4 ms·
> the DC's weren't patched As I understand it, airgapped systems are not in the habit of bringing software updates across the airgap, so unpatched everything i
by superuser2 10y ago
> the DC's weren't patched
As I understand it, airgapped systems are not in the habit of bringing software updates across the airgap, so unpatched everything is likely.
- drzaiusapelord 10y agoIts trivial to do with WSUS and off-line updates. But yeah, if its a shit run environment, it will get owned by someone eventually.
- paulfurtado 10y agoAn air-gapped set of servers performing updates from a non-air-gapped WSUS server are not air-gapped servers at all. If the WSUS server were also air-gapped, then you're in the business of manually downloading each update, verifying it, and copying it to over to the air-gapped WSUS server offline. Microsoft's Windows Update servers have also been compromised in the past. Depending on the level of security you're operating at, taking new windows updates on your air-gapped systems may require having someone decompile and review each update. In general, being air-gapped prevents infinitely more exploits than windows updates could ever possibly cure; that is, until one of your admins uses his admin privileges to disable the USB port restrictions for 5 minutes that one time to copy that one file quickly so he can go home for the day. For this, there are epoxied USB ports.