The U.S. Cybersecurity & Infrastructure Security Agency (CISA) released guidelines for network engineers, defenders, and organizations with enterprise-grade networking equipment as part of its continuing investigation into the People’s Republic of China’s (PRC’s) massive cyber espionage campaign. While the agency has released general guidelines for increased visibility and hardening that apply to any network, it also had a section labeled ‘Cisco-Specific Guidance.’
According to the document, “authoring agencies have observed Cisco-specific features often being targeted by, and associated with, these PRC cyber threat actors’ activity.” Aside from the recommendations mentioned, CISA also linked to Cisco’s IOS XE Hardening Guide and Guide to Securing NX-OS Software Devices. This shows that the networking company is likely aware of its vulnerabilities and is taking steps to help protect its customers from those who need it without removing features that make it easier for others who don’t need more stringent security to use its products.
