This week, Cisco provided comments on the Department of Commerce’s Bureau of Industry and Security (BIS) proposed cybersecurity regulations. These comments reflect the realities of how Cisco looks to protect both our customers and our products. They also emphasize the critical role that security researches, access to tools, and qualified talent have in cybersecurity.
Cisco has hundreds of dedicated security engineers and researchers throughout the company and around the globe, who use the latest and greatest tools and techniques to test our technology. We proactively attempt to break into our own products, our own services, and our own networks, in order to close identified weaknesses and vulnerabilities as soon as possible and to develop better protections against attack. Many of these same people are responsible for investigating reported vulnerabilities or compromises of our products and running these reports to ground with absolute certainty. In doing this, we have resolved countless bugs and vulnerabilities and continue to improve the security of our products with what we learn. Along the way we have discovered many interesting and creative adversaries and certainly learned that there are some very resourceful people out there. Read More »
Tags: penetration testing, Secure Development Lifecycle, security, trustworthy systems, Vulnerability Research
Over the past month, many of the Cisco Security Blog contributors have provided their view on Cybersecurity and its implications for customer network designs, architectures, protections, and services. These, in aggregate, stress what we all know: security is best achieved using a layered defense that includes securing endpoints, hosts, and network and services infrastructures. Cisco adds some unique layers to this defense, which stems from our experience developing capabilities and solutions that meet the needs of critical infrastructure and government networks. We are applying these lessons, capabilities, and our layered defensive approach to critical business infrastructures, as well.
Cisco takes a “build-in security” approach to provide device, system, infrastructure, and services security, and is the basis of the development approach that we use called the Cisco Secure Development Lifecycle (CSDL). Our development processes leverage product security baseline requirements, threat modeling in design or static analysis and fuzzing in validation, and registration of third-party software to better address vulnerabilities when they are disclosed. In the innermost layer of our products, security is built-in to devices in both silicon and software. The use of runtime assurance and protection capabilities such as Address Space Layout Randomization (ASLR), Object Size Checking, and execution space protections coupled with secure boot, image signing, and common crypto modules are leading to even more resilient products in an increasingly threatening environment.
Read More »
Tags: CSDL, cyber-security-month-2012, secure development, Secure Development Lifecycle
What a week! From October 31-November 3, Cisco hosted its annual internal security event—SecCon 2011. Co-hosted by Greg Akers, SVP of Cisco’s Global Government Solutions Group and Ed Paradise, Vice President of Engineering, this marked the fourth year in which we shared the latest in product security practices, policies, processes, and thought leadership with employees who participated in live and virtual sessions around the world.
Read More »
Tags: common crypto, CSDL, product certifications, product security, public policy, Secure Development Lifecycle, security, trustworthy systems