Re: Open Source Tool | vPrioritization | Risk Prioritization Framework

[Alex Gaynor <alex.gaynor () gmail com>]

On Tue, Sep 8, 2020 at 8:56 PM Jeffrey Walton <noloader () gmail com> wrote:

> On Mon, Sep 7, 2020 at 10:42 PM Kurt H Maier <khm () sciops net> wrote:
> > On Mon, Sep 07, 2020 at 09:11:00PM -0400, Jeffrey Walton wrote:
> > > Every US Federal agency I have worked with patches. The Social
> > > Security Administration does it within 30 days, and the Treasury
> > > Department does it in a matter of days. SSA is one of the largest
> > > networks in the world with over 100,000 hosts. Treasury had over
> > > 40,000 hosts.
> >
> > I've worked with US Federal agencies that did not patch.  I was able to
> > change some minds, and it was productive work of which I'm proud.  My
> > success rate is significantly below 100%, although my current employer
> > is largely sympathetic to this effort.
>
> I'd be interested to know which agencies don't have a comprehensive
> patch policy in place. And how they passed their SP800-53A audits.
> SI-2, Flaw Remediation, is part of all baselines.
Oh they have a policy. It says that systems will be patched in a timely
manner. And then the kind accountants who perform the audits say, "Great
policy, this is fully compliant, have an ATO and a gold star". And then
random things all over the place are not patched at all because federal IT
departments have astonishly poor automation practices, extremely limited
reuse of systems across distinct projects (contracts) within the agency and
there is nothing approaching a comprehensive way for a federal agency to
answer "did we deploy the updated struts for all of our stuff".

Alex


> > I would love to patch every computer with the latest available software,
> > but there remains a gulf between 100k data-entry terminals and computers
> > that must interact with the physical world.
>
> > Machines that are hooked up
> > to scientific or manufacturing equipment can be extremely difficult to
> > patch without breaking things and no amount of haughty lecturing seems
> > to fix the problem, despite same being readily available from multiple
> > sources as far back as I can remember.
>
> I usually encounter this as a one-off problem (and not a farm of
> specialized machines). In my experience, there will be 500
> workstations and servers that can be updated, and one machine that
> cannot. The one machine is the damn fax server with some custom board.
>
> > > Microsoft did a study years ago and found most hosts that are
> > > compromised failed to install vendor patches.
> >
> > "Software vendor finds that everything would improve if everyone
> > listened to software vendors" fails by a considerable distance to meet
> > with my interest.
>
> :)
>
> But it's hard to debunk facts like a new server will experience a
> break-in attempt within 3 minutes of being hung off the internet. It's
> a very repeatable experiment. And all the evidence is in the log
> files. (I think I have half of China and Europe banned through
> iptables).
>
> > "Software vendor stops breaking the driver ABI on
> > supported operating systems" would get a lot farther.  Suggesting this
> > generally results in an earth-shattering avalanche of excuses about how
> > hard programming is.
>
> Jeff


-- 
All that is necessary for evil to succeed is for good people to do nothing.