Re:Zero-days in Cisco Discovery Protocol
by duxup on Thursday February 06, 2020 @02:57PM
(#22259678)
I worked for a large networking equipment manufacturer. A company that should know better / how to handle things.
The team that fielded inquiries from security researchers and etc were STILL fighting fights with engineering executives whose first response when they saw something that showed a problem in their code from a researcher ... was to go running to the lawyers and talk about lawsuits.
In the meantime some engineers recognize the increased need for better security practices but there were NO new resources allocated to actually make time to do such things. Everything was lip service (if there even was any) but no time, and then later reactive to issues.
In terms of what I saw in a practical manner. There was a shockingly high rate of "we saw this security bug before" re-introduced right after it was fixed. You could almost bank on it happening. In the meantime you'd watch security related bug fixes pushed from one version to the next to the next ...
The team that fielded inquiries from security researchers and etc were STILL fighting fights with engineering executives whose first response when they saw something that showed a problem in their code from a researcher ... was to go running to the lawyers and talk about lawsuits.
In the meantime some engineers recognize the increased need for better security practices but there were NO new resources allocated to actually make time to do such things. Everything was lip service (if there even was any) but no time, and then later reactive to issues.
In terms of what I saw in a practical manner. There was a shockingly high rate of "we saw this security bug before" re-introduced right after it was fixed. You could almost bank on it happening. In the meantime you'd watch security related bug fixes pushed from one version to the next to the next ...