Re: Security risks of obsolete hardware/software

[Pete Helgren <pete@xxxxxxxxxx>]

The fact that it is obsolete shouldn't render it vulnerable.  A quick 
search on vulnerabilities on the device show nothing of import 
recently.  If it was current on patches when it became obsolete, then it 
should be OK.  If you hang on to it, then a quick search every couple of 
weeks should keep you covered.  Also, subscribing to a list of known 
vulnerabilities would be a good idea.  The SANS institute has several.  
Searching the metasploit site would also uncover an exploit should one 
surface for the device.

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 3/18/2013 6:59 AM, rob@xxxxxxxxx wrote:
> We get regular reports of our internal, and our external, network from
> Qualys.  Also some benevolent hacking is done.  Areas of concern are
> ranked in layers of severity with 5 being the area of highest concern and
> 1 being the area of lowest concern.  The one issue we have at a level 5 is
> only because the software is obsolete and is no longer issued updates.
>
> <snip>
> THREAT:
>      The Cisco VPN 3000 Series provides remote access deployments for IP
> Security (IPsec) and Secure Sockets Layer (SSL) VPN connectivity.
>
>      Technical support ended on 31st August 2012. Support services for the
> product are unavailable, and the product is obsolete.
>
> IMPACT:
>      The system is at high risk of being exposed to security
> vulnerabilities. Since the vendor no longer provides updates, obsolete
> software is more vulnerable to attacks.
> SOLUTION:
>      Cisco recommends migrating to the Cisco ASA 5500 Series SSL/IPsec VPN
> Edition. Information about this product can be found at Cisco ASA.
> COMPLIANCE:
>      Not Applicable
> EXPLOITABILITY:
>      There is no exploitability information for this vulnerability.
> ASSOCIATED MALWARE:
>      There is no malware information for this vulnerability.
> RESULTS:
>      OS obtained: Cisco VPN 3000 Concentrator
> </snip>
>
> This has been on the report for awhile so apparently my boss doesn't think
> it's really all that great a priority.  Or perhaps it's asking for budget
> money the same quarter that manufacturing tries to load up is unlucky.
>
> Would you or your boss?
> Would you or your boss have a concern if that was about some level of IBM
> i that you were running that is now obsolete (or will be in a few months)?
>
> Rob Berendt