Network Resilience

A: Cisco Talos, government agencies and other threat intelligence organizations have reported on an increasing volume of attacks against routers and firewalls globally. The actors behind these attacks are typically state-sponsored and very sophisticated. Network operators must be both diligent in maintaining their equipment and software and vigilant in monitoring for unusual activity.

A: This is not a threat that specifically affects any one vendor, product, or version. State-sponsored actors have demonstrated a preference for attacking and utilizing a broad spectrum of network equipment from consumer-grade to service-provider hardware. Actors target network devices because those devices are well positioned to steal information, are infrequently updated, and are often poorly monitored. Regardless of who your vendor is or what product you have selected, following best practices for securing your environment and aggressive monitoring are necessary. See also this Guide to Forensic Investigation Procedures for First Responder.

A: Visit our End of Sale and End of Life Products page.

A: See our vulnerabilities disclosures and access the updated software, here.  You can also check your Cisco Software for security vulnerabilities here.

A: Customers should replace hardware that is end-of-life. Once a product reaches end-of-life status, it will not be sold, improved, maintained, or supported. More information can be found in our End-of-Life Policy.

A: Equipment that is end of life cannot be supported by Cisco, and as today’s news illustrates, is subject to active attack by sophisticated adversaries. Customers should replace hardware that is end-of-life. Customers should also avoid using non-encrypted SNMP monitoring, and should not use SNMP community strings that are easy to guess and update their software. For additional details, see here.

A: One of the reasons to keep up-to-date on hardware is that we are always adding new security capabilities beyond just patching known vulnerabilities. We are constantly working to harden our products, accelerate our responses and issue the best guidance we can to help our customers. Customers can find out more about Cisco’s trustworthy solutions here and view security advisories here.

A: It is important to understand that this is not a new vulnerability, but the latest in a series of attacks against out-of-date and unpatched equipment and often not following security configuration best practices. The patch for the vulnerability used in Jaguar Tooth has been available since June of 2017. On January 11, 2018, Cisco updated the advisory, as the Cisco Product Security Incident Response Team (PSIRT) became aware of exploitation of the vulnerabilities described in the security advisory.