3 ms·

Never again worry about zero-days. That's pure snake oil. The little asterisk compounds their mistake: Because updates are securely installed within one

Never again worry about zero-days. That's pure snake oil. The little asterisk compounds their mistake: Because updates are securely installed within one hour of their availability, the time-scale of a fix being applied is no longer meaningfully measured in days. Zero hours are the new zero days. That's not what "zero day" means. It isn't the time between a security fix becoming available and a vulnerable system installing said patch. Rather, it's the time between a vulnerability being discovered and said vulnerability being disclosed. It's great that this vendor has mechanism for quickly distributing security updates, but that isn't going to mitigate zero day vulnerabilities. Rather, zero days would be mitigated by SDLC activities that would help them discover novel vulnerabilities in their code, like design/code reviews, static analysis, or fuzzing. If they want to reassure their customers that they're good at infosec, then they need to do a lot more than spout some BS about how their automatic update mechanism stops zero days when it can't.

CiPHPerCoder 10y ago
> That's not what "zero day" means. It's half of the practical concerns with zero days, and the half that most software teams have the least amount of control over. > It's great that this vendor has mechanism for quickly distributing security updates, but that isn't going to mitigate zero day vulnerabilities. See: http://www.tripwire.com/state-of-security/incident-detection/drupal-psa-if-you-didnt-patch-within-7-hours-consider-your-site-hacked/ http://www.tripwire.com/state-of-security/incident-detection... > Rather, zero days would be mitigated by SDLC activities that would help them discover novel vulnerabilities in their code, like design/code reviews, static analysis, or fuzzing. That's correct, but nontechnical users aren't interested in these details. What's more interesting to them is "When it's fixed, I won't have to do anything to not be vulnerable." > If they want to reassure their customers that they're good at infosec, then they need to do a lot more than spout some BS about how their automatic update mechanism stops zero days when it can't. I'll refine the wording a bit better. Thanks for the feedback.
- xenophonf 10y ago
  What's more interesting to [non-technical users] is "When it's fixed, I won't have to do anything to not be vulnerable." Then say that instead of making specious safety guarantees.

CiPHPerCoder 10y ago

> That's not what "zero day" means. It's half of the practical concerns with zero days, and the half that most software teams have the least amount of control over. > It's great that this vendor has mechanism for quickly distributing security updates, but that isn't going to mitigate zero day vulnerabilities. See: http://www.tripwire.com/state-of-security/incident-detection/drupal-psa-if-you-didnt-patch-within-7-hours-consider-your-site-hacked/ http://www.tripwire.com/state-of-security/incident-detection... > Rather, zero days would be mitigated by SDLC activities that would help them discover novel vulnerabilities in their code, like design/code reviews, static analysis, or fuzzing. That's correct, but nontechnical users aren't interested in these details. What's more interesting to them is "When it's fixed, I won't have to do anything to not be vulnerable." > If they want to reassure their customers that they're good at infosec, then they need to do a lot more than spout some BS about how their automatic update mechanism stops zero days when it can't. I'll refine the wording a bit better. Thanks for the feedback.

xenophonf 10y ago
What's more interesting to [non-technical users] is "When it's fixed, I won't have to do anything to not be vulnerable." Then say that instead of making specious safety guarantees.