Benefits 600 500 400 Industry Standards: Follows standard rules, policies, and scoring systems 300--- 200- 100 --- Cisco CVE Assignments 2016 2017 2018 2019 2020 Consistency: Applies the same mature process across the Cisco portfolio, even as the product line grows Best-In-Class Service: Provides dedicated support for product security and network protection Speed: Quickly assigns CVEs for security vulnerabilities Collaboration: Works with product teams across Cisco and third parties Transparency: Publicly discloses both internally and externally reported vulnerabilities Assigning Common Vulnerabilities and Exposure (CVE) identifiers to internally and externally found vulnerabilities across hundreds of products reflects Cisco's commitment to transparency and helping customers mitigate risk. Policy PSIRT investigates all reports, regardless of the Cisco software code version, through the last day of support for a given product. Issues will be prioritized based on the potential severity of the vulnerability and other environmental factors. Ultimately, the resolution of a reported incident may require upgrades to products that are under active support from Cisco. Review the Cisco Security Vulnerability Policy to learn about: + How to report or obtain support for a suspected security vulnerability + Details on the incident response process + Communications and disclosure plans Receiving Security Vulnerability Information from Cisco There are several ways to stay connected and receive the latest security vulnerability information from Cisco. Cisco Security: cisco.com/security Contact PSIRT: psirt@cisco.com RSS feeds: http://tools.cisco.com/security/center/rss.x?i=44 My Notifications: https://www.cisco.com/c/en/us/support/web/tools/cns/notifications.html Cisco PSIRT openVuln API: https://developer.cisco.com/site/PSIRT/ 2021 Cleco and/or Allright 4|14|11 CISCO CISCO Cisco Product Security Incident Response Team Protection. Security. Transparency. The Cisco Product Security Incident Response Team (PSIRT) is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. Over 20 years of experience helping to alert customers about vulnerabilities in Cisco products Incident Handling Process PSIRT is notified of a security incident The single entity authorized within Cisco to disclose vulnerability information to customers PSIRT prioritizes and identifies resources Global team of incident managers providing 24/7 support PSIRT coordinates product impact assessment and fixes ISO 29147 compliant 10001 10110 011001 + Cisco proprietary code Customers and the public are notified simultaneously До 6 Third-party software components COMPLETE PROTECTION: PSIRT investigates vulnerabilities across the entire Cisco product portfolio.