Cisco ASA - CraftedSignal Threat Feed

Cisco ASA Device File Copy Activity

hello@craftedsignal.io — Tue, 09 Jan 2024 10:00:00 +0000

This analytic detects file copy activity on Cisco ASA devices, potentially indicating malicious behavior. Attackers might copy device files, such as configurations (running-config, startup-config), logs, packet captures (pcap capture), or system files (disk0:, flash:, system:, capture:), via CLI or ASDM. This activity could be part of a reconnaissance phase, to extract credentials, or to exfiltrate sensitive data. While legitimate file operations do occur during backups and maintenance, unauthorized copies warrant investigation. This detection focuses on command execution events (message ID 111008 or 111010) containing copy commands. The activity may be associated with threat actors targeting perimeter network devices, such as those detailed in the Talos ArcaneDoor report.

Attack Chain

The attacker gains initial access to the Cisco ASA device, possibly through compromised credentials or a vulnerability (not specified in source).
The attacker authenticates to the ASA device via CLI or ASDM using valid credentials.
The attacker executes a copy command to copy sensitive files. This includes commands targeting running-config, startup-config, packet capture files (/pcap capture:), or system files from disk0:, flash:, system:, or capture: locations.
The ASA logs the command execution event with message ID 111008 or 111010.
The copied files are stored on the ASA's local storage (disk0:, flash:, etc.).
(Hypothetical) The attacker uses another command (e.g., tftp) to transfer the copied files off the ASA device to an attacker-controlled server.
(Hypothetical) The attacker extracts credentials from the configuration files or analyzes packet captures for sensitive information.
The attacker uses the extracted information for further lateral movement or data exfiltration.

Impact

Successful exploitation allows the attacker to access sensitive information, including device configurations and potentially network traffic data. Configuration files often contain usernames, passwords, and other sensitive information that can be used for lateral movement within the network. Packet captures may contain sensitive data transmitted over the network. This can lead to a complete compromise of the network infrastructure. The references indicate that nation-state actors may target these devices.

Recommendation

Enable Cisco ASA syslog data ingestion into your SIEM via the Cisco Security Cloud TA to collect the necessary logs.
Configure your ASA and FTD devices to generate and forward message IDs 111008 and 111010 as outlined in the "how_to_implement" section.
Deploy the Sigma rule "Cisco ASA Device File Copy Activity Detection" to identify suspicious file copy commands executed on Cisco ASA devices.
Investigate any alerts generated by the Sigma rule "Cisco ASA Device File Copy Activity Detection," especially those originating from non-administrative accounts or occurring during unusual hours.
Monitor command execution logs for unexpected use of the copy command, specifically targeting sensitive files and directories (running-config, startup-config, /pcap capture:, disk0:, flash:, system:, capture:).

Cisco ASA - New Local User Account Creation

hello@craftedsignal.io — Thu, 04 Jan 2024 12:00:00 +0000

This analytic detects the creation of new user accounts on Cisco ASA devices via CLI or ASDM. Adversaries may create unauthorized user accounts to establish persistence, maintain backdoor access, or elevate privileges on network infrastructure devices. These rogue accounts can provide attackers with continued access even after initial compromise vectors are remediated. The detection monitors for ASA message ID 502101, which is generated whenever a new user account is created on the device, capturing details including the username, privilege level, and the administrator who created the account. The source material was published by Splunk on 2026-04-17, highlighting the continued relevance of this threat.

Attack Chain

Initial access to the Cisco ASA device via compromised credentials or exploitation of a vulnerability.
Attacker authenticates to the ASA device using the gained access.
Attacker executes commands to create a new local user account using the CLI or ASDM interface.
The ASA device generates syslog message ID 502101, indicating the new account creation, which includes the username, privilege level, and creating administrator.
The attacker assigns a high privilege level (e.g., level 15) to the new account.
Attacker uses the newly created account to maintain persistent access to the ASA device.
Attacker leverages the persistent access to perform reconnaissance, modify configurations, or disrupt network operations.
The attacker establishes a backdoor for future access, bypassing normal authentication mechanisms.

Impact

Successful exploitation can lead to unauthorized access to the network infrastructure, allowing attackers to modify configurations, intercept traffic, or disrupt services. This can result in data breaches, denial of service, and significant financial and reputational damage. While the specific number of victims or targeted sectors isn't available, the impact is significant for any organization relying on Cisco ASA devices for network security.

Recommendation

Ensure Cisco ASA devices are configured to generate and forward syslog message ID 502101 to a SIEM for monitoring to enable the provided detections.
Implement the provided Sigma rule Cisco ASA - New Local User Account Created to detect suspicious account creation activities.
Investigate any alerts generated by the Sigma rule, paying close attention to accounts with elevated privileges (level 15) and those created outside of normal business hours.
Review existing user accounts on Cisco ASA devices regularly, looking for any unauthorized or suspicious accounts.

Cisco ASA User Account Lockout Detection

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This brief focuses on detecting account lockouts on Cisco ASA (Adaptive Security Appliance) devices. The increasing sophistication of cyberattacks means that organizations must monitor not just successful breaches, but also failed authentication attempts that may signal ongoing brute force attacks, password spraying campaigns, or credential stuffing attempts. The presence of these types of attacks indicate that credentials may have been compromised from external breaches and are being used to gain unauthorized access to network infrastructure. This analytic specifically leverages Cisco ASA message ID 113006, which signifies a user account lockout triggered by exceeding the permitted number of failed authentication attempts. This detection is crucial for defenders, as it enables timely response to potential unauthorized access attempts, protecting sensitive resources and maintaining network integrity.

Attack Chain

The attacker attempts to authenticate to the Cisco ASA using compromised credentials or by guessing passwords.
The authentication attempts fail.
The Cisco ASA logs message ID 113006, indicating a failed authentication attempt.
The attacker continues to attempt authentication, exceeding the configured lockout threshold.
The Cisco ASA locks the user account, logging message ID 113006 with details of the account lockout and the failure threshold.
The detection rule triggers based on the 113006 event identifying the user account and originating host.
Security team investigates the lockout event, looking for associated malicious activity.
If confirmed malicious, the security team takes action to block the attacker and remediate the compromised account.

Impact

Successful exploitation could lead to unauthorized access to the network, potentially leading to data breaches, service disruption, or further lateral movement within the network. While a single account lockout might seem minor, a series of lockouts, especially affecting privileged accounts, could indicate a coordinated attack. Organizations in all sectors are vulnerable, with financial services and healthcare being particularly attractive targets.

Recommendation

Ingest Cisco ASA syslog data into Splunk via the Cisco Security Cloud TA to populate the cisco_asa macro.
Configure Cisco ASA devices to generate and forward message ID 113006 for account lockout events to Splunk.
Tune and deploy the Sigma rule "Cisco ASA - User Account Lockout Detected" to detect account lockouts.
Investigate alerts from the Sigma rule, focusing on privileged accounts, unusual source IP addresses, and multiple simultaneous lockouts.
Review and tune the lockout threshold on Cisco ASA devices based on your organization's security policies.

Cisco ASA Reconnaissance Command Activity

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies potential reconnaissance activities targeting Cisco ASA devices. Threat actors often perform reconnaissance against network infrastructure to understand device configurations, network topology, security policies, and potential attack paths. This involves executing multiple "show" commands to enumerate device details, running configurations, active connections, routing information, and VPN sessions. This activity is often a precursor to further malicious actions, such as lateral movement or data exfiltration. The detection specifically monitors for command execution events (message ID 111009) and triggers when 7 or more distinct reconnaissance commands are executed within a 5-minute window by the same user. This allows for detection of anomalous behavior within a network.

Attack Chain

Attacker gains initial access to a network, potentially through compromised credentials or exploiting a vulnerability in an external-facing system.
The attacker leverages their access to connect to a Cisco ASA device.
The attacker executes a series of "show" commands via the ASA's command-line interface (CLI). These commands include "show running-config", "show version", "show interface", "show crypto", "show conn", and others to gather information about the ASA's configuration and network environment.
The ASA logs these command executions with message ID 111009.
The attacker analyzes the output of the "show" commands to map the network topology, identify potential vulnerabilities, and discover sensitive information such as usernames, passwords, and VPN configurations.
Using the gathered information, the attacker identifies potential targets for lateral movement within the network.
The attacker pivots to other systems within the network, potentially using stolen credentials or exploiting identified vulnerabilities.
The attacker achieves their final objective, such as data exfiltration, system compromise, or denial-of-service.

Impact

Successful reconnaissance can provide attackers with critical information needed to compromise network infrastructure, bypass security controls, and achieve their objectives. While the reconnaissance itself does not cause direct damage, it significantly increases the likelihood of a successful attack. A compromised ASA device can lead to network outages, data breaches, and unauthorized access to sensitive resources. The number of affected users/systems depends on the scope of the attacker's objective and the network's architecture.

Recommendation

Ensure Cisco ASA devices are configured to log command execution events with message ID 111009, following the guidance in the "how_to_implement" section.
Deploy the provided Sigma rule to your SIEM to detect reconnaissance activity based on multiple "show" command executions. Tune the threshold (unique_recon_commands >= 7) based on your environment's baseline activity.
Investigate alerts generated by the Sigma rule, focusing on unusual source IP addresses, non-administrative accounts, and off-hours activity. Correlate reconnaissance activity with other suspicious events.
Adapt the detection filters to exclude known legitimate administrative activities, as mentioned in the "known_false_positives" section.
Regularly review and update ASA configurations to minimize the exposure of sensitive information through "show" commands, referring to the Cisco documentation provided in the references section.

Cisco ASA Logging Message Suppression

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection focuses on identifying the suppression of logging messages within Cisco ASA devices, a tactic used by adversaries to evade detection. Attackers leverage the "no logging message" command to selectively disable the logging of specific, security-critical events, such as authentication failures, configuration changes, or suspicious network activity. This approach allows them to maintain a degree of stealth while still allowing other logging functions to proceed normally, avoiding suspicion that might be raised by a complete disabling of logging. The detection specifically monitors for the execution of commands with message IDs 111008 and 111010 that include the "no logging message" command, which can suppress message IDs irrespective of the configured severity level. Identifying unauthorized or suspicious use of this command is crucial for maintaining auditability and detecting malicious activity within the network environment.

Attack Chain

The attacker gains unauthorized access to a Cisco ASA device, potentially through stolen credentials or exploiting a vulnerability.
The attacker executes the command enable to enter privileged EXEC mode.
The attacker then enters global configuration mode using the configure terminal command.
The attacker identifies security-critical message IDs, such as those related to authentication failures or configuration changes.
The attacker uses the no logging message command to suppress logging for these specific message IDs. For example, no logging message 111008.
The ASA device ceases to log events associated with the suppressed message IDs, effectively hiding the attacker's actions.
The attacker performs malicious actions on the network, knowing that these actions will not be logged.
The attacker exits configuration mode and privileged EXEC mode, leaving the ASA device with suppressed logging.

Impact

Successful suppression of logging messages can severely hinder incident response and forensic investigations. If critical security events are not logged, administrators will be unaware of malicious activities occurring on the network. This can lead to delayed detection of breaches, data exfiltration, or other significant security incidents. The NCSC report referenced in the related articles details the use of similar techniques by advanced persistent threat (APT) groups to maintain persistence and evade detection on compromised systems, which highlights the potential impact of this tactic.

Recommendation

Enable Cisco ASA syslog data ingestion into your SIEM using the Cisco Security Cloud TA, as required by the detection [How To Implement].
Configure Cisco ASA devices to generate and forward message IDs 111008 and 111010, or adjust the logging level to include these messages if needed [How To Implement].
Deploy the Sigma rule "Cisco ASA Logging Message Suppression Detected" to identify instances of logging message suppression [rules].
Investigate any detected instances of message suppression, focusing on unauthorized suppressions of security-critical message IDs, suppressions by non-administrative accounts, and suppressions occurring during unusual hours [description].
Establish a baseline of approved suppressed message IDs and monitor for deviations from this baseline [known_false_positives].

Cisco ASA User Privilege Level Change Detection

hello@craftedsignal.io — Wed, 03 Jan 2024 10:00:00 +0000

This threat brief focuses on the detection of unauthorized privilege level modifications on Cisco ASA (Adaptive Security Appliance) devices. Threat actors may attempt to escalate privileges to gain elevated access to network infrastructure, enable additional command execution capabilities, or establish higher-level persistent access. This is achieved by modifying user account privilege levels, which range from 0 (lowest) to 15 (full administrative access). The detection strategy leverages Cisco ASA message ID 502103, triggered when a user account's privilege level is modified. This event captures crucial information, including the username, the administrator responsible for the change, and both the original and the new privilege levels. Defenders should investigate unexpected privilege changes, with particular attention to escalations to level 15, substantial privilege increases, modifications performed outside of established business hours, changes initiated by non-administrative users, or changes lacking proper change management documentation.

Attack Chain

Initial Access: An attacker gains initial access to a low-privilege user account on the Cisco ASA, possibly through compromised credentials or social engineering.
Reconnaissance: The attacker uses the compromised account to enumerate existing user accounts and their current privilege levels using CLI commands like show user.
Privilege Escalation Attempt: The attacker attempts to modify the privilege level of a target account (potentially their own) using commands like username privilege via CLI or ASDM.
Authentication: The ASA requires authentication for the privilege escalation attempt, often requiring administrator credentials. The attacker might attempt to brute-force or bypass this authentication.
Privilege Level Change: If successful, the attacker elevates the target account's privilege level. Message ID 502103 is generated, logging the change.
Command Execution: With elevated privileges, the attacker can now execute privileged commands, modify network configurations, and potentially compromise the entire ASA device.
Persistence: The attacker may create new high-privilege accounts or modify existing ones to ensure continued access, even if the initial compromised account is discovered and disabled.
Lateral Movement: The attacker uses the compromised ASA as a pivot point to gain access to other systems on the network.

Impact

Compromised Cisco ASA devices can lead to significant damage, including unauthorized network access, data breaches, and disruption of network services. A successful privilege escalation can grant attackers complete control over the network infrastructure. The NCSC's analysis of RayInitiator/LINE-VIPER malware highlights the potential for attackers to leverage compromised network devices for lateral movement and data exfiltration. The scope of impact depends on the organization's size and the criticality of the network services provided by the ASA.

Recommendation

Enable and forward Cisco ASA syslog data, including message ID 502103, to your SIEM using the Cisco Security Cloud TA, as required by the detection rules below.
Deploy the provided Sigma rule Cisco ASA User Privilege Level Change Detected to detect privilege level changes and tune it for your environment.
Investigate any alerts generated by the Sigma rule, paying close attention to escalations to privilege level 15, substantial increases in privilege levels, and changes made outside of normal business hours.
Correlate privilege level change events (message ID 502103) with other security events, such as failed login attempts or suspicious network activity, to identify potential compromise.
Regularly review user accounts and their privilege levels on Cisco ASA devices.
Implement strong password policies and multi-factor authentication for all ASA administrator accounts.
Refer to the Cisco documentation linked in the references to configure and monitor ASA logging effectively.

Cisco ASA User Account Deletion

hello@craftedsignal.io — Wed, 03 Jan 2024 10:00:00 +0000

This brief focuses on the detection of user account deletions on Cisco ASA devices, a tactic commonly employed by adversaries to obfuscate their activities within a compromised network. The deletion of user accounts, particularly those with elevated privileges (level 15), can serve to remove evidence of malicious actions, hinder incident response efforts, or deny legitimate administrators access to critical systems. This activity can also be a sign of hiding temporary account creation used during a compromise. This analytic relies on monitoring Cisco ASA logs for message ID 502102, which is triggered upon the deletion of a local user account. This event captures valuable information, including the username, privilege level, and the administrator responsible for the deletion. It is crucial to investigate unexpected or unauthorized account deletions, especially those occurring outside of normal business hours or involving privileged accounts.

Attack Chain

Initial Access: Adversary gains initial access to a system with valid credentials or exploits a vulnerability.
Privilege Escalation: The attacker elevates privileges to gain administrative access to the Cisco ASA device.
Account Discovery: The attacker enumerates existing user accounts on the Cisco ASA device to identify potential targets for deletion.
Account Deletion: The adversary deletes a local user account on the Cisco ASA device, generating syslog message ID 502102.
Log Manipulation (Optional): Attempts to further cover tracks by disabling logging or manipulating the ASA's logging configuration.
Persistence (Obstructed): By deleting accounts, legitimate user's persistence is removed and access to the system is revoked.
Defense Evasion: The attacker attempts to evade detection by deleting accounts used during the compromise.

Impact

Successful deletion of user accounts can disrupt incident response efforts by removing valuable forensic data and hindering the ability to track the attacker's activities. It can also lead to denial-of-service for legitimate users who rely on those accounts for access. Privileged account deletion can result in significant operational disruption and potential data breaches due to loss of control over critical systems.

Recommendation

Enable and forward Cisco ASA syslog data, specifically message ID 502102, to your SIEM for analysis as detailed in the "how_to_implement" section.
Deploy the Sigma rule "Cisco ASA - User Account Deletion Detected" to your SIEM and tune the filter list to exclude known benign account deletions.
Investigate any instances of message ID 502102, cross-referencing with HR records and change management systems to identify unauthorized account deletions as described in the description.
Monitor ASA logging configurations for unauthorized changes that could indicate log manipulation attempts.
Review the "references" link to understand the context of ASA message ID 502102 within the overall ASA syslog architecture.

Cisco ASA Device File Copy to Remote Location

hello@craftedsignal.io — Wed, 03 Jan 2024 10:00:00 +0000

This detection identifies file copy operations from Cisco ASA devices to remote locations, which could signal data exfiltration attempts. Threat actors targeting network infrastructure may attempt to exfiltrate sensitive data, including device configurations, logs, and packet captures, to attacker-controlled infrastructure. The analytic focuses on detecting unusual copy commands executed via the CLI or ASDM interface. Specifically, it monitors Cisco ASA logs (message IDs 111008 and 111010) for copy commands using protocols like TFTP, FTP, HTTP, HTTPS, SMB, or SCP. Legitimate backups to centralized servers are common, however copies to unexpected or external destinations are suspicious. This activity is associated with threat actors targeting perimeter network devices, like the ArcaneDoor campaign. Defenders should investigate copies to unexpected destinations, from non-administrative accounts, or outside approved maintenance windows.

Attack Chain

Attacker gains initial access to the Cisco ASA device, possibly through compromised credentials or exploiting a vulnerability.
Attacker authenticates to the ASA device via SSH, Telnet, CLI, or ASDM.
Attacker executes commands to copy sensitive files, such as the running configuration (running-config) or startup configuration (startup-config).
The copy command is used with a remote protocol (TFTP, FTP, HTTP, HTTPS, SMB, SCP) to specify the destination server. For example, copy running-config tftp:///config.txt.
The ASA device initiates a network connection to the attacker-controlled server using the specified protocol.
The sensitive file is transferred to the remote server.
Attacker uses exfiltrated data to gain further knowledge of the network environment or for malicious purposes.
The attacker attempts to remove evidence of the file copy operation from the ASA device's logs.

Impact

Successful exfiltration of Cisco ASA device configurations and logs can provide attackers with valuable information about network topology, security policies, usernames, passwords and other sensitive data. This information can be used to facilitate further attacks, such as lateral movement within the network, compromising additional systems, or gaining unauthorized access to sensitive resources. Organizations in any sector could be affected if their perimeter security devices are compromised.

Recommendation

Enable Cisco ASA syslog logging and ensure message IDs 111008 and 111010 are captured to enable this detection.
Deploy the Sigma rule Cisco ASA - Device File Copy to Remote Location to your SIEM and tune the filters to exclude known legitimate backup activities.
Investigate any alerts generated by the Sigma rule, paying close attention to the destination IP address, user account, and time of the activity.
Monitor network traffic for connections originating from Cisco ASA devices to external IP addresses using file transfer protocols (TFTP, FTP, HTTP, HTTPS, SMB, SCP).
Review and restrict access to Cisco ASA devices, enforcing strong password policies and multi-factor authentication to prevent unauthorized access.
Implement network segmentation to limit the impact of a compromised ASA device.

Cisco ASA Packet Capture Activity

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This analytic detects the execution of packet capture commands on Cisco ASA devices via CLI or ASDM. Adversaries might abuse the built-in packet capture functionality to perform network sniffing, intercept credentials transmitted over the network, capture sensitive data in transit, or gather intelligence about network traffic patterns and internal communications. Packet captures can reveal usernames, passwords, session tokens, and confidential business data. The detection focuses on command execution events (message ID 111008 or 111010) that include "capture" commands, which are used to initiate packet capture sessions on specific interfaces or for specific traffic patterns on the ASA device. This activity is associated with threat actors like LINE VIPER, as documented by NCSC. Detecting unauthorized packet capture activities, especially those targeting sensitive interfaces or involving unusual configurations, is critical for identifying potential intrusions.

Attack Chain

An attacker gains unauthorized access to a Cisco ASA device via compromised credentials or exploiting a vulnerability.
The attacker authenticates to the ASA device using CLI or ASDM.
The attacker executes the "configure terminal" command to enter global configuration mode.
The attacker uses the "capture" command to define a packet capture session, specifying interfaces, traffic patterns, and filters. For example, capture capin interface inside match ip any any.
The ASA device starts capturing network traffic based on the defined parameters.
The attacker retrieves the captured traffic data for analysis, potentially exfiltrating the data to an external server.
The attacker analyzes the captured data to identify sensitive information, such as usernames, passwords, session tokens, or confidential business data.
The attacker uses the stolen credentials or data to further compromise the network or exfiltrate sensitive information.

Impact

Successful exploitation allows attackers to perform extensive network reconnaissance and potentially steal sensitive credentials and data. This could lead to further compromise of internal systems, data breaches, and financial loss. While specific victim counts are unavailable, the impact is significant due to the potential for widespread data compromise and disruption of network operations. The references note association with advanced actors who use captured data to further their campaigns.

Recommendation

Enable Cisco ASA syslog data ingestion into your SIEM via the Cisco Security Cloud TA to ensure the cisco_asa macro is populated (How_to_implement).
Configure Cisco ASA devices to generate and forward message IDs 111008 and 111010, adjusting syslog levels as needed based on the instructions in the "How_to_implement" section.
Deploy the provided Sigma rule "Cisco ASA - Suspicious Packet Capture Configuration" to detect unusual packet capture configurations and tune the rule for your environment (rules).
Review and investigate any alerts generated by the Sigma rule, focusing on captures targeting sensitive interfaces, large traffic volumes, or unusual filter criteria.

Cisco ASA Logging Disabled via CLI

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This analytic focuses on detecting the disabling of logging functionality on Cisco ASA devices, a common tactic employed by adversaries and malicious insiders to evade detection and obscure malicious activities. The activity is identified by monitoring Cisco ASA syslog messages associated with command execution. Specifically, the detection triggers on syslog message IDs 111008 and 111010, coupled with the execution of commands indicative of logging manipulation, such as no logging, logging disable, clear logging, or no logging host. This tactic is a strong indicator of defense evasion, as disabling logging on security appliances like firewalls significantly reduces the visibility of malicious actions. This is a common post-compromise technique.

Attack Chain

The attacker gains unauthorized access to the Cisco ASA device, potentially through compromised credentials or exploiting a vulnerability.
The attacker authenticates to the ASA's CLI, possibly using stolen credentials.
The attacker executes a command to disable logging, such as no logging, logging disable, clear logging, or no logging host. This action is designed to prevent the recording of their subsequent activities.
The Cisco ASA generates a syslog message with message ID 111008 or 111010, indicating that a command has been executed.
With logging disabled, the attacker performs malicious activities, such as modifying firewall rules, establishing unauthorized VPN connections, or exfiltrating sensitive data.
Because logging is disabled, these malicious activities are not recorded in the ASA's logs, making them difficult to detect.
The attacker attempts to cover their tracks further by clearing any remaining logs or audit trails.

Impact

Successful disabling of logging can severely impair an organization's ability to detect and respond to security incidents. With logging disabled, malicious activities can go unnoticed, leading to data breaches, system compromise, and financial losses. The impact is magnified by the fact that Cisco ASA devices are often critical components of network security infrastructure. The number of victims can range from single organizations to multiple entities if the attacker is able to compromise multiple ASA devices.

Recommendation

Deploy the Sigma rule Cisco ASA Logging Disabled via CLI to your SIEM and tune for your environment to detect attempts to disable logging functionality.
Enable and forward Cisco ASA syslog data with message IDs 111008 and 111010 to your SIEM as described in the references and the how_to_implement section.
Review and enforce strict access control policies for Cisco ASA devices to minimize the risk of unauthorized access.
Monitor and alert on changes to logging configurations on Cisco ASA devices to identify suspicious activity.