Cisco is committed to protecting customers by sharing critical security-related information in different formats. Guided by customer feedback, Cisco’s Product Security Incident Response Team (PSIRT) is seeking ways to improve how we communicate information about Cisco product vulnerabilities to our Customers and Partners. As John Stewart mentioned on his blog post, the Cisco PSIRT has launched a new and improved security vulnerability disclosure format. The new Cisco Security Advisories can be accessed at http://www.cisco.com/go/psirt and at http://cisco.com/security
The intent is to make it easier for Customers and Partners to access information about all security vulnerabilities in Cisco products. Each vulnerability disclosed through our new security advisories are assigned a Common Vulnerability and Exposures (CVE) identifier to aid in identification. Additionally, Cisco will continue to assess all vulnerabilities using the Common Vulnerability Scoring System (CVSS). Check out the sites for CVE, CVSS, and this CVSS scoring calculator if these terms are relatively new to you or you simply need a refresher.
Read More »
Tags: Cisco PSIRT, cvrf, Open Vulnerability and Assessment Language (OVAL), OVAL, psirt, security advisories, security automation, vulnerabilities, vulnerability disclosure, vulnerability management
UPDATE: Webcast information is also now available at the Cisco Live 365 site
Many network security administrators are struggling to keep their network “up-to-date” with the constant release of new vulnerabilities and software fixes. At the same time, they’re under pressure to provide near 100% availability of key business services and systems. Every time a vendor discloses a security vulnerability, network security administrators must identify affected devices and (in numerous cases) upgrade such devices. These activities can take hours, days, or even weeks depending on the size of the organization. For instance large enterprises and organizations may have thousands of routers and switches that need to be assessed for the impact of any given vulnerability. Cisco is helping customers by adopting cutting-edge security automation standards such as the Open Vulnerability and Assessment Language (OVAL) and the Common Vulnerability Reporting Framework (CVRF).
In the following blog posts, I’ve provided details about how security automation is helping customers:
Additionally, my colleague Mike Schiffman has posted several posts explaining CVRF.
Webcast took place on Tuesday, April 23rd at 10:00 a.m. EST (14:00 GMT). Over 150 customers from 29 countries learned about security automation; Cisco’s machine readable content strategy; and vulnerability assessment using OVAL. We discussed how customers can use OVAL to quickly assess the effects of security vulnerabilities in Cisco IOS Software devices. The recording is now available:
Tags: cisco ios oval, cisco oval, cvrf, operational security, OVAL, security, security automation, seminar, webcast
No software is immune to security vulnerabilities. The time between the discovery and disclosure of security vulnerabilities and the availability of an exploit is getting shorter. This imposes pressures on network security professionals and information technology (IT) managers to quickly respond to security vulnerabilities or apply mitigation in their network. Many organizations are struggling to keep up-to-date with the constant release of new vulnerabilities and software fixes. At the same time, they are under pressure to provide near 100% availability of key business services and systems.
Note: Cisco has a very robust vulnerability management process. This process is described in detail at Cisco’s Security Vulnerability Policy. The Cisco Product Security Incident Response Team (PSIRT) manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks.
As an example, every time Cisco discloses a security vulnerability for Cisco IOS Software (or any given product), network security administrators have to identify affected devices and (in numerous cases) upgrade such devices. These activities can take hours, days, or even weeks depending on the size of the organization. For instance large enterprises and organizations may have thousands of routers and switches that need to be assessed for the impact of any given vulnerability.
Read More »
Tags: automation, OVAL, psirt, security
Security automation is a hot topic these days. Most organizations have many systems to patch and configure securely, with numerous versions of software and features enabled. Many security administrators are seeking ways to leverage standards and available tools to reduce the complexity and time necessary to respond to security advisories, assess their devices, and ensure compliance so they can allocate resources to focus on other areas of their network and security infrastructure.
Cisco is committed to protect customers by sharing critical security-related information in different formats.
Starting today, September 26, 2012, Cisco’s Product Security Incident Response Team (PSIRT) is including Open Vulnerability and Assessment Language (OVAL) definitions in Cisco IOS security advisories. Read More »
Tags: cvrf, ios bundle, OVAL, psirt, security, security advisories