The US Federal government, from military to civilian agencies, has long relied on Aruba for secure wireless and wired networking. That’s because Aruba products are secure by design, with a secure architecture and advanced security embedded into the infrastructure. Our solutions are certified to be secure, and we continue to innovate as global threats evolve.
The reality is that security bugs and vulnerabilities are common across the tech industry, and the criticality of finding and fixing bugs grows as mission operations become increasingly digital. How quickly a vendor can fix a problem and a customer can apply the patch is the key to making everyone safer.
Over the past two months, the US Cybersecurity and Infrastructure Agency issued multiple emergency directives for major vulnerabilities (not ours, thankfully). The urgency of these directives underscored the importance of our industry continuing to mature cybersecurity practices.
Aruba Threat Labs, our security incident response team (SIRT), plays a vital role in ensuring that Aruba’s products are designed to be secure—and that any vulnerabilities are resolved swiftly and completely. Aruba Threat Labs is focused on finding and eliminating security vulnerabilities in our products, with the ultimate goal of preventing vulnerabilities in the first place.
An Inside Look Aruba Threat Labs
Aruba Threat Labs is first and foremost responsible for managing and mitigating security vulnerabilities in our products. Vulnerabilities may be reported by independent security researchers, customers or even Aruba employees. We also run a public bug bounty program, which has been very effective in helping to discover vulnerabilities faster.
When a vulnerability is reported, a rapid response team triages the vulnerability. If the bug is validated, our rapid response team works to resolve the issue with our product teams. The rapid response team also maintains communication with the individual who reported the bug. We know that there’s nothing more frustrating that reporting a bug and never hearing back from the vendor.
Aruba Threat Labs operates as more than a just SIRT. The team approaches cybersecurity from a hacker perspective, because that’s the reality of the world we operate in. We dig deep into threat research to stay current on bad actors’ latest techniques and tactics. We act as adversaries and run red team exercises to hack our own products to ultimately make them more secure.
Combining the talents of experienced threat researchers and incident responders helps ensure that our products continue to be designed to operate as securely as possible. A multidisciplinary team empowers us to resolve issues faster and ultimately supports our product development team’s mission to design and build secure products.
When an Advisory is Issued
When a vulnerability is identified, Aruba doesn’t do selective disclosure. Our policy is to notify all customers of vulnerabilities at the same time. No Aruba customer, partner or third-party is given advanced notification or additional details about a vulnerability. It can be a delicate dance sometimes, but we have long followed industry norms for vulnerability disclosure, including ISO 29147.
Check out our vulnerability disclosure policy.
When a vulnerability is disclosed, we issue an advisory that strives to be clear enough to explain the issue without giving away details so that a malicious actor could reverse engineer the vulnerability and attack customers that haven’t patched.
IT leaders should review the advisory and identify whether the vulnerability exists on their network and assess their plan to address the threat. Patches must be applied swiftly, and IT teams typically will update products to fix known vulnerabilities regardless of FIPS certification status. It’s far riskier to not update software with a known vulnerability.
Secure By Design, Proactively Protected
Aruba networks are secure by design and have been carefully engineered with extensive security capabilities not typically found in other networking products. That level of security has given Federal departments and agencies the power to work anywhere and anytime—at even the highest levels of classified communications. With security designed into our products, backed by the work of our threat lab, Aruba strives to deliver the highest level of product security to our customers.
Learn More About Aruba Threat Labs
Watch the webcast “Insider Look: Tales from Aruba Threat Labs” with my colleagues, Jon Green, VP and Chief Security Technologist and Luiz Eduardo, Senior Director of Aruba Threat Labs. Don’t miss “story time” when Jon and Luiz tell tales about discovering and fixing vulnerabilities over the years.
