oss-sec mailing list archives
Re: Open Source Tool | vPrioritization | Risk Prioritization Framework
From: Jeffrey Walton <noloader () gmail com>
Date: Mon, 7 Sep 2020 21:11:00 -0400
On Mon, Sep 7, 2020 at 4:52 PM Perry E. Metzger <perry () piermont com> wrote:
On Sun, 6 Sep 2020 13:18:34 +0530 Pramod Rana <varchashva () gmail com> wrote:Appreciate your comments. My two cents - Patch everything is far from reality to most (read all) organizations"All" is clearly false; I know many organizations that patch all their hardware fast, and a few that do it essentially within hours (unless CI tests for the patched infra fail).
Yeah, I thought the same. I was hoping to see more about that comment. Every US Federal agency I have worked with patches. The Social Security Administration does it within 30 days, and the Treasury Department does it in a matter of days. SSA is one of the largest networks in the world with over 100,000 hosts. Treasury had over 40,000 hosts. Microsoft did a study years ago and found most hosts that are compromised failed to install vendor patches. Most patches were available at least 60 days earlier. The one takeaway is, if you want to get compromised, then don't patch the host. A script kiddie will be happy to pwn you. I also got to rebuild a few servers that were compromised due to lack of updates. It is a lot easier to fix a broken database connection then it is to rebuild the server and restore the database. Diagnosing and fixing the database connection takes about 30 minutes. Rebuilding and restoring the server takes about two days. I'm such a firm believer in patching from experiences at SSA and Treasury all machines under my control are patched immediately. I apply all patches in case something is misclassified. I don't care if it is a CVE or [benign?] memory error. I want the vector removed. https://github.com/noloader/auto-update. Also see Peter Herzog's https://blogs.blackberry.com/en/2018/04/security-getting-off-the-patch and https://blogs.blackberry.com/en/2018/05/security-getting-off-the-patch-the-shining-hope. Jeff
Current thread:
- Open Source Tool | vPrioritization | Risk Prioritization Framework Pramod Rana (Sep 03)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Perry E. Metzger (Sep 05)
- Risk and severity vectors (was: Open Source Tool | vPrioritization | Risk Prioritization Framework) Jeremy Stanley (Sep 05)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Pramod Rana (Sep 06)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Amos Jeffries (Sep 06)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Robert Watson (Sep 06)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Perry E. Metzger (Sep 07)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Jeffrey Walton (Sep 07)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Kurt H Maier (Sep 07)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Jeffrey Walton (Sep 08)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Alex Gaynor (Sep 08)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework The Doctor [412/724/301/703/415/510] (Sep 09)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Perry E. Metzger (Sep 05)