Slashdot Mirror
Cisco Evolving Into A Security Company
ChipGuy writes "Om Malik has an opinion piece stating his opinion that Cisco Systems is slowly becoming a security company, a move which may prove problematic for traditional security vendors like Symantec. Cisco has bought its way into the market, worried about the security moves of its main rival, Juniper Networks. The company expects to make major announcements at the RSA Conference later this week. "
Apparently they are very intersted in elliptic curve cryptography.
Cisco is becoming a security company - sort of like how Microsoft is becoming a security company.
They are still a "networking" company and networks are becoming security battlefields.
"a move which may prove problematic for traditional security vendors like Symantec."
Which means competition and is therefore good for the user.
Apart from that, another company concerned about security is no bad thing.
And some pretty good stuff, I might add. Popular with PHBs, too. Can we say "No one ever got fired for buying [Cisco]." yet?
This is going to be their major advantage when it comes to security, even down to the linksys brand for home users.
Good, proactive hardware provides real security. Bloaty, reactive software (Norton AV) goes down with the sinking ship (an exploding windows box).
Software, and security software has its purpose and can have value, but Cisco's advantage doesn't lie there.
~Rebecca
The market for security is much bigger anyway. There are dozens of network retailers, yet there are also dozens of security measures out there as well. From my experiance with Linksys equiptment (Part of Cisco, for those not in the know), security is a major strongpoint in their network hardware.
Anyway, as I'm trying to make out, the more competition in the security market, the more security has to evolve. This can only be a good thing, I feel.
And it took them how long to get SSH into the IOS? Give me a break. They are going to have to move at a lot faster pace if they want to be a security company.
Or security is a network battefield.
You don't 'sell' security : security for security is useless. Networking is something you sell and it needs security.
Sig (appended to the end of comments you post, 120 chars)
It will probably be Cisco's continued development of Network Admission Control(NAC) as it extends further down the network. NAC will interrogate a PC(via Cisco Trust Agent) that is plugged in to see if it running the latest MS patches, latest virus definitions, and Cisco Secure Agent policies. If not, it will prevent the workstation from going anywhere but to MS update, the AV vendor for updates, and the CSA policy server. Cisco is also pushing their IPSes into their devices. I wouldn't be surprised to see Cisco pushing IPSes to their switching line.
I live in Bangalore, you insensitive clod!
I think Apple will always have the strongest security. http://www.theappleblog.com/2005/01/26/best-from-a pple-security/
That's why they invented ACs.
"They are still a "networking" company and networks are becoming security battlefields."
More like networks are the second best place to handle security. The clients and servers is the first best.
do you really have to evolve into a security company in order to ensure that your products are secure... isn't it a fair expectation that when you buy an expensive router etc. that it won't have enormous flaws that allow for numerous exploits? regardless of who you buy it from?
Get your torrents...
Given the recent theft of the IOS source code, I certainly hope they get their shit together first.
bash: rtfm: command not found
You're funny and informative. I wish I could be you.
...when you ask them why you must use plaintext telnet to maintain routers you bought as recently as a year or two ago...they mumble around and then say "have you heard of our self defending networks?"
Then there are other little things, like the limited authentication options unless you spend bookoo bucks...or the very limited logging/audit functions...or the way PIX assumes all 'outgoing' connections are valid (the very concept of 'outgoing' is a SOHO concept and not an enterprise firewalling concept)...ugh...don't get me started on the pix....
The more you look at Cisco products hands-on, it just highlight what Cisco does: Make networking products.
Granted, they make networking products *very* well and I wouldn't hesitate to recommend them over anyone else. But myself and just about every security pro I know sees them as networking devices with security kind of bolted on...NOT security devices. It's more like some IOS networking programmers tried to figure out what security folks need instead of researching what's actually going on out there or getting some real world infosec experience.
If they are becoming a security company, great. But they've said this for awhile now and it hasn't changed the fact that the focus is networking networking networking.
Because there are only 2 OSes in the article and the other one is Win.
Sig (appended to the end of comments you post, 120 chars)
"The communications and computing sectors are coming together, and the key for us as a company is to leverage the expertise we have in those two sectors and develop vertical solutions." Hilarious.
Or security is an OS battlefield.
You don't 'sell' OSes : OSes for OSes are useless. OSes are something you sell and they need security.
The Yasashii Syndicate ||
Still ... the presumed anonymity of posting AC kinda depends upon Slashdot's logging policies. I have no idea what those are. But I bet that if autopr0n posted any really important "insider" info here on Slashdot, Cisco's lawyers would be beating down the door to Slashdot's server room tomorrow. Companies take a dim view of leaks.
The higher the technology, the sharper that two-edged sword.
Cisco is certainly a very experienced and knowledgeable company. The question is: would I trust someone who has built the greatest machine of censorship and oppression in the history of human kind to manage my "security"? Only an idiot would! Remember kids: some people may be experts in their field, but when they are so outrageously immoral you should never trust them. Never. Because one day those greedy bastards will gladly betray you as soon as they see even a slightest possibility of profit. Cisco is happy to collaborate with oppressive regimes helping to take away the last pieces of liberty from their citizens. Only a naïve child would think that they would not help the CIA and FBI to violate your privacy. Hiring Cisco as a security company would be an utterly foolish idea.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
OMGHI2U
I love how the ad that popped up above this article was a Cisco ad.
Two attacks on their own network resulting in stolen PIX and IOS code. Yeah...secure...if it weren't for the OpenBSD team Cisco would still be using telnet to remote admin routers....oh wait, they still do regardless, my bad. My $50 goes to an OpenBSD CD.
There is also the issue of whether any security, except your own, can be trusted. Will Cisco guarantee the absence of backdoors or 'approved' (not by the user) surveillance?
Then there is the issue of who makes the call on what 'security' is. There's a fair chance the average geek, sys admin, government and music trade rep will all have different ideas of what security is. Who's version gets implemented by Cisco and friends? Better that each one gets to do their own security.
I hate to sound like a sales guy for the company, but they have something called NAP that's just completely sick.
An agent (CSA) runs on all endpoints and checks them for AV, firewall, OS patches, etc. If it's clean, the switch or router let's them through to the main netowrk. If not, you get VLAN'd off to a remediation network, and once you are done there you are allowed on.
The trick here is that no one is in better position to do such a thing than the company that owns most of the network infrastructure.
Don't dismiss them as a security company; we've only seen the beginning.
dmiessler.com -- grep understanding knowledge
Software firewalls and security software are inherently pervertible - some even have programmatic interfaces to open ports!
The only good system security comes in part from sitting behind a hardware firewall router - something Cisco, with its subsidiary Linksys, is in a position to sell
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
thats why he can do it through an anonymous proxy i dont think slashdot logs IP of ac's
The Pink Syntax is a group of would-be jazz fanatics who commend on Slashdot stories in typical 1940s jazz-cat slang and insert random notes on worsgipping Charles Mingus and "Django Reinhardt Hot Grits". Unca Faubus is their leader.
Well I'd rather Cisco buy their way into the market than, say, Microsoft. Bought in or no, if Cisco wants to get somewhere meaningful, they're going to have to do it entirely based on quality products. If Symantec has to improve their own products to keep up, or Cisco's mainline products are indirectly improved in the process, well, so much the better.
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
Cisco in Singaporehttp://www.cisco.com.sg/ is already a security company. They provide private policemen , armoured transport and have control over much of Singapores electronic infrastructure. They do have their fingers in more than just producing routers.
...I obey the laws of physics....
Not imho. Last year, they released six new servers and five new software titles, none of them related to security. The big profits are all about routers and other hardware. Cisco owns Debliro, a security company which deals with things like virus protection, industry-strength firewalls, complete medium/large scale company security business system arrangement solutions for infrastructure management overviews. Not much R&D goes into Debliro, but it's a trademark they could use, which is widely known among large scale system administrators and the like.
And I suspect you organization is the same. Internal networks are victims of strange political forces, ridiculous budgets and a crippling blindness that expensive boxes that protect us from the evil commie internets is all we need.
I personally would love to see routers that you could install 'modules' onto to control things ranging from spam, to virueses, to spy/malware. I know this can be done with custom machines with router software, however you don't get the reliability that IS cisco.
ItWasFree.com - Take the mystery
This is really really old news.
ECC is the emerging standard for public-key cryptography. Within a few years, I can see it taking significant market share from traditional RSA-based systems. The mathematics behind ECC is much more complicated, but it improves on most of RSA's weaknesses. The only major drawback that I know of is that ECC is encumbered by a variety of patents.
While I'm not defending the issues listed on that page, Microsoft are directly responsible for the flaws in their software, as they wrote it, where as the products described on the Attrition site came to Cisco via acquisition (the ONS products came from Pirelli (I think the same company that make tires and very "interesting" calendars)), in times when security probably wasn't one of the checkpoints on the due diligence list.
The only "true" Cisco products are routers, IOS, and more recently the IOS that is on the CRS-1. The security record for IOS has been pretty resonable, when you consider that it has and will always be "exposed" to the Internet.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
Their PIX firewall is no competition to the other popular vendors. It lacks both the performance and features of Netscreen/Junpier and has a shoddy security record.
Their IDS is less sensitive than Snort and its VMS manager software is slow, hideously bloated and buggy.
For several years, Cisco have been promoting an insecure combination of IPSEC shared-secret with xauth. Despite being documented as dangerous on their own website, it was still the taught and recommended way of configuring "convenient" secure remote access VPNs. Only in the last six months have they fixed this.
Their NAC/self-deluding-network initiative is broken as proposed. All enforcement is performed in the wrong place: routers off in the edge of the network. Right now, there is no way to deploy NAC on a switch or even a MSFC.
Cisco need to stop their marketing droids from directing their product development and get back to competing on technology.
I would have though that Sun would have filled this vacuum a couple of years ago. With all their "network is the computer" marketing, and the huge demand for security on the networks that Sun pioneered, Sun had an even better position to fill this niche than does Cisco. But no real move by Sun on security for everyone since Java's sandbox. I think the Sun really is setting if it lets opportunities like this fall to companies like Cisco instead.
--
make install -not war
I'd be pretty sure that the only reason they built the "Great Firewall of China" is because they could sell a lot of kit to do it, as well as establish a relationship and presence in China to sell a lot more kit in the future. If they didn't, probably one of their competitors would have.
Who demands Cisco continue to be a profitable company ? Who demands Cisco continue to provide ever increasing share value, on a trajectory similar to the past ? Who demands that Cisco never accept letting their competitor win a deal ? I'd suggest it is primarily the hard-nosed capitalists in the US, as they have the largest shareholdings in the company.
Arguably, China is becoming more and more a Communist country in name only - it is having to adopt capitalist systems to survive on the world stage. In the short term, there will be conflicts between communist beliefs (and the government who administer them) and capitalist systems they need to survive. The controlling of the Internet via the "Great Firewall of China" is an example.
I think China is on the "slippery slope" towards eventually becoming a Capitalist country. The Chinese government are letting companies become profit and growth/aquisition oriented, the next logical step is to let the citizens themselves adopt the same views. Isn't that what capitalism is fundamentally ?
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
The only security related product Cisco has been remotely successful with is Cisco Security Agent aka CSA aka Okena. A technology that will be obsolete with technologies being integrated into Windows.
They have to give away their PIX firewalls to have any sort of market share at all, their network IDS is is piss poor and their network IPS (present and future) falls below ISS Proventia Gseries (which puts it nearly at the bottom of the list.
I don't care who they aquire, any security professional worth their salt knows Cisco doesn't do software well.
Cisco has a terrible security track record, using them for security is absolutely retarded. And although its not firing, I have consistantly refused to hire people who think of cisco as the default solution to network problems for the last 3 years. You can get better hardware much cheaper, and install open source OSs like linux and openbsd and get a way better solution than cisco for a fraction of the price. The only think cisco is in competition is switches and high end routers. And there are superior products from other vendors in both those areas.
They sure do.
shouldn't trust the hosts.
In "Routing in the Internet", Christian Huitma, when describing the Internet architecture, describes why hosts shouldn't trust the network to perform reliable delivery. Hosts have more of an interest in reliable communication than the network as ultimately they will suffer the most if the network isn't as reliable as it says it is; therefore hosts should take the primary interest in ensuring the network delivers data reliably. That leads to absolute reliablity mechanisms in the network being redundant, as the hosts will implement them anyway. This is why TCP is an end-to-end protocol, why the IP header checksum only covers the IP header, and why the network layer in the Internet is only "best-effort".
In a later chapter, regarding QoS, he makes the point that the network shouldn't trust the hosts. The network should provide generally equal service to all its "customers" - the hosts that are attached to the edge of the network. Therefore, if one host is misbehaving, the network should penalise it. That is what the default queuing algorithm (Random Early Dectection) for the Internet does. Some details are in Recommendations on Queue Management and Congestion Avoidance in the Internet.
The same model applies to security. Security should be end-to-end when the host has the most interest in the consequences of lack of security. Hosts shouldn't trust the network to deliver data securely, as the consequences of secure delivery are most felt by the hosts (and therefore the users sitting behind them).
The network's security needs aren't quite the same as the hosts; the main thing the network has to secure is availability and the ability to continue to provide equal service to all its customers (the hosts.) Authentication in routing protocols, secure administration tools such as SNMPv3 and SSH, and traffic rate limiting mechanisms like RED are network security mechanisms that protect the network's service.
Security problems come about when attempts are made to implement host security in the network, and network security in the hosts. For example, a firewall's purpose is really to protect the hosts. The current location for most firewalls is inside the network. Unfortunately that doesn't fully extend the host protection a firewall provides up to the host itself. With the current model, it is easy enough to "unprotect" the host by inserting a device, for example a wireless access point, between the firewall and the host. The firewall may still protect the host from Internet based attackers, however it doesn't protect the host from war drivers. Ideally, a firewall should reside on the host itself, to protect the host from attacks from all (network) directions. Interestingly, that is happening already through evolution - most host OSes are coming with firewalls out of the box. Administration of firewall security policy is a problem with this model, due to the increased number of firewalls to now administer, however, mechanisms are being developed to apply distributed security policy. Distributed Firewalls by Steven M. Bellovin describes this model further.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
Or love is a battlefield.
Ever since Cisco bought the Wheel group all those years back, they've attempted to make a real entry into the security market.
Although they have great market share in the blue-chip corporate sector these days, they are still lacking two major components from the suite of products have also been lacking: A decent workable management platform (anyone that has built or used VMS knows where this is coming from), and an event correlation engine (the Protego aquisition addresses this).
Cisco has made so many aqusitions over the years, but has had little success with re-branding them and taking them to market. Check out the host based IDS as an example of this (for those who cannot be bothered, Cisco introduced an OEM'ed HIDS then dumped it very quickly after aquiring yet another vendor in the HIDS space...)
Whilst NAC and the latest product offerings all sound great and definately are the way of the future converged network, I'll believe it when I see it deployed in a real network - not in the lab in the Cisco building.
could cisco be evolving into a more services-oriented company because in a few years 95% of networking hardware will be a commodity item - except for the truly truly large mega-buck routers?
I could easily see Dell or Huawei encroaching on their market very very soon. Dell is an amazing assembly plant that happens to sell computers (and tvs, laptops, pdas, soon - printers)
Huawei has the benefit of super low cost labor to eat into any competitor's margins.
Cisco is caught between a rock and a hard place, they do R&D in networking components, but after a certain point, everything in techland becomes a commodity or margin locked.
Good Luck Cisco - I sense you will have to reinvent yourself like Sun, Apple, and HP - very very hard things for large companies to do.
What happens if the CSA is compromised ? The network shouldn't trust the host, or any software running it it, to make network protection decisions that the network will blindly follow. This model implies that Cisco believe they can write perfectly secure and perfectly trustworthy software that operates on a perfectly insecure and perfectly untrustworthy OS such as Windows. I'd doubt they actually believe that.
I explain some more about the network security model I believe should be followed in this previous post - Hosts shouldn't trust the network; Network ...
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
I wrote
Hosts shouldn't trust the network to deliver data securely, as the consequences of secure delivery are most felt by the hosts (and therefore the users sitting behind them).
which really should be
Hosts shouldn't trust the network to deliver data securely, as the consequences of insecure delivery are most felt by the hosts (and therefore the users sitting behind them).
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
Wire Cutters
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
Most local libraries provide public internet access. Combined with AC posting, it would be impossible to identify him. Unless, of course, his information could be tracked to him by the others that knew the same info.
If CiscoIDS is any indication of the quality of their security mindset...I wouldn't expect them to master it anytime soon.
Juniper's made some great strides, but as much as I like their products, what I've seen of Fortinet products is much more impressive. Having all your enterprise netowrk and infrastructure devices in one product is reaaaaaaaaaaalllly fucking handy. No more explaining "ok, the up-link is coming from our IDS, then comes our firewall, then comes our VPN device, then comes the spam filtering boxes."
Fortinet was founded by one of the guys who started Netscreen (which is now Juniper) and some of their ideas are really worth checking out (like re-ordering packets to search them as one complete packet -- no "deep-inspection" BS like Netscreen or TippingPoint IDS'. From what I understand from speaking to company reps, this was one of the things that made the founder go from netscreen to creating his own company.
Purpose-specific products (e.g. sealed boxes with ASICs that do one thing reallllly well,) are the future of enterprise-level security, imo. Linux (or solaris or what-have-you,) doing firewalling or routing or anti-spam or whatver may be adequate for small offices, but is not an ideal solution for large companies (10000+ users.)
They really do have their fingers in more than just producing routers!
This is a backhoe !
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
Cisco has always been a security company. My favorite quote from the article:
"Cisco isn't known as a security company,"
Really? IOS doesn't have any security features built in? What exactly are my PIX firewalls doing for me?
Security isn't something you can buy from a vendor and just roll out over a weekend. Security must be present at every layer of your network. Routers, firewalls, switches, servers, desktops, operating systems, applications, user accounts, and even peripherals must be scrutinzed for security these days. Cisco realizes this, and is taking steps to secure "their" part - the network part.
Now if we could just get some software guys in Redmond to check their input buffers...
-ted
http://shit.slashdot.org/article.pl?sid=05/02/13/2 023202
General design philosophy is that "core" anything shouldn't have ACLs, as they inhibit performance.
ACLs on a core device is usually a sign that a non-optimal design is being used. Push the ACLs to towards the edge if you can, so traffic is dropped as early as possible. It also distributes the ACL processing load across many more devices, by distributing subsets of the network ACL set to those devices, rather than concentrating the network ACL set on a more central device.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
"The new CELL processor is documented as having a DRM enforcment system embedded in the CPU itself. There's no details available on this "DRM enforcement system", but it is doubtless Trusted Computing."
I guess IBM will be crippling linux rather than protecting Sony's profits on the PS3? Hmm, no. Take off your tinfoil hat and realize that anything designed to take away our freedoms is at least slightly more insidious than giving Microsoft and Apple and Sun monopolies on the OS market.
> Bloaty, reactive software (Norton AV) goes down with the sinking ship (an exploding windows box).
4 1eb76f2c0adc72440aafe3477bac43
d -misc&m=108248948202715&w=2
m isc&m=108264490523927&w=2
- misc&m=108431540506674&w=2
You don't mean the TCP Reset Vulnerability in Cisco's BGP do you? You know, the one Cisco tried to blow it out of proportion by including the internet, while in reality it was their own implementation that didn't take security seriously. But that's not all, Cisco then tried to patent the fix for largely their own vulnerability.
"Feature: Understanding TCP Reset Attacks, Part I"
http://kerneltrap.org/node/
3072?PHPSESSID=9
"You are being told "lots of people have a problem". By not seperating out the various problems combined in their notice, or the impact of those problems, you are not being told the whole truth."
http://marc.theaimsgroup.com/
?l=openbs
"cisco is affected and tries to make it look like it was a problem everybody has, which it isn't, and it looks like they managed to fool you."
http://marc.theaimsgroup.com/
?l=openbsd-
Cisco applied for a patent to the TCP Reset vulnerability Fix. Patenting a freaking FIX...
http://marc.theaimsgroup.com/
?l=openbsd
I do agree : security is not a final purpose. But it is needed in many products and sometimes to be efficient, must span accross many of them.
But security is not a target, communication/work/processing is.
Sig (appended to the end of comments you post, 120 chars)
This might be that actual strategy but I guarantee that this will flop big time.
A) A large percentage (growing all the time) of people connect to the Internet via their own little NAT boxes. Killing everyone's NAT boxes will not fly well.
B) What about all the non-Windows boxes hooked to the network? And I'm not talking about Macs, I'm talking about all the little doo-hickeys that get hooked to the net like my printer, people's TIVO's, etc.
These kind of big bang schemes are often dreamed up by marketing types and control freaks but the reality is that they're damned hard to roll out. I doubt this will go anywhere really. Samsung just got suckered is all. If Dell said they were doing it it might be something to take seriously.
> What exactly are my PIX firewalls doing for me?
c tion=displaynews&NewsID=2546
Well, I don't know and it's difficult to say, but it certainly does something for the people who have the source. Maybe they'll take your computers and networks for a spin.
http://www.techworld.com/news/
index.cfm?fusea
I guess IBM will be crippling linux
I'm don't think it's completed yet, but there will be a Trusted Linux available soon. It will almost definitely be available before Longhorn is out.
Oh, and in case it wasn't clear, Trusted Computing processors will run existing Linux and all existing software just fine. Hoever normal Linux and software will not be able to read Trusted files. Also you will increasingly run into software and servers that will refuse to talk to normal Linux or unTrusted applications. In a few years you may not be able to get an internet connection except with Longhorn or a Trusted Mac or with Trusted Linux.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Despite what Certicom would have you believe, it's perfectly possible to use ECC and point compression without trespassing their patents. There are some optimizations and nice tricks that are patented, but they are not essential.
Xenu loves you!
You will still be able to run Linux on a TC platform. It's just that you'll no longer be able to fool other (local and remote) software into thinking you're running Windows.
TC is evil, but it's more subtle than a hardware lock that prevents you from running Linux on the plaform.
Xenu loves you!
Hum, it seems they are already publishing info ...
For example, this Cisco Clean Access is the re-badged and cisco-integrated Perfigo CleanMachines.
#include "coucou.h"
They most definitely do. :P
Which is why I can't post as an AC from home any more. . .
Cisco as security company? Sure, whynot?
These are the same guys who'll shout high and low that the internet could be brought down by a particular vulnerability and then refuse to supply the fix (not an IOS upgrade, mind you, just a patch) to anyone running their gear but without a current maintenance contract. Sorry, if your gear powers a sizable fraction of the internet and you have already made your money off of selling it, it is your responsibility to the community to provide patches for this kind of exploit gratis if in fact it is as dire as you say it is. Security comapny? Bah. Profitteer!
Can I bum a sig? I left mine at the office.
Am I the only one here who thinks this usage of the word "sick" is the most unoriginal, contrived linguistic devices since the 1980's?
...because "hacker" sounds way sexier than "code drone."