u/StoriesFromTAC

The three of us were having a chat about our posts and had a thought of taking questions or topic suggestions from the community.

If it's of interest, please give us your questions or topics you want answers to. It can be about anything related to TAC, technology, Cisco, or roles. Please do give us time to respond since it takes a bit for the three of us to chat and write back.

Edit: The answer was yes. We will respond tomorrow evening after we are all off shift, UTC time.

Friends, prepare for the sky to fall. A substantial vulnerability to SDWAN will land tomorrow. The projected announcement will be noon our time.

It's significant, it's bad. Follow the instructions in the PSIRT.

This is the new normal.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU

If you've felt TAC engineers are angry lately, you'd be correct, and if you ask why, you'll get an earful on how we're not happy. Our most recent pain in the tail has been a surprise change to team assignments.

Several teams had members forced to leave their technology and move to SD-WAN due to case volume. Instead of professional hires, or at least someone from a related field, Cisco leadership opted to take good engineers from unrelated technologies. Those making the move will get a few months of training before being let loose over there. Leadership felt it was better to short the existing teams and retrain, most likely to make the budget numbers work.

The stated reason is that Cisco, and SD-WAN in particular, has had a busy year on the vulnerability front. It started with the authentication-bypass issue in the control connections, but then we got blasted with a few more. Seeing a 9.9 score for a CVE isn't exactly something you want lurking in the background. The Glasswing deluge was minor by comparison, but it's been wave after wave.

From a technical perspective, nothing changes — keep it patched. Keep it locked down. And for heaven’s sake, don't expose the management plane to the internet just because it's convenient.

This has been a tough year for TAC. The changes to case management with automated case distribution have been terrible. The AI system requires constant oversight, which means we spend as much time, or more, on case intake and assignment as we did before. Not only that, we're benchmarked on metrics that don't matter, while the aspects that actually do matter are largely ignored.

Overwatch of Sherlock and the AI responses, organisational restructuring, keyword changes, sudden shutdown of some GDP teams, and the endless AI fixation without much substance have been rough.

If you're reading this and thinking we should quit if we're so unhappy, you're right. The problem is the job market is shite, and we haven't found another worthwhile position.

In summary, the point of this mostly pointless post is to apologise for TAC being angry. I'm sure you see it or feel it, but we're not happy, and I don't see that improving over the next few months. We're only speaking as a small number of engineers in the broad TAC population, so take it for what it's worth.