7 ms·
Are we going to pretend that all our systems, software and service are 100% up to date and there are no known issues? 8 months isn't uncommon for a lot of compa
by swarnie_ 6y ago
Are we going to pretend that all our systems, software and service are 100% up to date and there are no known issues? 8 months isn't uncommon for a lot of companies I've consulted for.
In fact i've patched things with year with CVEs published in 2012/2013.
- the8472 6y agoDo lives depend on those companies' infrastructure?
- threentaway 6y agoIn all seriousness, how does this happen? Security updates are typically just installed with an apt-get upgrade and you're looking at a few minutes of downtime if the services needs to be restarted. Containers are even easier.
- Bombthecat 6y agoHow? It cost money and there is a... Hmm delayed impact (or none) that's why. But : germany is bringing out a new law about important IT infrastructure where you need a soc/ siem etc. I think its called IT sig.
- pjmlp 6y agoThis is definitely the kind of thing we need, when there is law involved, maybe that C library isn't appealing any more, or the CI/CD with all sorts of static analysis finally get the green light for the necessary infrastructure.
- saagarjha 6y agoThere’s no way most hospitals are using containers and a package manager, or even Linux for that matter.
- tstrimple 6y agoYou mean you're just running apt-get upgrade on critical systems which are literally responsible for the life and death of people without extensive testing and roll back procedures?
- pjmlp 6y agoNo, but if companies start getting liable for not ensuring up to date secured software, the priorities will certainly change.