Hello Folks - Clay Kossmeyer here from the Cisco PSIRT.
I can see there's a lot of interest around the changes in our vulnerability disclosure policy, and I'd like to direct you to the following section of the announcement that can be found here on Cisco's website: http://www.cisco.com/en/US/products/products_security_advisories_listing.html "This schedule change will not restrict us from promptly publishing an individual IOS Security Advisory for a serious vulnerability which is publicly disclosed or for which we are aware of active exploitation." For vulnerabilities that are publicly known, or for which we see active exploitation, we will publish Security Advisories immediately. This has always been Cisco's policy, and remains so. In the history of PSIRT Security Advisories, the majority of security vulnerabilities we report on are either found through internal testing or from a very small number of customer reports that are confirmed to be non-malicious. This schedule change for IOS security advisories is designed to help customers avoid multiple 'fire-drill' software upgrades per year for issues that do not pose an immediate security threat. One other point that bears mention is that although our announcement of these vulnerabilities has moved to a six month schedule, the availability of fixes has not. As we discover and fix these bugs, they are included in releases posted to cisco.com well before the Advisory announcement date. The actual public disclosure of vulnerabilities is the end of the cycle so that customers who have recently upgraded may have already deployed fixed software. As always, we're happy to receive input on our policies. Regards, Clay On Mar 11, 2008, at 9:41 AM, Robert Boyle wrote:
At 08:43 AM 3/11/2008, you wrote:http://www.techworld.com/security/news/index.cfm?RSS&NewsID=11665 "Following the lead of Microsoft and Oracle, Cisco Systems willstart releasing security patches for some of its products on a schedule.... The first of these scheduled updates will occur on Wednesday, 26 March, and Cisco will continue to release patches on a twice-yearly schedule after that, Cisco said in a note posted Wednesday on its website. These firmware updates will ship on the fourth Wednesday of September and March each year."So we need to wait 6 months for security patches if an exploit which may affect us is discovered on the fourth Thursday of September? That's crazy! Let Enterprise customers wait if they want, I want my security patches ASAP so we can test them for a few days then deploy network wide. Does anyone else think this is not a rational change? -Robert Tellurian Networks - Global Hosting Solutions Since 1995 http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Well done is better than well said." - Benjamin Franklin _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
PGP.sig
Description: This is a digitally signed message part
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
