Cisco Recommended OS for ASA 5500-X series

[Steven Williams]

Is there a site that I can look at the states Cisco recommended IOS/OS versions for all their devices?

[Marvin Rhoads]

Sure - the recommended ASA software version(s) are denoted by a gold star on the software download page. For instance, see this one for the 5525-X which shows that 9.1(5.21) and 9.2(3) are currently recommended.

That does not always take into account the very latest security advisories. If that's of concern to you, you might want to go with something a bit newer, as noted in this current advisory.

The same guidance applies to many other platforms (but not every single one). 

[Steven Williams]

Lets be honest though, every version is going to have vulnerabilities! Qualys can detect one or two on code 9.1 and then I go to 9.4, whos to say it wont detect 5 or 6? How do people manage this?

[Marvin Rhoads]

Well I do this for a full-time living; so how I manage it may differ from the occasional ASA admin. Here's my process:

I read the release notes with every release (except the interims). I also subscribe to the Cisco Security Advisories and go through each one seeing if the advisory is relevant for any of the use cases I'm supporting.

When it is, I first see if there are compensating controls I can put in place or if the risk level is acceptable for a given environment. (I tend not to just jump on every interim release as they are not as completely regression test as the maintenance releases.) Ths step is very important because just running automated scans and looking for a "perfect" score is, as you implied, chasing a will o' wisp

If there are no compensating controls and/or the risk is unacceptable then I schedule a deployment of the software in a planned maintenance window. I do some basic sanity check tests to make sure nothing obvious is broken, and then follow up with the customer in a week or so to make sure no subtle problems have cropped up.