Date: Mon, 7 Sep 2020 21:11:00 -0400 From: Jeffrey Walton <noloader@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Open Source Tool | vPrioritization | Risk Prioritization Framework On Mon, Sep 7, 2020 at 4:52 PM Perry E. Metzger <perry@...rmont.com> wrote: > > On Sun, 6 Sep 2020 13:18:34 +0530 Pramod Rana <varchashva@...il.com> > wrote: > > Appreciate your comments. > > > > My two cents - Patch everything is far from reality to most (read > > all) organizations > > "All" is clearly false; I know many organizations that patch > all their hardware fast, and a few that do it essentially within > hours (unless CI tests for the patched infra fail). Yeah, I thought the same. I was hoping to see more about that comment. Every US Federal agency I have worked with patches. The Social Security Administration does it within 30 days, and the Treasury Department does it in a matter of days. SSA is one of the largest networks in the world with over 100,000 hosts. Treasury had over 40,000 hosts. Microsoft did a study years ago and found most hosts that are compromised failed to install vendor patches. Most patches were available at least 60 days earlier. The one takeaway is, if you want to get compromised, then don't patch the host. A script kiddie will be happy to pwn you. I also got to rebuild a few servers that were compromised due to lack of updates. It is a lot easier to fix a broken database connection then it is to rebuild the server and restore the database. Diagnosing and fixing the database connection takes about 30 minutes. Rebuilding and restoring the server takes about two days. I'm such a firm believer in patching from experiences at SSA and Treasury all machines under my control are patched immediately. I apply all patches in case something is misclassified. I don't care if it is a CVE or [benign?] memory error. I want the vector removed. https://github.com/noloader/auto-update. Also see Peter Herzog's https://blogs.blackberry.com/en/2018/04/security-getting-off-the-patch and https://blogs.blackberry.com/en/2018/05/security-getting-off-the-patch-the-shining-hope. Jeff
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.