3 ms·
Clickbait perhaps, but also tech press noting that if it was a Struts problem then it was either a 0-day when it happened or it happened months after a patch wa
by fencepost 9y ago
Clickbait perhaps, but also tech press noting that if it was a Struts problem then it was either a 0-day when it happened or it happened months after a patch was made available and widely publicized.
- tptacek 9y agoDoesn't matter. The "zero day" thing is a red herring. If you operate a business like Equifax, technically you're responsible for infrastructure vulnerabilities whether they're known or not. You assume your app servers could get compromised by an unknown vulnerability; you design your applications to minimize attack surface to reduce your risk, and then build in layers of controls and additional defenses to mitigate the impact of such a vulnerability. Nobody Fortune 500 company besides Google, Microsoft, Facebook and Apple really does this effectively (and even then, the track record isn't great). But that doesn't change anything about the analysis.