oss-sec mailing list archives
Re: Open Source Tool | vPrioritization | Risk Prioritization Framework
From: Kurt H Maier <khm () sciops net>
Date: Mon, 7 Sep 2020 19:41:35 -0700
On Mon, Sep 07, 2020 at 09:11:00PM -0400, Jeffrey Walton wrote:
Every US Federal agency I have worked with patches. The Social Security Administration does it within 30 days, and the Treasury Department does it in a matter of days. SSA is one of the largest networks in the world with over 100,000 hosts. Treasury had over 40,000 hosts.
I've worked with US Federal agencies that did not patch. I was able to change some minds, and it was productive work of which I'm proud. My success rate is significantly below 100%, although my current employer is largely sympathetic to this effort. I would love to patch every computer with the latest available software, but there remains a gulf between 100k data-entry terminals and computers that must interact with the physical world. Machines that are hooked up to scientific or manufacturing equipment can be extremely difficult to patch without breaking things and no amount of haughty lecturing seems to fix the problem, despite same being readily available from multiple sources as far back as I can remember. Risk assessment is for when you don't have absolute control over your environment.
Microsoft did a study years ago and found most hosts that are compromised failed to install vendor patches.
"Software vendor finds that everything would improve if everyone listened to software vendors" fails by a considerable distance to meet with my interest. "Software vendor stops breaking the driver ABI on supported operating systems" would get a lot farther. Suggesting this generally results in an earth-shattering avalanche of excuses about how hard programming is. In the meantime, we do what we can. khm
Current thread:
- Open Source Tool | vPrioritization | Risk Prioritization Framework Pramod Rana (Sep 03)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Perry E. Metzger (Sep 05)
- Risk and severity vectors (was: Open Source Tool | vPrioritization | Risk Prioritization Framework) Jeremy Stanley (Sep 05)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Pramod Rana (Sep 06)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Amos Jeffries (Sep 06)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Robert Watson (Sep 06)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Perry E. Metzger (Sep 07)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Jeffrey Walton (Sep 07)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Kurt H Maier (Sep 07)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Jeffrey Walton (Sep 08)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Alex Gaynor (Sep 08)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework The Doctor [412/724/301/703/415/510] (Sep 09)
- Re: Open Source Tool | vPrioritization | Risk Prioritization Framework Perry E. Metzger (Sep 05)