab and a Home lab

Cloud Lab (dCLoud and DevNet)

If you are one of those weird people that don’t want to run CUCM, UNITY Connection, IM & Presence, Jabber and other UC apps in your house, you are in luck. Cisco dCloud + Devnet Sandboxes are what you are in the business for.

CCIE Certifications Changing to Agile and Modular Revision Cycles

it-learn.io — Fri, 24 Feb 2017 00:00:00 +0000

A nice email with this information may have gotten to your Mailbox today. The email opens up a new methodology called agile, wich will be used going forward.

What do these changes mean?

For what I read so far and what I have been able to research, means that there will be minor revisions every year, these revisions will bring at least 20% of changes with what you are being asked in the test. Also, there will be major changes to blueprints and actual exams every 3 to 5 years, such changes should reflect between a 50% to an 80%

Video: Setting up a Collaboration Lab - Integrating CUCM and UCCX

it-learn.io — Thu, 16 Feb 2017 00:00:00 +0000

Video detailing the basic steps to integrate CUCM and Contact Center Express

The Video

https://www.youtube.com/watch?v=7qtY2g1HZrE

The Content

Get the configuration started
JTAPI/CTI Users
Getting an Admin User

What to look forward to?

I’m having too much fun with these videos and I think I will keep on doing them, of course, as time permits

About the Author:

Video: Setting up a Collaboration Lab - Licensing CUCM and UNITY

it-learn.io — Wed, 15 Feb 2017 00:00:00 +0000

Video is about how to License CUCM and UNITY Connection (Using NFR Licenses), same applies for regular licenses

The Video

https://www.youtube.com/watch?v=337Wg1aZMRg

The Content

Go to Cisco Licensing
Generate License from PAK
Add CUCM and UNITY to Prime Licensing Manager
Generate Licensing Request
Install Licensing File
Verify Licensing

What to look forward to

The videos are a cool way for me to keep things interesting and provide help for people that have questions.

Video: Setting up a Collaboration Lab - Installing Trusted Certificates

it-learn.io — Tue, 14 Feb 2017 00:00:00 +0000

This is a quick video on how to install Trusted Certificates to any of your UC and Collaboration servers

The Video

https://www.youtube.com/watch?v=6UW1dEltNYw

The Content

Using Windows CA Role to generate Certificates
Generate the CSR
Upload ROOT CA Certificate as “tomcat-trust”
Upload Signed Certificate as “tomcat”

What to look forward to?

As time permits I will keep creating the videos and continue with the labs

About the Author:

Video: Setting up a Cisco Collaboration Lab - Installing CUCM

it-learn.io — Wed, 01 Feb 2017 00:00:00 +0000

The continuation from Yesterday is here, not too much. I’m trying to make them shorter so that they can be easily watched.

The Video

The Content

Requirements for CUCM 11.5 (SU2)
Setup DNS Records
Setup NTP Server
Test Connectivity before installation (Connectivity tricks)

What to look forward to?

As time permits I will keep creating the videos and continue with the labs

About the Author:

Video: Setting up a Cisco Collaboration Lab - Preparation

it-learn.io — Tue, 31 Jan 2017 00:00:00 +0000

This is going to be the first of few videos that I’m creating on how to set up a Cisco Collaboration Lab.

This is just to get a baseline ready for starting configuring CUCM and other UC applications but today is just CUCM Preparation. I prefer looking at the video in Speed x1.39 - I noticed I’m a slow talker :) hope you enjoy the video.

The Video

The Content

I describe in a very high level how I’m running my lab

Rebuilding CUCM from an Export - Common issues and solutions

it-learn.io — Mon, 30 Jan 2017 00:00:00 +0000

Here is something that I should have posted few weeks ago, but I have been very busy lately, a sign that the New year took off very strong.

The Scenario

Sometimes your CUCM server is out of any hope, full of bugs and issues after issues, yes I’m talking about CUCM version 11.0 - .0 versions are really hard on Delivery Engineers, because the solution is not as stable as Cisco says it is.

Adventures with OpenStack - Learning what's inside

it-learn.io — Tue, 13 Dec 2016 00:00:00 +0000

When I heard about OpenStack for the first time I was very confused, so I want to share in my own words (Hope I don’t confuse you more), what is the deal with OpenStack.

OpenStack maybe so many things for different people, but I decided to unveil the doubt and take it for a spin in my lab. I’m still learning and as I have said before, is just baby steps, and I still have not seen the tip of the iceberg, there is still too much to learn.

Tropo Series: Creating a Voicemail Application with Tropo - That simple really?

it-learn.io — Mon, 21 Nov 2016 00:00:00 +0000

I’m a bit surprised and impressed on the capabilities of Tropo, and this small post will show you why.

Here is a quick and short tutorial on how to create a Voicemail application at the Tropo site

The Code [PYTHON]

Here is the sample code in Python, I believe this one is more readable for me… JavaScript is the next best option

record(“Please leave your message at the beep. Press pound when finished to listen to your recording.”, { “beep”:true, “timeout”:10, “silenceTimeout”:7, “maxTime”:60, “terminator”:"#", “recordURI”:“http://www.example.com/recording.py", “transcriptionOutURI”:“mailto:you@example.com”, “onRecord”: lambda event : say(“You said " + event.recordURI) })

Tropo Series: Good resources to keep around when playing with the Tropo Scripting API

it-learn.io — Fri, 18 Nov 2016 00:00:00 +0000

If you are experiencing and learning how to play with Tropo, make sure you check all these tools, it really make sense and are very easy to use.

Speaking Languages

In case you are in need to get a full list of Spoken Languages and different styles, make sure you look the page

Speaking Multiple Languages

** I have to admit, in my native language it sounds very good, I bet that the others is just great

Tropo Series: Ready to get Started with Tropo?

it-learn.io — Thu, 17 Nov 2016 00:00:00 +0000

In case you are interested in getting your hands dirty with Tropo, here is some handy information

What is Tropo?

Tropo is a company that Cisco aquired not too long ago, but to be short and sweet, Tropo is a “cloud API platform that simplifies the addition of real-time communications and collaboration capabilities within applications” from Wikipedia

What is possible with Tropo?

I’m a UC and Collaboration guy, and the first time I heard of Tropo so many ideas came to my mind.

Auto Registration CUCM 11.5 (Video)

it-learn.io — Wed, 16 Nov 2016 00:00:00 +0000

This is a video I created, showing how auto registration works in CUCM 11.5

Not too much really, but I think I will get better as I start working more in my editing skills and being a bit less nervous

Enjoy

About the Author:

Changing the hostname of Unity Connection - why would you?

it-learn.io — Mon, 14 Nov 2016 00:00:00 +0000

In case you were wondering, if there was a way to change the name of a Unity Connection server… of course there is a way… Now, the question is, would you do it?

So in this case I will go with the Cisco Prime Collaboration Deployment to even think about tackling this one. Seems that there is a function that will assist you on doing that. I guess I will definitely take a look at that and share my experience with you in the near future, as I keep advancing on creating more content that is keeping me distracted, but hang in there, cools stuff is coming soon :)

Configuring a Cisco IOS Router to act as a DNS Server

it-learn.io — Fri, 04 Nov 2016 00:00:00 +0000

Have you ever had the need to have a quick DNS server at hand? - This is very useful when configuring UCCX 9.x and above in a lab environment with no DNS Server.

At this point I’m not really sure if this DNS configuration will support more advanced configurations, like SRV records or anything of that nature, but I guess is a good start to begin testing it and see if there is more to it.

Creating "Zaps" with Cisco Spark and Zapier

it-learn.io — Wed, 26 Oct 2016 00:00:00 +0000

Since we ran out of space in our last post (I think it was too long!), I have created this one, to expand a bit more on the Integrations. There are many ways to integrate Spark into our software and things that we do that I wanted to dedicate this Post to something useful.

In this post we are going to create a Form from Wufoo, and when the form is filled out, you will be invited to join my Collaboration Room in Spark. Lets Give it a try!

Want to know how to start using Spark? it's FREE and useful - lets meet in Spark

it-learn.io — Tue, 25 Oct 2016 00:00:00 +0000

Cisco spark is a great and useful cloud collaboration tool that integrates Messaging, Calling and Meeting features very nicely. Shortly in this post I will be sharing interesting features that I think you can begin leveraging at work. I will also show a sneak peak of things that you can start using right of the box.

How do I get started with Cisco Spark?

The first thing you are going to do is register with Cisco Spark, its FREE, follow this link Cisco Spark

Lab for Cisco APIC-EM and my feedback

it-learn.io — Mon, 24 Oct 2016 00:00:00 +0000

I’m sure that by now there is lots of people already working and playing on the Cisco APIC-EM. I finally had the opportunity this week to attend to a Cisco APIC-EM hands on lab. Let me begin by telling you that I was very impressed with the quality and the functionality of the software.

The general idea from APIC-EM is to provide provisioning, inventory and networking path tracing among others… I think this description is short and loose from what the application itself can accomplish.

Directory lookup not working - Unified Attendant Console Standard V11.0.2.

it-learn.io — Fri, 21 Oct 2016 00:00:00 +0000

In some cases when you complete the installation of the Attendant Console Standard, you may notice that the Directory lookup is not working. You may ask yourself, what could be the issue.

The issue

Plain and simple, the Attendant console is not able to return any information from the Directory

The Solution

At the installation stage you will be asked to provide the IP address of the CUCM server and the User name and password of the Console User:

Fix for Unified Attendant Console Standard V11.0.2.2571 - CSCva24885

it-learn.io — Fri, 21 Oct 2016 00:00:00 +0000

As you may know with he release of CUCM 11.5 there were lots of issues with the Attendant Console applications, one of the related to a bug defect CSCva24885. September 16 there was a new update and instructions on how to install the attendant Console with CUCM 11.x

This post looks at 2 different levels of issues, the actual technical issue and discrepancies on Documentation for the solution. Also the post is looking to point out the solutions that are provided, in hopes that you can finally solve the issues you are currently having with your install

Introduction to Projects from Collaboration Engineer

it-learn.io — Tue, 18 Oct 2016 00:00:00 +0000

I’m very excited to announce that the Collaboration Engineer site is evolving into a solution repository for Engineers, I started this project as a way for me to document my studies and achieve my CCIE in Collaboration. I completed my task few months ago, along the way I was introduced to exciting technologies and interesting things into the Cisco Collaboration arena, and I now feel that I want to share all things have come across, and introduce it to whomever will make use of the information I will be blogging about.

TED Talk 10-Pack: Security Lectures

it-learn.io — Mon, 15 Aug 2016 00:00:00 +0000

Following up on my (http://collabengineer.com/2016/06/15/cisco-puts-10-million-cisco-for-cisco-cyber-security-scholarships/) and my sudden interest into Security I wanted to share the following information in case you did not receive it.

If you signed up for the Scholarship program Cisco started couple of months back you should have received the following link.

TED Talk 10-Pack

Here is a breakdown of the videos:

Andres Sarmiento CCIE # 53520 - 4th Time was the charm - CCIE Collaboration, Passing the Lab and recommendations!

it-learn.io — Wed, 20 Jul 2016 00:00:00 +0000

Passing the CCIE Collaboration Lab was really hard and a very nice and entertaining experience, which I feel very happy to say that I completed the challenge!!

I will be very short on this post and will make it technical and a bit emotional for the people out there that may benefit from it at all

How many times is enough?

Well I started this year thinking that it was going to take as many times as it needed to take… Financially this could be brutal and indeed it is. But the reality is that you need to make everything possible to make it happen. Just make sure you will get it, no matter what! and put every effort possible to achieve the goal.

{uccx scripting tips & tricks: generating prompts}

it-learn.io — Mon, 11 Jul 2016 00:00:00 +0000

adding this one to my toolbox! - Thank You Sam!

Cisco puts $10 Million Cisco for Cisco Cyber Security Scholarships

it-learn.io — Wed, 15 Jun 2016 00:00:00 +0000

I read this one the other day and posted it in my Facebook account. But I really wanted to dig deep into it and learn more about it.

Here are some highlights from Cisco’s latest publication on this one and on their Security program.

New Certification CCNA Cyber Ops

Cisco introduces its new CCNA Cyber Security Ops certification, more information in the following link: http://www.cisco.com/c/en/us/training-events/training-certifications/certifications/associate/ccna-cyber-ops.html

A deeper look into requirements and the blue print of the exam(s) can be found on the Cisco’s training website, but I wanted to save you time and list the exam topics and the % on each one of the topics:

CUCM 11.5 is here and with it, deprecated phones announcement

it-learn.io — Wed, 15 Jun 2016 00:00:00 +0000

Looking for more information on this one, is always good idea to look at the field notices on CCO.

In a nutshell here is a list of the phones that will no longer be supported by CUCM on version 11.5

Problem Description

The following phone models are deprecated and are not supported by Cisco Unified Communications Manager Release 11.5(x). If you are using any of these phone models and you upgrade to release 11.5(x), you will be unable to use the phone after the upgrade. After you switch over to the new release, registration on the phone will be blocked.

Combining 2 ISO files into 1 - CUCM pre-8.x Installation

it-learn.io — Thu, 05 May 2016 00:00:00 +0000

A quick one and hopefully you don’t get to see this moving forward.

Long time ago Cisco used to provide images on CCO that were divided in 2 parts, for upgrades and patches, I started working with those images since everybody started migrating from older versions to 9.x which is when I officially working as a consultant.

How to join or combine these 2 ISO image?

Windows:

coby /b UCSInstall_UCOS_6.1.3.1000-16.sgn.iso_part1of2+UCSInstall_UCOS_6.1.3.1000-16.sgn.iso_part2of2 UCSInstall_UCOS_6.1.3.1000-16.sgn.iso

How to install vSphere 5.5 client on a domain controller

it-learn.io — Wed, 04 May 2016 00:00:00 +0000

Always give credit where credit is due. Looking for a simple solution I found the following article:

(http://www.josephturley.com/install-vsphere-5-5-client-domain-controller/) - Thank You Joseph Turley

But in summary and just in case you are one of the ones that just look for the solution and not the entire blog post, here is how you install the Vsphere client in a Domain Controller:

Make sure you run this command into your Command Prompt or Shell window:

ASA AnyConnect and SSL VPN for IP Phones with CUCM

it-learn.io — Fri, 04 Mar 2016 00:00:00 +0000

This one may seem a bit like a very involved configuration but in reality is not. The process is easy, if you know how to set up AnyConnect in an ASA, you will be able to crack it.

I have also included few links that show the process and the important things that you need to consider, as well as licensing requirements

Useful Links: ASA Sample Configuration: (http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/8_5_1/secugd/sec-851-cm/secuvpn.html#wp1054676)

Configure AnyConnect VPN IP Phones with Certificate Authentication on an ASA (http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/115785-anyconnect-vpn-00.html)

CUCM upgrade from 9.x to 11.x - Short post

it-learn.io — Fri, 04 Mar 2016 00:00:00 +0000

Finishing an upgrade project after being a while since doing one, I wanted to take the time to share the experience and how easy has Cisco made it into upgrading their software.

It may look a bit disorganized, but you will find few things that I used to refresh my memory on the process, but I found that it was a surprisingly less painful than before. Now, one thing I like to mention is the fact that this is still a Refresh Upgrade because of the change on the REHL version of CUCM, but the Refresh Upgrade COP is not needed, note that the previous version is 9.x.

UCCX 10.6 Migration from Cisco Agent Desktop (CAD) to Finesse Desktop

it-learn.io — Thu, 03 Mar 2016 00:00:00 +0000

Today I attended to the WebEx training UCCX, so this time I decided I was going to take note of all the things that I considered interesting on the training. This one is an interesting one to note because is a question that we may get asked very often. Also one more thing, CAD and Finesse can work in the same UCCX only if its running version 10.6SU1 this is called mixed mode. This post is also followed by a Q&A that was held by the Cisco team on WebEx and I added the ones I considered more relevant.

Check DNS records for Collab_Edge Expressway

it-learn.io — Sun, 28 Feb 2016 00:00:00 +0000

This one is intended to look it up when you need, on the fly, also a quick google search will show you the light:

Check any SRV record:

On your DNS, click Start, and then click Run.
In the Open box, type cmd.
Type nslookup, and then press ENTER.
Type set type=all, and then press ENTER.
Type _ldap._tcp.dc._msdcs.

Check Collab_Edge SRV record:

nslookup -type=SRV _collab-edge._tls.example.com

dig _collab-edge._tls.example.com SRV

Example:

dig _collab-edge._tls.example.com SRV

NANPA and LocalCallingGuide - Best new friends?

it-learn.io — Sun, 28 Feb 2016 00:00:00 +0000

Confused about dial plans in the US? - Here is the solution

These 2 sites will help you get the most out of any North America dial-plan based on Areacode

Lets begin with NANPA: https://www.nationalnanpa.com/

Going into Tools and Area Code Search you can get a lot information

Here is an example:

Pay close attention to the Dialing Plan for this NPA section. This will dictate the way you can make calls out locally and nationally. In case you are interested in FPA HNPA, NPA and NXX terms, here is a good link: https://en.wikipedia.org/wiki/North_American_Numbering_Plan

OpenSSL Create and Sign Certificate on MAC [El Capitan]

it-learn.io — Sun, 28 Feb 2016 00:00:00 +0000

Since I started in IT and Networking, I have discovered that there are many things that result easier to do on a MAC, than any other OS. However we have to give credit where credit is due, Windows is doing a fantastic job with their new OS, but I still prefer MAC ;).

This post is dedicated to a paged referred from a colleague at my job on Cisco VCS Expressway configuration:

VCS Expressway Licensing - The allocation of the SKUs

it-learn.io — Sun, 28 Feb 2016 00:00:00 +0000

In my effort to make sure I post things as do them, I want to make sure I leave this one here for anyone out there that may need a bit of help on understanding the obscure process of Licensing a VCS (Control and Expressway servers)

The good news is that Cisco Licensing is already providing all the Option Keys and Features keys in one message, which makes it easy to get licensing done in just one shot! - This requires you to open a case and most of the times they will do it right, but again we are humans and we make mistakes, that was my venting about my latest call to Cisco Licensing.

2nd Attempt -but not out of the Collaboration woods yet

it-learn.io — Sun, 22 Nov 2015 00:00:00 +0000

Hi all,

Here is an update on my second and unsuccessful attempt. Things to think about and others to ignore.

This time the results were less effective and the score one to be ashamed of, however I learned few things of me and some “don’t try this at the lab” things that can be useful for many out there in the same path.

This the lab hit me with different questions and stuff from my previous attempt, which got the best of me and made me loose tremendous amount of time. I will do my best to summarize how everything went, off course without breaking my NDA. I hope you enjoy reading this post

CUBE LTI - Local Transcoding Interface No need for SCCP and/or CME Licenses)

it-learn.io — Tue, 17 Nov 2015 00:00:00 +0000

Hi everyone, I think this post will be very useful for everyone, I have tried this on few production environments and requires some tweaking but nothing impossible, just make sure you are aware of how the call flows and how it interacts with other endpoints.

Previously the issues I have had with this configuration have been based on DTMF, oddly enough DTMF on International calls only. Fortunately the case was resolved by our provider in conjunction with few commands that are listed in this document.

QOS Values Calculator or better yet, cheat-sheeet!

it-learn.io — Tue, 17 Nov 2015 00:00:00 +0000

I have been using this page for this particular and obscure subject for many out there.

I hope you enjoy it.

You can also find it in this blog:

http://www.netcontractor.pl/blog/?p=1161

Thank you NetContractor for putting this together.

About the Author:

Install CUCM 9.1 Boot error (Make any Cisco UC CD/DVD Bootable)

it-learn.io — Sun, 08 Nov 2015 00:00:00 +0000

Because sometimes you just need a refresher - rebuilding my lab servers and was just forgetting the Generate Bootinfotables option. Thank you!

About the Author:

Auto Registration ATA 190 - Dual registration

it-learn.io — Fri, 06 Nov 2015 00:00:00 +0000

I don’t mess around too much with ATA devices, and I think never configured one that supports 2 DNs/FXS ports. I was surprised that when configuring Auto-Registration and connecting the ATA 2 devices came up with 2 devices, I was unsure so I looked around to get more information on this one.

I used Auto Registration to save me some time.

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cata/190/1_0/english/administration/guide/sip/ATA190/a190_ag2str.html

Here is the text from Cisco’s website on the ATA’s

Document from Cisco on FoIP CUBE Third Party Interoperability

it-learn.io — Fri, 06 Nov 2015 00:00:00 +0000

Hi there, Here is the link to the CUBE Third-Party Interoperability Fax Guidelines - http://www.cisco.com/c/en/us/support/docs/voice/t38/116280-configure-cube-00.html I decided to copy the Source code of the page just not mess around with the contents and images which help on understanding the Fax protocols with Cisco CUBE.

Also this makes it a nice link to keep in your toolbox.

Introduction

Prerequisites

Requirements

Components Used

Background Information

CUBE Fax Call Flows

FoIP Transport Methods

Multicasting with GNS3 and Virtualbox

it-learn.io — Wed, 26 Aug 2015 00:00:00 +0000

Really nice article… I’m actually working on a lab to do this… Multicast has become viral for all my customers!

About the Author:

CCIE Collaboration Lab Recommendations and Strategy [The aftermath of my first attempt]

it-learn.io — Tue, 09 Dec 2014 00:00:00 +0000

While my experience on my first attempt was not the brightest one because I failed, I was able to open my mind and think on endless possibilities and maybe potential recommendations. I hope this helps other with their studies and strategies.

Studying and Muscle Memory: Do you studying… I think many instructors across the globe could not stress this one enough… but its right, going into the Lab with just few practice is not enough, muscle memory plays and interesting role on your experience. The need to know your IOS commands without Context Sensitive help is key (this one got me very bad).

Single Inbox Unity Connection 9.x Exchange 2013

it-learn.io — Tue, 09 Dec 2014 00:00:00 +0000

We are UC/Collaboration guys and if you are like me, Exchange 2013 is not your expertise… but if you are handy with Exchange 2013 that is great, and maybe you can use the following post useful too.

Single Inbox Unity Connection 9.x Exchange 2013

Here are some useful links that I have found in order to get Single Inbox configured:

This is the main link:

(http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/9x/design/guide/9xcucdgx/9xcucdg032.html%23pgfId-1141552)

System Requirements:

(http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/9x/requirements/9xcucsysreqs.html)

High level and pretty much what you need to do in order to complete the configuration:

Cisco 9971 Factory Reset Admin Password Removal - [Timing is the answer]

it-learn.io — Sat, 15 Nov 2014 00:00:00 +0000

I promise this will be a very short one. This week I purchased 3 9971 with the camera in order to get ready for my rack rentals for CCIE Collaboration, well when I got them I noticed that the phones belonged to someone else(Duhhh!!).

I needed to do a factory reset on those guys, or at least be able to remove the ITL files.

My problem was that I could not do any of these because the Admin Settings was locked by a password. Of course you can remove this password but if only if your phone is able to get the SEP config from your CME (off course if you are using CME) - TCLSH procedure here http://collabengineer.com/2014/11/15/cisco-sip-phones-admin-password-removal-cme-tclsh-operation/

Cisco SIP Phones Admin Password removal CME [TCLSH Operation]

it-learn.io — Sat, 15 Nov 2014 00:00:00 +0000

On this one I wanted to share a really nice way to remove the Admin password from Cisco SIP phones.

It really is annoying to type the Admin password every time you need to modify or at least take a look at the configuration on your phone.

As you may know when you configure a SIP phone on CME you need to give it a username and password, also SIP is kind enough to publish the SEPXXXXX.cnf.xml file to Flash

Cisco AutoSecure Feature [Routers – Management Plane]

it-learn.io — Thu, 13 Nov 2014 00:00:00 +0000

Let’s break it down, I heard about this feature not too long ago and just wanted to take the time to take a look at it and see what is it all about. In the mean time, I’m rebuilding all my U VMs because I created a new topology (CCIE Collaboration LAB on November 26th), but more on that later. Network needs to be secured, that is what we keep hearing from customers/clients everywhere, and why not make it easier to use and apply.

Shellshock-ed

it-learn.io — Wed, 12 Nov 2014 00:00:00 +0000

Thank you Michael for the post. Just re-posting to make my connections aware!

About the Author:

Accesibility Features for Hearing Impaired Users - Cisco 7900 Phones

it-learn.io — Tue, 28 Oct 2014 00:00:00 +0000

This post is dedicated to a request that was sent to me, and this is what I did in order to make it more understandable for my customer and Client Manager.

The request was basically that the client needed to support Hearing impaired users and needed to find a way to do it. In all the aspects I found out that Cisco provides a vast majority of features that are very accessible friendly that I did not noticed before.

National Numbering Plans - ITU

it-learn.io — Mon, 20 Oct 2014 00:00:00 +0000

Today I have a quick one, I hope you find it useful.

Just in case you are doing an international Dial-Plan configuration, I think this web site will be very helpful:

http://www.itu.int/oth/T0202.aspx?parent=T0202

You can find all the numbering dial plans per country, including the country codes, in the past I used to google to find country codes or what I needed to know, but this will be my official link from now on to look so that I can based my Dial-Plans.

CCNA – LAN Switching Technologies RE: 100-101 ICND [LAB-1]

it-learn.io — Sat, 18 Oct 2014 00:00:00 +0000

This one is going to be a series of labs to help friends with their CCNA studies, I have always been asked about something like this and I think now is the time to help and share.

In order to help you pass the ICND 1 there are few things that you need to visualize. I want to start from the one I think its more important:** **

Know the Objectives

IM&P (CUPS) Server, Blank (Admin Page) page after upgrade from 9.x to 10.5

it-learn.io — Thu, 02 Oct 2014 00:00:00 +0000

Yes, another upgrade and more with it. This one was very special and I was totally blaming myself after the TAC engineer helped me figure it out.

I was always told, or I remember it was good practice to always get the latest Upgrade file from CCO Downloads page for everything. Well I did that and found myself into an issue.

The scenario:

Customer Upgrading CUCM, CUC and IM&P servers from 9.1.2 to Version 10.5 (No issue here):

Upgrade CUCM 9.1 to 10.5 - Procedure (No Prime Collaboration Deployment)

it-learn.io — Sat, 27 Sep 2014 00:00:00 +0000

So with the introduction of Cisco Prime Collaboration Deployment, now upgrade any of your UC applications its easier and quicker than before. One of the big advantages that I see with this new product is that the product can have control of the overall infrastructure, starting from VMware all the way to the UC applications.

For a better understanding of this product you can use the following link: (http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/pcdadmin/10_0_1/CUCM_BK_U9C58CB1_00_pcd-administration-guide-1001.html) - The previous is the one for version 10.x – I don’t see too many changes from version to version.

Unity Express AA Transfer no Ring-back - Perception is Key!

it-learn.io — Thu, 18 Sep 2014 00:00:00 +0000

This one was a very funny one and I’d like to share with you. After an install of a remote office using the following equipment:

CIsco 2901 with an ISM for CUE and an AutoAttendant that when the office is open sends the call to a Hunt Group in CUCM and when they are close the **AA (**prompts) really kicks in. Nothing too crazy right?

After 1 month of the installation received a call that when someone calls the main number they hear not ring back (only death air) until someone answers the call. After this one I had few things to look at but I knew this was a cosmetic issue.

Debug CCSIP for Lunch

it-learn.io — Sat, 13 Sep 2014 00:00:00 +0000

Well written, I was actually having the same issues but it was related to Codec negotiation, so my PSTN site is using a CP-7961 and noticed that my Dial-peer on the PSTN router was using ilbc, and this codec is not supported on these phones, http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cuipph/7962g_7961g_7961g-ge_7942g_7941g_7941g-ge/8_0/english/administration/guide/62adm80/62614241trb.html

About the Author:

CCIE Collaboration Labs by Technologies

it-learn.io — Fri, 12 Sep 2014 00:00:00 +0000

In order to organize myself for my lab preparation I need to work on my speed and accuracy, so I created quick and very general Lab outlines, which will be covering CUCM as of now. I created them so that I can guide myself and know where to begin, where to stop and don’t burn myself (hoping this strategy to work!!)

I know I’m missing lots and lots of information and study domains, such as QoS and yes, QoS… Infrastructure and Multicast… I do feel confident with the Network infrastructure configuration, but need more work on QoS and Multicast, if you know of good QoS labs let me know… enjoy!

How are you preparing for the CCIE Collaboration LAB ?

it-learn.io — Sat, 30 Aug 2014 00:00:00 +0000

Just for curiosity, I would like to know how is the people on this group preparing for the CCIE Collaboraiton Lab, right now here is my preparation and roadmap:

I have completed a lab in order to be able to study most of the technologies included in the blueprint, here is what I have:

3 Cisco 2811 64 PVDM2 1 Cisco 2821 128 PVDM2 1 Cisco 3750G 24 Port 1 Poweredge 1950 III 32GB - 2 TB HD - 2 XeonQuadCore E5240 2.4Ghz 5 Cisco 7961 2 Cisco 7965

Upgrading CUCM from 9.1.2 to 10.5 – Issues

it-learn.io — Fri, 29 Aug 2014 00:00:00 +0000

Hi there, today I have a customer that wanted to upgrade from CUCM 9.1.2 to 10.5 - which sounds pretty easy… think again, so this is a BE6K deployment where CUCM instance was configured with the recommended OVA from CCO. When starting the upgrade I found that the upgrade didn’t wanted to proceed as expected. and I was getting the following error:

Installation of UCSInstall_UCOS_10.5.1.10000-7.sgn.iso failed

An error has occured but no messages are available. This can happen when another administrator is working on the system at the same time and triggers an error.

CCIE collaboration Lab

it-learn.io — Thu, 14 Aug 2014 00:00:00 +0000

Here is my lab

About the Author:

CWMS - Recordings button grayed out - Alerts button not found

it-learn.io — Wed, 30 Jul 2014 00:00:00 +0000

So I stumbled across a really basic issue related to adding storage to WebEx, really simple right, just adding an NFS mount to it and done with the issue.

In my particular case my NFS storage was running on 84% of capacity, which is OK, I mean, there is still some space on it, maybe not good practice to have it like that (will be changing it soon though)

So when started I started a meeting to test the recording feature I noticed that my recording button was grayed out, which indicated that there was an issue. After doing some research I found the CWMS troubleshooting guide, which pointed to an issue with the alerts and the threshold of my storage, here is the document that explains it all:

Andres’s toolbox, workflow and more…

it-learn.io — Mon, 23 Jun 2014 00:00:00 +0000

Hi people, I wanted to take this opportunity and share my toolbox and workflow with you. In case you don’t know who I am and what I do here is a quick reference note.

What I do and who I am:

I’m a Lead Technical consultant specialized in Cisco Unified Communications and Collaboration (a mouthful, but really cool stuff … that, I can assure you!) – yes I do some other stuff but I could not call myself an expert, such as in routing & switching, Network design and architecture. I’m learning a bit more about security, which I though I knew something but not really!

RADIUS vs TACACS+ - Cool document I found...

it-learn.io — Mon, 16 Jun 2014 00:00:00 +0000

Liking the beginning of the document and some how knowing where the conversation will end up being…..

"Cisco seriously evaluated RADIUS as a security protocol before it developed TACACS+. Many features were included in the TACACS+ protocol to meet the needs of the growing security market. The protocol was designed to scale as networks grow, and to adapt to new security technology as the market matures. The underlying architecture of the TACACS+ protocol complements the independent authentication, authorization, and accounting (AAA) architecture."

First contact after I made it back from Cisco Live 2014!!

it-learn.io — Wed, 28 May 2014 00:00:00 +0000

Cisco Live 2014 – San Francisco

Just wanted to take this time to talk about my experience at Cisco Live 2014, representing the Modcomp team.

It was a great experience and a nice way to meet with people that is in the same boat you are, Engineers that are seeing the same issues you see and others that have it all figured out (You want to be like them!!).

So just to get you started off the narration of this adventure, I wanted to start by adding few things that I think deserve to be mentioned:

CCIE Collaboration - Campus Design (Migration to Routed Access Layer Design)

it-learn.io — Tue, 13 May 2014 00:00:00 +0000

So in the traditional Campus Design it used to be Layer 2 from the Access Layer to the Distribution and to the Endpoints, running Layer 3 on the Distribution and the Core, and in most of the cases, you will have a Core/Distribution approach called Collapsed Distribution Core. as shown in the example:

Now moving from that model to a new and recommended approach you can take a look at the Layer 3 or Route Access layer Design, this one has many benefits as follows:

CCIE Collaboration - Written Exam Reading List

it-learn.io — Tue, 13 May 2014 00:00:00 +0000

Just wanted to share some knowledge about the locations on some useful resources:

This document contains the topics that will be covered by the CCIE Collaboration exam, in my case I have been using an structured approach that goes from weakness I have. here are few (Just not to say all of them)

SCCP Call Flows MGCP Call Flows UC on UCS (all fine print and special requirements, many things I didn’t know until now!!!) Answer Files….Who in earth uses them? (I know I would have saved so much time in past deployments by using them…Cool Stuff!).

Cisco Collaboration Edge - Mobile Remote Access (Jabber with no VPN)

it-learn.io — Mon, 05 May 2014 00:00:00 +0000

Hi there, I have been looking at the new collaboration edge deployments, in order to support Jabber from remote networks without the need of using a VPN (What a relief!!! - I was actually getting slammed from customers because of the lack of options from Cisco). Doing some research I was able to find the following documents:

Collaboration Edge with Cisco VCS Expressway:

Cisco TelePresence VCS Cluster Creation and Maintenance: www.cisco.com/c/dam/en/us/td/docs/telepresence/infrastructure/vcs/config_guide/X8-1/Cisco-VCS-Cluster-Creation-and-Maintenance-Deployment-Guide-X8-1-1.pdf

Configure MoH on CUCME and Transcoding

it-learn.io — Fri, 02 May 2014 00:00:00 +0000

So I stumbled into this topic with a customer and was having few issues to understand the mechanics of this simple step, my customer is having issues with quality on the music on hold.

Here is what I did:

Looked up in CUCM Flash and found a media file that I was going to use as MoH.

media/music-on-hold.au

First I started by working on my Transcoder:

voice-card 0 * dsp services dspfarm*

SIP Devices unable to stablish PSTN calls

it-learn.io — Thu, 01 May 2014 00:00:00 +0000

I was just reading the following Article and wanted to add few things that helped me solve my issue:

http://uctickets.wordpress.com/2014/03/21/11-sip-9971-phone-unable-to-complete-pstn-calls/

*** bearer-cap speech *** This simple command also fixed an issue I had with Jabber clients calling from Softphone mode to cellphones, and they were getting straight to the voice mail of that particular cellphone.

At first it looks like a simple issue with the phone company, but then you start re-thinking it because it happens with every cellphone you make and with every SIP device you have connected to CUCM.

CCIE Collab - Gateways and Trunks in CUCM

it-learn.io — Sat, 26 Apr 2014 00:00:00 +0000

Hi there, so today I wanted to bring up something that was very confusing to me long time ago. The concept of MGCP, H.323 and SIP.

these 3 are very big and there is a lot of information about them, I just want to explain with my own words what every single protocol means for me and the way I had to put it in my head before I was able to understand the technology behind it.

CCIE Collab - Self Training

it-learn.io — Fri, 25 Apr 2014 00:00:00 +0000

So today I was able to study for 3 hours, dedicated the first hour to read CIPT2 on Multi-site considerations, read about some QoS recommendations and also something about multi-site dial plans.

I was also able to watch the demonstration videos on Media Termination Points (One of my weakest areas) from INE ATC for CCIE VOICE and I was able to understand more and more about it and saw some multicast and why is there, I remember studying but not paying to much attention to it.

CCIE Collab preparation - Written Booked at Cisco Live!!!

it-learn.io — Tue, 22 Apr 2014 00:00:00 +0000

Just wanted to throw it out here, not sure if you have had the same experience but finding Study material for this exam has been very hard for me, currently I’m looking at the INE Voice ATC. they look great but I see a bunch of irrelevant information as of now compared to the new blueprint on the exam.

So far I have studied the following topics:

QoS
Cisco UC on UCS

About it-learn.io

it-learn.io — Mon, 01 Jan 0001 00:00:00 +0000

What is it-learn.io?

it-learn.io is a free learning hub for IT professionals, network engineers, and cybersecurity practitioners. We cover what matters in the field — not watered-down theory, but practical content you can apply on the job and in the lab.

The site was built by someone who has been in the trenches of enterprise networking and security, and who got tired of paying for study resources that didn’t align with real-world experience.

Search

it-learn.io — Mon, 01 Jan 0001 00:00:00 +0000

You're In — Welcome to the it-learn Brief

it-learn.io — Mon, 01 Jan 0001 00:00:00 +0000

You're subscribed.

Your first issue of The it-learn Brief will land in your inbox on the next weekday morning.

Every issue includes breaking CVEs, MITRE ATT&CK-mapped deep dives, copy-paste detection queries, and specific defender action items — the technical depth that keeps you sharp in customer conversations and on the job.

📬 Catch up on the latest briefs

📬 Daily Brief Aug 7, 2026

NatJack Hijacks TCP Sessions via NAT State Manipulation

NatJack attacks manipulate NAT state to hijack TCP sessions and spoof DNS. Plus Linux SCTP root exploit since 2008 and three Cisco SD-WAN CVSS 9.9 …