The Angel And Devil On Cisco's Shoulders

Cisco Systems apparently has an angel on one shoulder and a devil on the other when it comes to wireless security. The angel issued a security advisory this week about a hole in Cisco's Wireless LAN Solution Engine and offered patches to fix the problem.

The devil, however, has done nothing in the last year about an often-discussed problem with Cisco's LEAP authentication system. As a result, one frustrated networker released a tool this week that attacks the weakness, apparently hoping to prod Cisco into action.

I don't necessarily blame Cisco for the security problems. After all, absolute security is an oxymoron and all we can hope for is that vendors commit to do their best to prevent them and to fix them rapidly when they come to light.

But the LEAP issue has been discussed for a year or more. I spoke with the CIO of a large systems integrator and he said his company has long known about the problem and has deployed other security solutions. Since LEAP is proprietary, though, Cisco had a lot invested in it and, perhaps because of that, it didn't take adequate action to fix the problem. It still hasn't, other than to issue a tepid warning.I don't for a second believe that these problems will put a dent in Cisco's dominance of the enterprise WLAN market. It's long been said that IT folks can't get into trouble by buying Cisco equipment. But if Cisco doesn't start acting more forthrightly when problems occur, and if its competition in the enterprise continues to mount, that truism may well change.