Discontinued and end-of-life networking products often present a massive attack surface for bad actors, but the solution is not simply to hit the update button or upgrade to a newer version or alternative.

To address this issue, the Network Resilience Coalition (NRC) published a white paper titled “Protecting Network Resiliency” to offer recommendations on how networking vendors and users can collaborate to improve the overall security of networks.

The founding members of this coalition include AT&T, Broadcom (VMware), BT Group, Cisco, Fortinet, Intel, Juniper Networks, Lumen Technologies, Palo Alto Networks, and Verizon.

End of life products from both perspectives

NRC noted in the paper that addressing the challenges with end-of-life network products requires understanding the perspectives of both vendors and users: Vendors face technical and financial challenges in providing post-purchase support. Identifying and particularly fixing product flaws after release demands significant time and resources. Supporting a product indefinitely is economically infeasible and some products become too out-of-date to even update it.

However, users see ongoing support as an important part of continuing to use a product but often don't raise this issue until a product reaches its end of life, and many of them didn't pay sufficient attention to the end-of-life plans for that technology at the time of purchase.

“This paper was really important because certainly the dialogue on end-of-life issues has been simplistic, unrealistic and frankly showing not a lot of education about the problem,” Kathryn Condello, senior director of national security and emergency preparedness at Lumen Technologies, said at this week’s NRC event. “There are reasons why people don't automatically just hit update, I think it’s important because that means that any potential ‘oh I can fix it buttons’ whether on a regulatory or legislative basis, need to be reconsidered.”

Eric Goldstein, executive assistant director for cybersecurity at CISA, echoed dealing with end-of-life and end-of-support products becomes one of the most challenging and prevalent structural issues in cybersecurity. “The US government is only not immune from this challenge, we are one of the biggest victims,” he said at the event.

Recommendations for addressing security risks of end-of-life products

The white paper from NRC listed several recommendations for network product vendors on how to provide clarity on end-of-life products to help customers deal with security risks:

  • Firmly define specific end-of-life dates and details for each product, especially if there are multiple phases of end-of-life.
  • Publicly share end-of-life information in a static and web-addressable accessible location, if possible.
  • Clearly state if the end-of-life details have any deviations from the standard ones in a particular contract.
  • Use a standardized and/or machine-readable language to specify the end-of-life conditions and details such as by using OpenEoX.

OpenEoX is a global initiative — launched by OASIS Open, the international standards and open source consortium — to standardize the exchange of end-of-life and end-of-support information within the software and hardware industries.

In addition, NRC also offered suggestions for product users and maintainers on increasing cybersecurity vigilance on end-of-life and end-of-support products:

  • When you can't upgrade a product anymore, increase your efforts in managing risks and maintaining the product's settings, especially if the product no longer has vendor support.
  • Keep using protective measures on products without support, and be more vigilant as these products become older and further past their support dates.
Can automation help?

Condello argues automation plays into every single portion of the lifecycle of managing the security risks of end-of-life networking products.

Ari Schwartz, managing director at Venable, said in a press conference for the NRC event that automation can be helpful in the identification of what’s on the network as networks become more complex; in addition, automating the patching and tagging the vulnerabilities can extend to when products go out of life.

“The automation in the identification of what's on the network and the automation of the communication between the vendors and the customers about what the vulnerabilities are, what the consequences are associated with them; those are the key places where we can focus for now with a longer-term goal of being able to automate the mitigation down the road,” echoed Eric Wenger, senior director of technology policy and global government affairs at Cisco.