4 ms·

Cisco is a very large company, that mostly acquires existing products and employees. They do make an effort to train new hires on their SDLC and security practi

Cisco is a very large company, that mostly acquires existing products and employees. They do make an effort to train new hires on their SDLC and security practices. But at the end of the day, security is up to the individual product development team. There's lots of those teams, and most of them are clueless about security. So it's honestly kind of a miracle when there isn't a big security vulnerability in any given product. I've worked for a lot of large enterprises, and they all are the same. Nothing special about Cisco or any others. Security is hard, and it does not provide a good return to invest in good security. You can stop using hardcoded passwords, but it won't make you any more money, and customers clearly aren't leaving because of them. The stock price is the only thing that matters. As long as that's safe, it's business as usual.

jeffrallen 3y ago
Cisco, to it's credit, does a good job of internal quality auditing, so bad behavior of these individual teams gets caught and corrected. But there is just so much bad behavior...
JohnFen 3y ago
> They do make an effort to train new hires on their SDLC and security practices. Cisco has security practices?
- throwawaaarrgh 3y ago
  Not only do they have standard security practices and training programs, they have one of the industry's best known security research teams. rest of comment redacted due to too much honesty/whisky
marcus0x62 3y ago
Another thing to consider is how many development resources a given product/team has available. Emergency Responder is fundamentally a supporting product[0] to their PBX software. For the organizations that need it, it is something they have to have, but nobody that buys PBXes[1] picks a PBX on the basis of the security of the E911 add on package. Now, if you're a big vendor, do you give more resources to the PBX team that builds features which sells PBX customers, or the add on team used by a fraction of a percent of the worldwide PBX install base? I'm not asking what you should do, but rather what your inner MBA would do... 0 - the fundamental purposes of Emergency Responder are to a) provide enhanced location information about a caller, say the general location within a building, and b) to allow emergency responders to call back the person who placed an emergency call, even if the phone they called from does not have a directly callable phone number. It does some other things, too, but those are the "primary" features. 1 - source: sold a whole bunch of PBXes.
oldbbsnickname 3y ago
Sadly, it's true. There are a lot of rebranded products with completely different stacks. And some started as pretty gross, thrown together startups. If you wanted to make some juice at the cost of a lot of squeeze, legacy support is always needing self-abusive people who can keep fragile crap going.

jeffrallen 3y ago

Cisco, to it's credit, does a good job of internal quality auditing, so bad behavior of these individual teams gets caught and corrected. But there is just so much bad behavior...

JohnFen 3y ago

> They do make an effort to train new hires on their SDLC and security practices. Cisco has security practices?

throwawaaarrgh 3y ago
Not only do they have standard security practices and training programs, they have one of the industry's best known security research teams. rest of comment redacted due to too much honesty/whisky

marcus0x62 3y ago

Another thing to consider is how many development resources a given product/team has available. Emergency Responder is fundamentally a supporting product[0] to their PBX software. For the organizations that need it, it is something they have to have, but nobody that buys PBXes[1] picks a PBX on the basis of the security of the E911 add on package. Now, if you're a big vendor, do you give more resources to the PBX team that builds features which sells PBX customers, or the add on team used by a fraction of a percent of the worldwide PBX install base? I'm not asking what you should do, but rather what your inner MBA would do... 0 - the fundamental purposes of Emergency Responder are to a) provide enhanced location information about a caller, say the general location within a building, and b) to allow emergency responders to call back the person who placed an emergency call, even if the phone they called from does not have a directly callable phone number. It does some other things, too, but those are the "primary" features. 1 - source: sold a whole bunch of PBXes.

oldbbsnickname 3y ago

Sadly, it's true. There are a lot of rebranded products with completely different stacks. And some started as pretty gross, thrown together startups. If you wanted to make some juice at the cost of a lot of squeeze, legacy support is always needing self-abusive people who can keep fragile crap going.