topic Why update ASDM if we don't use it in Network Security

Why update ASDM if we don't use it

jason.mora1 — Tue, 08 Sep 2020 19:32:34 GMT

I have several Cisco ASA 5525-X's and we only run Command Line on them. I can see the ASDM image on the flash but I've never updated it because we don't use it. Would there be a reason to update ASDM if it's not used?

Re: Why update ASDM if we don't use it

Rob Ingram — Tue, 08 Sep 2020 19:41:49 GMT

Hi,

If you aren't using ASDM, then possibly no need to upgrade.

If however you do need to use ASDM at somepoint in the future, then you should have the latest version to ensure any new feature available in ASA software is configurable via ASDM.

HTH

Re: Why update ASDM if we don't use it

jason.mora1 — Tue, 08 Sep 2020 19:46:42 GMT

That makes sense, I just want to make sure that if a CVE is published in the future regarding ASDM that I could possible ignore it because it does not apply to my system or if there was not some nuanced functionality that ASDM operated internally that could affect the system software.

Re: Why update ASDM if we don't use it

balaji.bandi — Tue, 08 Sep 2020 22:43:37 GMT

Personally, my suggestion is - even though you are not using ASDM good to put the latest version which is in line with your ASA version - as part of the upgrade process. - make sure you done all the tick boxes because some auditing not good - they point EOL code in ASA.

Re: Why update ASDM if we don't use it

Leo Laohoo — Tue, 08 Sep 2020 23:37:22 GMT

Whether ASDM is used or not, update or risk getting the network "pwn-ed".

There are a number of ASA vulnerabilities that are actively being exploited.

Re: Why update ASDM if we don't use it

Ruben Cocheno — Wed, 09 Sep 2020 00:12:39 GMT

@jason.mora1

Keep your network sanitized having all patches/software up-to-date. It's the best that you can do to lower the surface and reduce Risk to the business.

Re: Why update ASDM if we don't use it

Marvin Rhoads — Wed, 09 Sep 2020 07:16:37 GMT

If you never use it then remove the image from flash and make sure there is no "http server enable" line in the config. That way you don't expose the older (and potentially vulnerable to security-related defects) image.