Cisco Blogs


Cisco Blog > Security

I Patched my Car Over the Weekend

Actually, I did it on Saturday afternoon, that way I had time to test the patch and roll it back if necessary and still have the car ready for Monday.

So… when do you patch your car? Interesting, albeit fictitious, conversation that will relatively soon become reality. New cars are sophisticated artifacts. They look nice and enable you to travel from point A to point B in great comfort (well, most of them), and they are packed with electronics. Inside the car there are multiple processors and computers executing hundreds of thousands of lines of code to ensure your safe journey. The programmers who wrote that code are as equally adept as the ones writing modern operating systems and applications – which means that there are some errors in the algorithms that monitor and maintain many aspects of your car, and in their implementation.

Read More »

Tags: ,

Death, Taxes, and Vulnerability Scanners

When talking about vulnerabilities, the Cisco PSIRT has probably seen it all. Vulnerabilities that can be exploited over the network, vulnerabilities that need local access, and vulnerabilities that need physical access. Vulnerabilities that affect integrity, confidentiality, and availability. Vulnerabilities at the operating system level, at the application level, or at the protocol level. Hands down, the most time consuming and complex to handle are those involving a protocol -- we need to investigate each and every Cisco product that implements the affected protocol. And if the vulnerability is in, say, IPv4… the investigation will require significant time and resources.

But there is one kind of report that makes the heart of any PSIRT Incident Manager sink -- an email from a customer asking “How do I fix these vulnerabilities?”. And attached to the email -- a report from a vulnerability scanner.

Read More »

Tags: ,

Penetration Testing in the Cloud

Tell me if this sounds familiar… you are asked to perform a penetration test on customer’s network to determine the security posture of their assets and the first thing they do is give you a list of assets that you are NOT allowed to test, because they are critical systems to the business. Ironic isn’t it? This is exactly the difficulty you can expect when performing penetration testing in the cloud, but multiplied by ten.

There is a lot to think about and plan for when you want to perform a penetration test in a cloud service provider’s (CSP) network. Before we get into the technical details, we need to start with the basics.

Read More »

Tags: , , , ,