CCN-CERT document on Webex
TheCCN-CERT is the Information Security Incident Response Capability of the National Cryptologic Center, CCN, attached to the National Intelligence Center, CNI.
Its mission is to contribute to the improvement of Spanish cybersecurity.
CCN publishes about webex: Use of Cisco Webex, its implications for security and privacy. Recommendations and best practices.
In point 2 of the following document, the CCN-CERT highlights the security commitment of CISCO WEBEX:
National Cryptologic Center: Use of Cisco Webex, its implications for security and privacy. Recommendations and best practices.
CISCO WEBEX SECURITY COMMITMENT
Cisco designs products in accordance with Cisco’s Secure Development Lifecycle (SDL) which includes periodic privacy impact assessments, proactive penetration testing and threat modeling.
Cisco’s Security and Trust organization monitors Webex security and privacy and publicly discloses security vulnerabilities.
There are three (3) Cisco Webex security principles:
- Webex is committed to respecting the privacy of your data.
- CISCO Webex is secure by default.
- Webex has cyber security governance and is transparent when there are security issues.
In the context of the state of alarm decreed by the nation’s government due to the Covid-19 pandemic, it has provoked a series of changes in work routines. This situation has generated an explosion in the widespread use of videoconferencing systems and chat applications such as Zoom, Cisco Webex, Google Meet, Microsoft Teams and consumer applications such as Houseparty, Jitsi, etc.
Cyber attackers are taking advantage of the opportunities associated with pandemic fear, widespread teleworking, difficulties in patching remotely connected endpoints, and the increased exposure surface resulting from enabling more fluid operations.
In this context, poorly secured videoconferencing sessions and applications are a great attack vector.
Conclusions of the document:
Cisco offers an end-to-end ecosystem of secure solutions, where Cisco Webex is the collaboration platform part that enables meetings, events, training courses, remote support, group messaging, with audio, video and sharing services, interoperable with all room video platforms based on H323 and SIP standards.
