4 ms·

Don't use Cisco equipment; they put (quite sloppy) backdoors in their products. Absolutely zero trust with them. Snowden: The NSA planted backdoors in Cisco pr

by davisr 3y ago

Don't use Cisco equipment; they put (quite sloppy) backdoors in their products. Absolutely zero trust with them. Snowden: The NSA planted backdoors in Cisco products --- https://www.infoworld.com/article/2608141/snowden--the-nsa-planted-backdoors-in-cisco-products.html https://www.infoworld.com/article/2608141/snowden--the-nsa-p... Backdoors Keep Appearing In Cisco's Routers --- https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a... Sinister secret backdoor found in networking gear perfect for government espionage: The Chinese are – oh no, wait, it's Cisco again --- https://www.theregister.com/2019/05/02/cisco_vulnerabilities/ https://www.theregister.com/2019/05/02/cisco_vulnerabilities...

sneak 3y ago
The idea that the network is trustworthy is outdated. Assume all network connections, including those through your own equipment, are under surveillance. You shouldn't be trusting your network equipment to be not-backdoored in the first place. (Never mind that the router on the other end of the cable isn't yours and is untrusted also, whether Cisco or not.) CPUs have AES key schedule accelerator instructions for a reason now. Encrypt and authenticate your traffic.
- davisr 3y ago
  I respectfully disagree. Are you suggesting everyone just rolls over and forgets about making decisions to the best of their ability to ensure security? The switches on the outside of your network do not matter. The traffic doesn't matter. If you lose trust in your own switching equipment then it's all over. Management network? Compromised. Segmented traffic? Compromised. IPMI/BMC interfaces? Compromised. Anybody else's malformed traffic could breach your defense, and breach the very sanctity of the traffic your network is spitting out. It doesn't matter if your computer encrypts its traffic because a breached switch can just silence it. A company selling switches/routers/firewalls should _not_ have these liabilities, and as these liabilities are known, nobody should buy Cisco equipment, ever. Buy the equipment that you know is the safest. Don't just give up and roll over!
  - sneak 3y ago
    > If you lose trust in your own switching equipment then it's all over. What is all over? The security boundary is when packets leave the machine with private information. VLANs and management networks and whatever aren't it. Proper security assumes an insecure network and uses cryptography for privacy and authentication.
  - teleforce 3y ago
    Internet packet switching architecture is an attempt to provide reliable networks over unreliable (low cost) components, and very successful on that. Similarly, network or cyber security should be able to provide secure networks over insecure (untrusted) components.

by davisr 3y ago

sneak 3y ago

The idea that the network is trustworthy is outdated. Assume all network connections, including those through your own equipment, are under surveillance. You shouldn't be trusting your network equipment to be not-backdoored in the first place. (Never mind that the router on the other end of the cable isn't yours and is untrusted also, whether Cisco or not.) CPUs have AES key schedule accelerator instructions for a reason now. Encrypt and authenticate your traffic.

davisr 3y ago
I respectfully disagree. Are you suggesting everyone just rolls over and forgets about making decisions to the best of their ability to ensure security? The switches on the outside of your network do not matter. The traffic doesn't matter. If you lose trust in your own switching equipment then it's all over. Management network? Compromised. Segmented traffic? Compromised. IPMI/BMC interfaces? Compromised. Anybody else's malformed traffic could breach your defense, and breach the very sanctity of the traffic your network is spitting out. It doesn't matter if your computer encrypts its traffic because a breached switch can just silence it. A company selling switches/routers/firewalls should _not_ have these liabilities, and as these liabilities are known, nobody should buy Cisco equipment, ever. Buy the equipment that you know is the safest. Don't just give up and roll over!
- sneak 3y ago
  > If you lose trust in your own switching equipment then it's all over. What is all over? The security boundary is when packets leave the machine with private information. VLANs and management networks and whatever aren't it. Proper security assumes an insecure network and uses cryptography for privacy and authentication.
- teleforce 3y ago
  Internet packet switching architecture is an attempt to provide reliable networks over unreliable (low cost) components, and very successful on that. Similarly, network or cyber security should be able to provide secure networks over insecure (untrusted) components.