8 ms·

I would love to know which cloud companies, such as Amazon AWS, Azure, Google Cloud Platform, etc. use Cisco at any critical part of their architecture. Becaus

I would love to know which cloud companies, such as Amazon AWS, Azure, Google Cloud Platform, etc. use Cisco at any critical part of their architecture. Because Cisco has proven over and over again that they can't be trusted. Or has something changed these last couple of years that I do not know about regarding how they handle security? Edit: I forgot that Google use their own hardware, but the article doesn't mention if they use it for their cloud platform. https://www.wired.com/2015/06/google-reveals-secret-gear-connects-online-empire https://www.wired.com/2015/06/google-reveals-secret-gear-con...

lpasselin 9y ago
Any examples except this issue?
- reimertz 9y ago
  https://arstechnica.com/information-technology/2017/03/a-simple-command-allows-the-cia-to-commandeer-318-models-of-cisco-switches/ https://arstechnica.com/information-technology/2017/03/a-sim... https://arstechnica.com/information-technology/2018/01/cisco-drops-a-mega-vulnerability-alert-for-vpn-devices/ https://arstechnica.com/information-technology/2018/01/cisco... https://arstechnica.com/information-technology/2016/08/cisco-confirms-nsa-linked-zeroday-targeted-its-firewalls-for-years/ https://arstechnica.com/information-technology/2016/08/cisco... https://arstechnica.com/information-technology/2013/01/hack-turns-the-cisco-phone-on-your-desk-into-a-remote-bugging-device/ https://arstechnica.com/information-technology/2013/01/hack-...
- craftkiller 9y ago
  https://news.ycombinator.com/item?id=16259127 https://news.ycombinator.com/item?id=16259127 https://news.ycombinator.com/item?id=13923669 https://news.ycombinator.com/item?id=13923669 https://news.ycombinator.com/item?id=13466187 https://news.ycombinator.com/item?id=13466187 https://news.ycombinator.com/item?id=14594331 https://news.ycombinator.com/item?id=14594331 https://news.ycombinator.com/item?id=5401496 https://news.ycombinator.com/item?id=5401496
- disconnected 9y ago
  Cisco has had a bunch of boneheaded security issues "recently" (last 2 years or so, by my casual observations). A quick Google search will find several such examples. See for example: https://www.theregister.co.uk/2017/04/06/stop_us_if_youve_heard_this_cisco_aironet_has_hardcoded_passwords/ https://www.theregister.co.uk/2017/04/06/stop_us_if_youve_he... https://www.theregister.co.uk/2018/02/26/cisco_elastic_services_controller_critical_vulnerability/ https://www.theregister.co.uk/2018/02/26/cisco_elastic_servi...
  - davidu 9y ago
    Cisco has 800,000 customers and thousands of active products in the market. I think Cisco does an exemplary job on how it handles security both proactively: in design, in development, in production, and in response to disclosures and discoveries. Same with Microsoft, and the other few companies on the planet who operate at this scale. I think it's easy to find our mistakes, but keep in mind our corporate culture is to shine a light as honestly and transparently as possible on security issues, and we strive to err on the side of caution and communication. (I work for Cisco)
- deleted 9y ago
  [deleted]
crb 9y ago
Google Cloud Platform builds its own: https://www.wired.com/2015/06/google-reveals-secret-gear-connects-online-empire/ https://www.wired.com/2015/06/google-reveals-secret-gear-con...
- mtgx 9y ago
  That may not be up to date: https://www.blog.google/topics/google-cloud/cisco-and-google-partner-open-hybrid-cloud/ https://www.blog.google/topics/google-cloud/cisco-and-google...
- ra1n85 9y ago
  No, that only pertains to specific parts of the network (which are typically not complex). Google does operate (lots of) vendor gear, particularly at their network edge.
- scurvy 9y ago
  Google (corporate? maybe not Cloud) and Facebook still buy a lot of vendor gear, though it's mostly Arista. Google and FB have investments in running their own whitebox gear, but they use their own purchasing size as a carrot with companies like Arista. "If you can build this feature in 3 months, we'll buy X units. Otherwise we'll build it in house." Arista has much more resources to bring to the challenge, and they generally get the feature built quickly. Sometimes I wonder if the "in house" networking projects are just a ruse to get vendors jumping whenever you call. The brainpower and talent that a company like Arista can dedicate to projects is much more than a tiny division inside Google or FB. Not hating on Google or FB, just trying to figure out their game.
  - ra1n85 9y ago
    It makes (business) sense to build your own gear when you operate at scale. Typical use cases are TORs and small table routers used for data center Clos topologies. Both often make use of merchant silicon which come with SDK's.
    - scurvy 9y ago
robbyt 9y ago
Bad security is typically the tip of the iceberg.
Karunamon 9y ago
It is somewhat telling that we keep finding hardcoded credentials in their gear. An honest company making an honest mistake, after the first or second time this came out, would have ordered a review to ensure that no further instances of this are in shipping code.
Cyph0n 9y ago
From my understanding, Cisco has been taking security very seriously ever since the Snowden leaks. They essentially have an entire team dedicated to designing and implementing security measures for their devices. However, the focus seems to be on hardware and low-level security. I don't know if they have an active high-level software security team.
- ploxiln 9y ago
  The thing about security is, it does not work well to try to just add it "on top". You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care. Just enumerating all the stuff you need to not do (e.g. "don't call system() with user input") is inefficient and not completely effective. In my opinion. "Scans" turn up a bunch of false positives and false negatives.
  - Cyph0n 9y ago
    > You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care. Right, but this team is not only improving current devices, but also designing the next iteration of Cisco products with a focus on security.
  - dmlorenzetti 9y ago
    There's a new-ish book, "Secure by Design", that makes this point -- and shows ways for ordinary devs to design for security without explicitly thinking about security. I really like this book so far (it's still in the early access stage of writing). https://www.manning.com/books/secure-by-design https://www.manning.com/books/secure-by-design
- txcwpalpha 9y ago
  As a security consultant, it makes me sad that the criteria for "taking security seriously" is as low as just "having an entire team dedicated to ... security". Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Even the most traditionally slow-moving companies these days have security teams. If you do not have this, you are behind and are laughably unprepared for the modern age. I wish the public would start recognizing this and publicly shaming companies that don't take security seriously.
mc32 9y ago
I would bet they all do. Yes they use custom hardware for some intra datacenter tasks, but outside of that i think they will all have Cisco, to one degree or another. Mostly great degrees.
xnyan 9y ago
While Cisco's market share has been slipping steadily, they still have more that 50% of the traditional big metal box market for routers and switches.
- peterwwillis 9y ago
  A lot of their money is/will be coming from SDN, virtualization and security, so they are definitely not limited to big metal boxes. But that's what they specialize in, and that's what most of the whales rely on.
peterwwillis 9y ago
> Cisco has proven over and over again that they can't be trusted. So has Windows. So has Linux. So has MacOS. Does anyone stop using these just because they're riddled with security flaws? Cisco is a vendor just like any other. You can not reinvent every single piece of technology in the world just because you think you can do it better - not only because you probably can't, but also because it costs too much, and also because you don't have enough time. Saying "Cisco can't be trusted" just because they have security flaws is a bit like saying "Debian can't be trusted" just because they've had massive holes that nobody else has had. They fix the holes, they put new practices in place, they move on. You don't have to stop using them, but the alternatives are not definitively more secure.
- petee 9y ago
  None of your examples have pretty much had hardcoded-password vulnerabilities once-a-year for the past 20 years. (yes, a slight exaggeration but you get the idea) And only one of these, Cisco is a security/infrastructure company. So to consistently miss low hanging fruit, and violate best-common-practices...yeah, their trust level should be taking a hit.
  - peterwwillis 9y ago
    Whereas Linux probably has had privesc holes once a year for 20 years, Cisco definitely has not. Their core products have been rock solid for decades. Only their newer, non-IOS stuff has had persistent problems lately, with a few of IOS holes.
    - petee 9y ago
      Actually they have - IOS has had almost 1 a year the last 20 years...compare Code Execution CVEs to the Linux Kernel, and they are damn close if you exclude the kernel's huge number for 2017 - Kernel only has 20 more than IOS. And the kernel is likely far larger than IOS Edit: apparently this isn't the only 'product' page for IOS, there are multiple, and also different versions which get their own CVEs: https://www.cvedetails.com/product/19/Cisco-IOS.html?vendor_id=16 https://www.cvedetails.com/product/19/Cisco-IOS.html?vendor_... https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm...

lpasselin 9y ago

Any examples except this issue?

reimertz 9y ago
https://arstechnica.com/information-technology/2017/03/a-simple-command-allows-the-cia-to-commandeer-318-models-of-cisco-switches/ https://arstechnica.com/information-technology/2017/03/a-sim... https://arstechnica.com/information-technology/2018/01/cisco-drops-a-mega-vulnerability-alert-for-vpn-devices/ https://arstechnica.com/information-technology/2018/01/cisco... https://arstechnica.com/information-technology/2016/08/cisco-confirms-nsa-linked-zeroday-targeted-its-firewalls-for-years/ https://arstechnica.com/information-technology/2016/08/cisco... https://arstechnica.com/information-technology/2013/01/hack-turns-the-cisco-phone-on-your-desk-into-a-remote-bugging-device/ https://arstechnica.com/information-technology/2013/01/hack-...
craftkiller 9y ago
https://news.ycombinator.com/item?id=16259127 https://news.ycombinator.com/item?id=16259127 https://news.ycombinator.com/item?id=13923669 https://news.ycombinator.com/item?id=13923669 https://news.ycombinator.com/item?id=13466187 https://news.ycombinator.com/item?id=13466187 https://news.ycombinator.com/item?id=14594331 https://news.ycombinator.com/item?id=14594331 https://news.ycombinator.com/item?id=5401496 https://news.ycombinator.com/item?id=5401496
disconnected 9y ago
Cisco has had a bunch of boneheaded security issues "recently" (last 2 years or so, by my casual observations). A quick Google search will find several such examples. See for example: https://www.theregister.co.uk/2017/04/06/stop_us_if_youve_heard_this_cisco_aironet_has_hardcoded_passwords/ https://www.theregister.co.uk/2017/04/06/stop_us_if_youve_he... https://www.theregister.co.uk/2018/02/26/cisco_elastic_services_controller_critical_vulnerability/ https://www.theregister.co.uk/2018/02/26/cisco_elastic_servi...
- davidu 9y ago
  Cisco has 800,000 customers and thousands of active products in the market. I think Cisco does an exemplary job on how it handles security both proactively: in design, in development, in production, and in response to disclosures and discoveries. Same with Microsoft, and the other few companies on the planet who operate at this scale. I think it's easy to find our mistakes, but keep in mind our corporate culture is to shine a light as honestly and transparently as possible on security issues, and we strive to err on the side of caution and communication. (I work for Cisco)
deleted 9y ago
[deleted]

crb 9y ago

Google Cloud Platform builds its own: https://www.wired.com/2015/06/google-reveals-secret-gear-connects-online-empire/ https://www.wired.com/2015/06/google-reveals-secret-gear-con...

mtgx 9y ago
That may not be up to date: https://www.blog.google/topics/google-cloud/cisco-and-google-partner-open-hybrid-cloud/ https://www.blog.google/topics/google-cloud/cisco-and-google...
ra1n85 9y ago
No, that only pertains to specific parts of the network (which are typically not complex). Google does operate (lots of) vendor gear, particularly at their network edge.
scurvy 9y ago
Google (corporate? maybe not Cloud) and Facebook still buy a lot of vendor gear, though it's mostly Arista. Google and FB have investments in running their own whitebox gear, but they use their own purchasing size as a carrot with companies like Arista. "If you can build this feature in 3 months, we'll buy X units. Otherwise we'll build it in house." Arista has much more resources to bring to the challenge, and they generally get the feature built quickly. Sometimes I wonder if the "in house" networking projects are just a ruse to get vendors jumping whenever you call. The brainpower and talent that a company like Arista can dedicate to projects is much more than a tiny division inside Google or FB. Not hating on Google or FB, just trying to figure out their game.
- ra1n85 9y ago
  It makes (business) sense to build your own gear when you operate at scale. Typical use cases are TORs and small table routers used for data center Clos topologies. Both often make use of merchant silicon which come with SDK's.
  - scurvy 9y ago

robbyt 9y ago

Bad security is typically the tip of the iceberg.

Karunamon 9y ago

It is somewhat telling that we keep finding hardcoded credentials in their gear. An honest company making an honest mistake, after the first or second time this came out, would have ordered a review to ensure that no further instances of this are in shipping code.

Cyph0n 9y ago

From my understanding, Cisco has been taking security very seriously ever since the Snowden leaks. They essentially have an entire team dedicated to designing and implementing security measures for their devices. However, the focus seems to be on hardware and low-level security. I don't know if they have an active high-level software security team.

ploxiln 9y ago
The thing about security is, it does not work well to try to just add it "on top". You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care. Just enumerating all the stuff you need to not do (e.g. "don't call system() with user input") is inefficient and not completely effective. In my opinion. "Scans" turn up a bunch of false positives and false negatives.
- Cyph0n 9y ago
  > You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care. Right, but this team is not only improving current devices, but also designing the next iteration of Cisco products with a focus on security.
- dmlorenzetti 9y ago
  There's a new-ish book, "Secure by Design", that makes this point -- and shows ways for ordinary devs to design for security without explicitly thinking about security. I really like this book so far (it's still in the early access stage of writing). https://www.manning.com/books/secure-by-design https://www.manning.com/books/secure-by-design
txcwpalpha 9y ago
As a security consultant, it makes me sad that the criteria for "taking security seriously" is as low as just "having an entire team dedicated to ... security". Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Even the most traditionally slow-moving companies these days have security teams. If you do not have this, you are behind and are laughably unprepared for the modern age. I wish the public would start recognizing this and publicly shaming companies that don't take security seriously.

mc32 9y ago

I would bet they all do. Yes they use custom hardware for some intra datacenter tasks, but outside of that i think they will all have Cisco, to one degree or another. Mostly great degrees.

xnyan 9y ago

While Cisco's market share has been slipping steadily, they still have more that 50% of the traditional big metal box market for routers and switches.

peterwwillis 9y ago
A lot of their money is/will be coming from SDN, virtualization and security, so they are definitely not limited to big metal boxes. But that's what they specialize in, and that's what most of the whales rely on.

peterwwillis 9y ago

> Cisco has proven over and over again that they can't be trusted. So has Windows. So has Linux. So has MacOS. Does anyone stop using these just because they're riddled with security flaws? Cisco is a vendor just like any other. You can not reinvent every single piece of technology in the world just because you think you can do it better - not only because you probably can't, but also because it costs too much, and also because you don't have enough time. Saying "Cisco can't be trusted" just because they have security flaws is a bit like saying "Debian can't be trusted" just because they've had massive holes that nobody else has had. They fix the holes, they put new practices in place, they move on. You don't have to stop using them, but the alternatives are not definitively more secure.

petee 9y ago
None of your examples have pretty much had hardcoded-password vulnerabilities once-a-year for the past 20 years. (yes, a slight exaggeration but you get the idea) And only one of these, Cisco is a security/infrastructure company. So to consistently miss low hanging fruit, and violate best-common-practices...yeah, their trust level should be taking a hit.
- peterwwillis 9y ago
  Whereas Linux probably has had privesc holes once a year for 20 years, Cisco definitely has not. Their core products have been rock solid for decades. Only their newer, non-IOS stuff has had persistent problems lately, with a few of IOS holes.
  - petee 9y ago
    Actually they have - IOS has had almost 1 a year the last 20 years...compare Code Execution CVEs to the Linux Kernel, and they are damn close if you exclude the kernel's huge number for 2017 - Kernel only has 20 more than IOS. And the kernel is likely far larger than IOS Edit: apparently this isn't the only 'product' page for IOS, there are multiple, and also different versions which get their own CVEs: https://www.cvedetails.com/product/19/Cisco-IOS.html?vendor_id=16 https://www.cvedetails.com/product/19/Cisco-IOS.html?vendor_... https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm...