3 ms·

Generally, the biggest problem is that many companies just don't see updates as all that important unless they're offering a computer program or internet servic

by CM30 7y ago

Generally, the biggest problem is that many companies just don't see updates as all that important unless they're offering a computer program or internet service. Many smart devices, IoT devices, etc don't get updates at all, which leaves them wide open to anyone with the technical knowhow to attack them. Especially if they're internet connected, like many of them are. Getting companies to issue updates and fix security problems in these devices seems like one of the most important issues we're dealing with security wise.

thephyber 7y ago
> Getting companies to issue updates and fix security problems in these devices seems like one of the most important issues we're dealing with security wise. I would argue this is tangential to another massive problem: corporate IT teams are largely overwhelmed with the number of security patches required to keep their entire network updated (my company is in this space). Device manufacturers not patching their devices is one issue (zero day), but it's not likely the largest issue. I would say that devices that have patches available, but unapplied (Unpatched Vulnerabilities) are at least 10x bigger problem. I don't think your observation and the UV problem are unlinked -- most electronics manufacturers don't have a streamlined way of developing a patch, notifying the device owners/controllers, and pushing it quickly+easily to their devices. The {CVE database, OVAL, OSQuery} are useful, but it's very difficult for network owners to identify devices and know whether they are patched, let alone act on that and test+apply patches organization-wide.
- yasinaydin 7y ago
  I agree. Between 2005-2009, I used to work in systems of factories which has some CNC machines that were using Windows 95 and 98. They were not connected to internet or company network and were receiving the files required via USB sticks. That was also how Stuxnet infected power plants.

by CM30 7y ago

thephyber 7y ago

> Getting companies to issue updates and fix security problems in these devices seems like one of the most important issues we're dealing with security wise. I would argue this is tangential to another massive problem: corporate IT teams are largely overwhelmed with the number of security patches required to keep their entire network updated (my company is in this space). Device manufacturers not patching their devices is one issue (zero day), but it's not likely the largest issue. I would say that devices that have patches available, but unapplied (Unpatched Vulnerabilities) are at least 10x bigger problem. I don't think your observation and the UV problem are unlinked -- most electronics manufacturers don't have a streamlined way of developing a patch, notifying the device owners/controllers, and pushing it quickly+easily to their devices. The {CVE database, OVAL, OSQuery} are useful, but it's very difficult for network owners to identify devices and know whether they are patched, let alone act on that and test+apply patches organization-wide.

yasinaydin 7y ago
I agree. Between 2005-2009, I used to work in systems of factories which has some CNC machines that were using Windows 95 and 98. They were not connected to internet or company network and were receiving the files required via USB sticks. That was also how Stuxnet infected power plants.