8 ms·

From my understanding, Cisco has been taking security very seriously ever since the Snowden leaks. They essentially have an entire team dedicated to designing

by Cyph0n 9y ago

From my understanding, Cisco has been taking security very seriously ever since the Snowden leaks. They essentially have an entire team dedicated to designing and implementing security measures for their devices. However, the focus seems to be on hardware and low-level security. I don't know if they have an active high-level software security team.

ploxiln 9y ago
The thing about security is, it does not work well to try to just add it "on top". You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care. Just enumerating all the stuff you need to not do (e.g. "don't call system() with user input") is inefficient and not completely effective. In my opinion. "Scans" turn up a bunch of false positives and false negatives.
- Cyph0n 9y ago
  > You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care. Right, but this team is not only improving current devices, but also designing the next iteration of Cisco products with a focus on security.
- dmlorenzetti 9y ago
  There's a new-ish book, "Secure by Design", that makes this point -- and shows ways for ordinary devs to design for security without explicitly thinking about security. I really like this book so far (it's still in the early access stage of writing). https://www.manning.com/books/secure-by-design https://www.manning.com/books/secure-by-design
txcwpalpha 9y ago
As a security consultant, it makes me sad that the criteria for "taking security seriously" is as low as just "having an entire team dedicated to ... security". Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Even the most traditionally slow-moving companies these days have security teams. If you do not have this, you are behind and are laughably unprepared for the modern age. I wish the public would start recognizing this and publicly shaming companies that don't take security seriously.
- Cyph0n 9y ago
  I agree, but I think you overestimate: (1) how many companies actually care about security and (2) how recent this security-focused movement among large companies is. Furthermore, Cisco deals with security problems that few other companies worry about, such as the wide-scale availability of counterfeit devices and convincing foreign customers that their devices are backdoor-free.
  - qubex 9y ago
    (3)What small firms’ margins of contribution allow, given the competition in their markets. I for example run a family business that operates in the paint sector in Italy, and you’d be horrified by how compressed margins are (and have become over the past five years of debt crisis and economic recession). There’s always this aura that a rational firm can arbitrarily add structural (HR) costs to defer some nebulous, future “risk”, but in my experience this is not the case (anymore). Competition is so hardscrabble and survival is such a luxury that pretty much everybody is not only willing but obliged to skimp on everything. Being “with the times” simply isn’t an option, sadly.
- brianwawok 9y ago
  > Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Two competitors in a space. One has 3 developers and 1 security guy, the other has 4 developers. In 99/100 outcomes, all else being equal, the 4 developer guy will add more features and outpace the other team and win the market. Security is an overhead and a drag on company resources.. until it's not. But how many startups fail due to lack of a security team? I cannot think of any from my RL network. I am sure some exist... but otherwise, this is the same as most "safety" measures... unimportant until it is really important.
  - bproven 9y ago
    Mainly b/c there are no real downsides/penalties to leaking data (or PII) - you say "sorry" and just move on. Sometimes with an increased stock price - see Equifax :(
ceejayoz 9y ago
> They essentially have an entire team dedicated to designing and implementing security measures for their devices. Isn't that the absolute barest minimum for a corporation of that size and infrastructural importance?
- Cyph0n 9y ago
  In this day and age? Other than your occasional Google or Apple, I don't think so.
  - logicallee 9y ago
    >>>> They essentially have an entire team dedicated to designing and implementing security measures for their devices. >>Isn't that the absolute barest minimum for a corporation of that size and infrastructural importance? >Other than your occasional Google or Apple, I don't think so. Cisco is a $218.62B company (about 24% size of Apple by market cap, 27% of Google by market cap) which is a "Networking hardware company". (As opposed to, say, McDonald's.) I'd say it definitely qualfiies as your "occasional Google or Apple" in terms of "size and infrastructural importance."
    - Cyph0n 9y ago
      I was not talking about "size" at all. I was referring to Google and Apple as examples/outliers of companies that put a huge emphasis on security in practice.
  - haloux 9y ago
    I’d beg to differ. Even in the silicon forest, I frequently come across firms with entirely dedicated Appsec and Infosec departments. Most dev shops out here have them and I’d be comfortable extrapolating that to SV and old money NY/CHI/LA and Austin based on my consulting experience. All of this is, of course, anecdotal but it’s a tad more than a blanket refutation.
athenot 9y ago
We do. :) More importantly, there's also a Secure Development Lifecycle process that basically involves everyone. Security is not an "after the fact" feature that gets bolted on right before market time, it's a requirement for any project or feature and starts at design time, and gets evaluated several times during the development of the product (and after it's released). https://www.cisco.com/c/en/us/about/security-center/security-programs/secure-development-lifecycle/sdl-process.html#psr https://www.cisco.com/c/en/us/about/security-center/security...
- adrianN 9y ago
  Then how does a hardcoded password make it to the customer?
  - frankharv 9y ago
    They are a USA company so maybe a National Security Letter or a FISA court order. The USA now has secret court systems and all USA companies are bound by them.
    - Kadin 9y ago
      That's a pretty asinine way to add a backdoor. I think we can give the intelligence community more credit than that. Plus, if you're an intelligence agency, the ideal backdoor is one you can use, and only you can use -- one that other adversaries can't take advantage of even if they know it's there. A hardcoded password is the opposite of that; once its existence leaks out, which it invariably will, it's open to everyone. Having a developer modify some crypto code in a subtle way that happens to reduce the effectiveness of the system such that it becomes marginally more vulnerable to a certain type of obscure cryptanalysis, preferably very resource-intensive analysis that only you can perform, is the direction I'd try for...
      - stordoff 9y ago
        If a intelligence service is adding the backdoor themselves, or the company is willingly working with them, sure, but I can imagine a scenario where a court orders them to provide access but does not specify the technical means. In that case, the company isn't particularly incentivised to make a subtle/NOBUS backdoor. I'd also wonder about it being a case of deniability - a hardcoded password can be written off as a development/debug oversight, whereas a more structured backdoor/deliberate vulnerability to cryptoanalysis is harder to explain away if found.
TaylorAlexander 9y ago
Google (Actually X/Alphabet) started an entire company focused on computer security. They would have whole departments dedicated to this, rather than teams. But I get that maybe this is a semantic issue. https://www.theverge.com/2018/1/24/16929320/google-x-cybersecurity-chronicle-spin-off-alphabet https://www.theverge.com/2018/1/24/16929320/google-x-cyberse...
thathappened 9y ago
My understanding is any government vendor has to let said government at least audit the source if not provide it to allow then to modify for the equipment they purchase. With that said , if they also control the land it's being shipped through I recall pictures of nsa intercepting Cisco boxes to update FW. So really it's a matter of which government you want spying on you and whether you keep MGMT private or not.

by Cyph0n 9y ago

ploxiln 9y ago

The thing about security is, it does not work well to try to just add it "on top". You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care. Just enumerating all the stuff you need to not do (e.g. "don't call system() with user input") is inefficient and not completely effective. In my opinion. "Scans" turn up a bunch of false positives and false negatives.

Cyph0n 9y ago
> You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care. Right, but this team is not only improving current devices, but also designing the next iteration of Cisco products with a focus on security.
dmlorenzetti 9y ago
There's a new-ish book, "Secure by Design", that makes this point -- and shows ways for ordinary devs to design for security without explicitly thinking about security. I really like this book so far (it's still in the early access stage of writing). https://www.manning.com/books/secure-by-design https://www.manning.com/books/secure-by-design

txcwpalpha 9y ago

As a security consultant, it makes me sad that the criteria for "taking security seriously" is as low as just "having an entire team dedicated to ... security". Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Even the most traditionally slow-moving companies these days have security teams. If you do not have this, you are behind and are laughably unprepared for the modern age. I wish the public would start recognizing this and publicly shaming companies that don't take security seriously.

Cyph0n 9y ago
I agree, but I think you overestimate: (1) how many companies actually care about security and (2) how recent this security-focused movement among large companies is. Furthermore, Cisco deals with security problems that few other companies worry about, such as the wide-scale availability of counterfeit devices and convincing foreign customers that their devices are backdoor-free.
- qubex 9y ago
  (3)What small firms’ margins of contribution allow, given the competition in their markets. I for example run a family business that operates in the paint sector in Italy, and you’d be horrified by how compressed margins are (and have become over the past five years of debt crisis and economic recession). There’s always this aura that a rational firm can arbitrarily add structural (HR) costs to defer some nebulous, future “risk”, but in my experience this is not the case (anymore). Competition is so hardscrabble and survival is such a luxury that pretty much everybody is not only willing but obliged to skimp on everything. Being “with the times” simply isn’t an option, sadly.
brianwawok 9y ago
> Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Two competitors in a space. One has 3 developers and 1 security guy, the other has 4 developers. In 99/100 outcomes, all else being equal, the 4 developer guy will add more features and outpace the other team and win the market. Security is an overhead and a drag on company resources.. until it's not. But how many startups fail due to lack of a security team? I cannot think of any from my RL network. I am sure some exist... but otherwise, this is the same as most "safety" measures... unimportant until it is really important.
- bproven 9y ago
  Mainly b/c there are no real downsides/penalties to leaking data (or PII) - you say "sorry" and just move on. Sometimes with an increased stock price - see Equifax :(

ceejayoz 9y ago

> They essentially have an entire team dedicated to designing and implementing security measures for their devices. Isn't that the absolute barest minimum for a corporation of that size and infrastructural importance?

Cyph0n 9y ago
In this day and age? Other than your occasional Google or Apple, I don't think so.
- logicallee 9y ago
  >>>> They essentially have an entire team dedicated to designing and implementing security measures for their devices. >>Isn't that the absolute barest minimum for a corporation of that size and infrastructural importance? >Other than your occasional Google or Apple, I don't think so. Cisco is a $218.62B company (about 24% size of Apple by market cap, 27% of Google by market cap) which is a "Networking hardware company". (As opposed to, say, McDonald's.) I'd say it definitely qualfiies as your "occasional Google or Apple" in terms of "size and infrastructural importance."
  - Cyph0n 9y ago
    I was not talking about "size" at all. I was referring to Google and Apple as examples/outliers of companies that put a huge emphasis on security in practice.
- haloux 9y ago
  I’d beg to differ. Even in the silicon forest, I frequently come across firms with entirely dedicated Appsec and Infosec departments. Most dev shops out here have them and I’d be comfortable extrapolating that to SV and old money NY/CHI/LA and Austin based on my consulting experience. All of this is, of course, anecdotal but it’s a tad more than a blanket refutation.

athenot 9y ago

We do. :) More importantly, there's also a Secure Development Lifecycle process that basically involves everyone. Security is not an "after the fact" feature that gets bolted on right before market time, it's a requirement for any project or feature and starts at design time, and gets evaluated several times during the development of the product (and after it's released). https://www.cisco.com/c/en/us/about/security-center/security-programs/secure-development-lifecycle/sdl-process.html#psr https://www.cisco.com/c/en/us/about/security-center/security...

adrianN 9y ago
Then how does a hardcoded password make it to the customer?
- frankharv 9y ago
  They are a USA company so maybe a National Security Letter or a FISA court order. The USA now has secret court systems and all USA companies are bound by them.
  - Kadin 9y ago
    That's a pretty asinine way to add a backdoor. I think we can give the intelligence community more credit than that. Plus, if you're an intelligence agency, the ideal backdoor is one you can use, and only you can use -- one that other adversaries can't take advantage of even if they know it's there. A hardcoded password is the opposite of that; once its existence leaks out, which it invariably will, it's open to everyone. Having a developer modify some crypto code in a subtle way that happens to reduce the effectiveness of the system such that it becomes marginally more vulnerable to a certain type of obscure cryptanalysis, preferably very resource-intensive analysis that only you can perform, is the direction I'd try for...
    - stordoff 9y ago
      If a intelligence service is adding the backdoor themselves, or the company is willingly working with them, sure, but I can imagine a scenario where a court orders them to provide access but does not specify the technical means. In that case, the company isn't particularly incentivised to make a subtle/NOBUS backdoor. I'd also wonder about it being a case of deniability - a hardcoded password can be written off as a development/debug oversight, whereas a more structured backdoor/deliberate vulnerability to cryptoanalysis is harder to explain away if found.

TaylorAlexander 9y ago

Google (Actually X/Alphabet) started an entire company focused on computer security. They would have whole departments dedicated to this, rather than teams. But I get that maybe this is a semantic issue. https://www.theverge.com/2018/1/24/16929320/google-x-cybersecurity-chronicle-spin-off-alphabet https://www.theverge.com/2018/1/24/16929320/google-x-cyberse...

thathappened 9y ago

My understanding is any government vendor has to let said government at least audit the source if not provide it to allow then to modify for the equipment they purchase. With that said , if they also control the land it's being shipped through I recall pictures of nsa intercepting Cisco boxes to update FW. So really it's a matter of which government you want spying on you and whether you keep MGMT private or not.