[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAH8yC8ms56V7hAVKz1VQ7wX01H+ZC78GAPnNbd7tXRQgRxBt6A@mail.gmail.com>
Date: Mon, 7 Sep 2020 21:11:00 -0400
From: Jeffrey Walton <noloader@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Open Source Tool | vPrioritization | Risk
Prioritization Framework
On Mon, Sep 7, 2020 at 4:52 PM Perry E. Metzger <perry@...rmont.com> wrote:
>
> On Sun, 6 Sep 2020 13:18:34 +0530 Pramod Rana <varchashva@...il.com>
> wrote:
> > Appreciate your comments.
> >
> > My two cents - Patch everything is far from reality to most (read
> > all) organizations
>
> "All" is clearly false; I know many organizations that patch
> all their hardware fast, and a few that do it essentially within
> hours (unless CI tests for the patched infra fail).
Yeah, I thought the same. I was hoping to see more about that comment.
Every US Federal agency I have worked with patches. The Social
Security Administration does it within 30 days, and the Treasury
Department does it in a matter of days. SSA is one of the largest
networks in the world with over 100,000 hosts. Treasury had over
40,000 hosts.
Microsoft did a study years ago and found most hosts that are
compromised failed to install vendor patches. Most patches were
available at least 60 days earlier. The one takeaway is, if you want
to get compromised, then don't patch the host. A script kiddie will be
happy to pwn you.
I also got to rebuild a few servers that were compromised due to lack
of updates. It is a lot easier to fix a broken database connection
then it is to rebuild the server and restore the database. Diagnosing
and fixing the database connection takes about 30 minutes. Rebuilding
and restoring the server takes about two days.
I'm such a firm believer in patching from experiences at SSA and
Treasury all machines under my control are patched immediately. I
apply all patches in case something is misclassified. I don't care if
it is a CVE or [benign?] memory error. I want the vector removed.
https://github.com/noloader/auto-update.
Also see Peter Herzog's
https://blogs.blackberry.com/en/2018/04/security-getting-off-the-patch
and https://blogs.blackberry.com/en/2018/05/security-getting-off-the-patch-the-shining-hope.
Jeff
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
