Cisco PSIRT

Cisco PSIRT
Name	Cisco Product Security Incident Response Team
Type	Security response team
Founded	2004
Headquarters	San Jose, California
Parent organization	Cisco Systems, Inc.
Website	Cisco Security Advisories

Cisco PSIRT Cisco Product Security Incident Response Team provides vulnerability handling and security coordination for products developed by Cisco Systems, Inc., working alongside technology firms, standards bodies, and national agencies to address threats affecting networking, collaboration, and cloud platforms. The team engages with vendors, researchers, and regulators to publish advisories, mitigate compromises, and manage coordinated disclosure for software and hardware affecting customers, partners, and critical infrastructure stakeholders. Cisco PSIRT's work touches major ecosystems and incident frameworks, influencing practices across commercial, open-source, and governmental sectors.

Overview

Cisco PSIRT operates within Cisco Systems, Inc. and liaises with organizations such as Microsoft Corporation, Google LLC, Amazon Web Services, IBM, and Intel Corporation to investigate vulnerabilities and produce mitigations. The team interacts with standards and consortiums including Internet Engineering Task Force, World Wide Web Consortium, Institute of Electrical and Electronics Engineers, Payment Card Industry Security Standards Council, and Open Web Application Security Project to align advisories with protocol expectations. Cisco PSIRT’s remit spans products used by major enterprises like Bank of America, Walmart, AT&T, and public-sector entities represented by Department of Defense (United States), National Security Agency, and European Union Agency for Cybersecurity.

Responsibilities and Scope

Cisco PSIRT is responsible for triage, root-cause analysis, patch development, and disclosure coordination for vulnerabilities in routing, switching, wireless, security appliances, collaboration suites, and cloud services deployed by organizations such as Verizon Communications, Deutsche Telekom, Vodafone Group, and T-Mobile US. Its scope includes handling reports from independent researchers associated with institutions like University of California, Berkeley, Massachusetts Institute of Technology, Stanford University, and corporate research labs at Facebook, Inc. and Nokia. The team adheres to policy frameworks and legal considerations influenced by statutes and directives including the Cybersecurity Information Sharing Act of 2015, NIS Directive, and guidance from National Institute of Standards and Technology.

Vulnerability Disclosure Process

Cisco PSIRT follows a coordinated disclosure model, engaging with bug-finders, vendors, and affected parties such as Red Hat, Canonical Ltd., SUSE, Juniper Networks, and Arista Networks to develop fixes prior to public advisories. The process often invokes collaboration with CERT organizations like US-CERT, CERT-UK, CERT-EU, and researchers from Google Project Zero and Microsoft Security Response Center. For severe flaws, PSIRT may leverage timeline practices informed by historical incidents involving Heartbleed, Shellshock, and WannaCry to determine embargo periods and mitigation disclosure that balance disclosure pressure from entities like Electronic Frontier Foundation and Institute for Security and Technology.

Coordination with Industry and Government

Cisco PSIRT coordinates with national authorities and industry consortia, including Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, Europol, NATO Communications and Information Agency, and private sector partners such as Cisco Partners and global carriers. The team participates in information-sharing forums like Information Sharing and Analysis Centers, FIRST (Forum of Incident Response and Security Teams), Open Source Security Foundation, and Cloud Security Alliance to disseminate indicators and remediation steps. In cross-border events, PSIRT interacts with regulators such as Federal Communications Commission, European Commission, and ministries referenced in advisories from Japan Computer Emergency Response Team Coordination Center.

Security Advisories and Publications

PSIRT publishes advisories, guidance, and workarounds for products used by customers including Verizon, Comcast, Siemens, and Schneider Electric. Advisories reference standards and technologies from Border Gateway Protocol, Simple Network Management Protocol, Transport Layer Security, and frameworks like MITRE ATT&CK and Common Vulnerabilities and Exposures. Publications often cite CVE identifiers tracked by MITRE Corporation and CVSS vectors used by FIRST (Forum of Incident Response and Security Teams). The team’s disclosures are consumed by vendors such as Palo Alto Networks, Fortinet, Checkpoint Software Technologies, and integrators like Accenture.

Incident Response and Mitigation Practices

In incidents, PSIRT coordinates patch engineering, hotfix distribution, and mitigation tactics with engineering teams across divisions similar to large-scale responses by Cisco Meraki, Cisco Secure Firewall, and collaboration with cloud providers including Microsoft Azure, Google Cloud Platform, and Amazon Web Services. The team uses digital forensics and threat intelligence sources like Mandiant and Recorded Future to attribute activity and recommend network-level mitigations involving technologies from OpenSSL, BIND, and Quagga. Remediation guidance is tailored for operational environments run by enterprises such as Goldman Sachs and telecom operators like Orange S.A..

Criticism and Controversies

Cisco PSIRT has faced scrutiny in contexts similar to debates involving Hewlett-Packard Enterprise and Oracle Corporation over patch cadence, disclosure timing, and support lifecycle for legacy platforms used by entities like United States Postal Service and Department of Homeland Security (United States). Critics from advocacy groups such as Electronic Frontier Foundation and industry commentators in outlets referencing The New York Times, Wired, and The Wall Street Journal have challenged vendor practices on coordinated disclosure deadlines and vulnerability attribution. Debates also reflect tensions seen in incidents involving Juniper Networks and SolarWinds about supply-chain security and the scope of vendor responsibility.

Category:Cisco Systems Category:Computer security organizations