At least this time they them selves found the security vulnerabilities and not someone else.
I hope these internal audits are now a normal part of their business.
I hope these internal audits are now a normal part of their business.
They now are, at 3 stages:
- During design,
- Before early field trial,
- Before production.
Stuff like this is bad for everyone so we're spending a lot of effort upstream to ensure these things don't happen again. And yes it's embarrassing when we find existing products that have these vulns but there's a no-blame attitude that's really helping get things addressed instead of ignoring them (which is the default in large organizations). The faster we can find and address the errors of the past, the better off everyone is.
Ok, but you guys have been screwing the pooch in this regard for decades. What went wrong the last 20+ times?
From the article:
> Let's not criticize Cisco
> The company discovered these flaws following as part of its massive series of internal audits it started back in December 2015.
> At the time, security researchers found a backdoor account in Juniper software that could decrypt VPN traffic, and Cisco decided to hunt and root out any similar backdoors before attackers found them first.
> The company discovered many backdoors and hardcoded accounts in the past two years as part of internal audits and has received some pretty unfair criticism for its efforts.
> The most recent backdoors Cisco discovered was in March, when the company's engineers discovered two —one in Cisco's Prime Collaboration Provisioning (PCP) platform, and one in the IOS XE operating system.
To put it bluntly, even backdoor accounts need their credentials changed once in a while.
Finding those only to replace them with a more elaborate bug seems to be ill intent and unlikely for me. The bigger problem IMO is that the mentality above is still prevalent: for every two backdoors found a new one may be put in by another do-gooder.
I'm sure it is mostly incompetence, with only the occasional state-actor poisoning the well. But I see little evidence Cisco gives a damn or has any intention of actually attempting to regain some of the squandered trust.
Which is fine, from my perspective; for the most part I like other vendors' kit quite a bit more anyway.
I do think product liability law needs to kick in somewhere. If you have some Tourettes-like inability to stop writing back doors in security products, there should be some outside pressure to maybe get some help.
Ha, sure, one could say that the effort itself is commendable (internal audits and exploit hunts), but why does it feel it's a little like applauding a hitman for cleaning up the bloody mess they made in someones house?