Re: Windows O/S Patching Question

[Joel Rosenblatt <joel () COLUMBIA EDU>]

So, if I wait a month or two before installing patches normally and the exploit comes out before the end of my normally (very lax) install cycle, I can call it 
a 0-day ... I guess that would work if your boss is really clueless :-)

My 2 cents

Joel

--On Monday, March 26, 2012 1:06 PM -0700 David Gillett <gillettdavid () FHDA EDU> wrote:

> > It's TOOOO long if the compromised is out in the wild
>
>   That is, I believe, the definition of a "0-day":  The "patch window"
> between discovery of a vulnerability and appearance of an exploit "in the
> wild" is of zero length, usually because the vulnerability was identified
> (by vendor or researchers) only by reverse-engineering some new exploit....
>
> ...
>
> I believe it is the task of auditors to verify two assertions:
>
> 1.  The institution's policies/procedures meet its business needs.
>
>   where "meet the requirements of thus-and-such standard" is often accepted
> as a minimum set of requirements, necessary but not necessarily sufficient
> to satisfy this assertion, and
>
> 2.  Actual operations conform to those policies/procedures.
>
>   So to pass an audit is going to require at least (a) a written
> standard/policy, and (b) an "audit trail" logging actions performed with
> time and date.  If you don't have both of those, you shouldn't pass an
> audit.  Ever.
>
>   Once you have them, then it's time to look closer at #1 and at the actual
> needs of the business -- whether regulatory compliance is mandated by
> legislation, what degree of risk is acceptable, and so forth -- stuff where
> Senior Management makes some choices, even if the choice is only whether to
> remain in business or not....
>
>
> David Gillett, CISSP CCNP



Joel Rosenblatt, Director Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel
Public PGP key
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x90BD740BCC7326C3