|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: "Cisco gate" and "Meet the Fed" at Defcon....
Cisco is in fact listening. Cisco, like other companies, generally does not release security notices until enough information exists to allow customers to make a reasonable determination as to whether or not they are at risk and how to mitigate possible risk.Cisco, are you listening? The issue underlying the suit wasn't the disclosure of the security issue, although we would have rather worked that according to the usual processes. From what the corporate legal folks tell me, their issue was the disclosure of Cisco intellectual property. Note that it wasn't just Cisco that felt the presentation was out of order; Lynn's employer became "former" because it also felt that way. I'll refer you to the legal brief for anything further on that, but I would really like to see this discussion begin to resemble an informed one. By this misbehavior you are seriously discouraging researchers from releasing info to you. They will suspect you'll sit on the exploit for months and not tell anyone (as you did with this one). They'll be afraid you'll try to kill the messenger (as you did with this one).For the record, the vulnerability was first detected by Cisco in internal testing, not by outside researchers, and Cisco's approach to this has been in accordance with the RDF. Part of that process, at Cisco, is to develop work-arounds or updated code that corrects the exploit, testing it, and getting it into the field. Releasing the information on the exploit before that point exposes the ISPs to a vulnerability that they can't fix, or puts them into a scramble to download code that they haven't been able to gain confidence on. I should imagine that the various operators on this list would prefer to get the fix in place before the vulnerability is exposed rather than playing catchup while their pants are around their ankles. We very much try to work with people that are willing to work with us. We aren't very impressed by people that expose the industry to danger.
|