5 ms·

Your comment exemplifies the attitude I'm talking about. You've presented a scenario that's false in it's premise: either your data is safe or it isn't. But rea

Your comment exemplifies the attitude I'm talking about. You've presented a scenario that's false in it's premise: either your data is safe or it isn't. But really, whether a thing is protected isn't quite so zero or one. Whether your production environment is actually at risk for the exploit being patched is a reasonable thing to ask in all scenarios. "What's our exposure here? Can it wait a few days?" would be a reasonable thing to ask. But in my experience that isn't how it goes. It goes how you suggested: ITSecOps presents an easy-to-decide case based on a false premise, and then immediately asks for CYA if the company says no. Over time, this becomes a rubber stamp from management, who are also demoralized by the process. The solution is to not present every security patch as a sky-is-falling event, but rather to be reasonable about the threats one faces and the impact to the business of forcing updates.

pixl97 4y ago
>Whether your production environment is actually at risk for the exploit being patched is a reasonable thing to ask in all scenarios. "What's our exposure here? Can it wait a few days?" would be a reasonable thing to ask. You would think it do be that way, but it don't.... Especially with things like Microsoft's megapatches they distribute these days. You are asking for the potential impact of anywhere from 10 to 100 patches custom tailored to the particular applications you're running on your server. Now you're asking for some large number of manhours of in depth analysis in a department that's already short on time. And as often as there is a patch that breaks the application, there is a patch that was released as a low impact that suddenly is high impact because it can be chained into an exploit, and now IT/SecOps is looking at the servers history to make sure it wasn't exploited at some time in the past. What is helpful here is not delaying patches, but instead having good testing environments that run the same version of the production application so the patch can be tested there first. Of course that costs a lot so you don't see it as often as you should.
BrandoElFollito 4y ago
> You've presented a scenario that's false in it's premise: either your data is safe or it isn't. Do you work in cybersecurity? have you done security assessment - the real, technicals ones before? I did. I coded (a tiny, tiny) part of the Linux kernel. My teams break systems for a living. If you have actually done security assessments than you know, of course, that there is no way to assess whether a vulnerability is low or high before shit hits the fan. When MS says "critical", then I say "critical" as well. I am not going to plat smart ass and then realize that in the shitty cathedral of systems businesses build there is THE configuration that allows for an exploit. Anything lower than critical - I do not care/ This can be done later. Bit is it is critical, it will be applied immediately, breaking systems and important presentations of the C-whatever. If the business has something against me then feel free to escalate to my management and tell them that they do want their data to be insecure. Because this is what they do want. Some tried - their systems are patched as the others. Everyone today is a doctor, football coach an,d recently cybersecurty expert. Yes, maybe your IT team sucks, but others just want to do their fucking dmn, work.
- hn_version_0023 4y ago
  You know, I've worked in IT long enough -- 25 years now! -- to watch the rise of "the cybersecurity professional", and their place as a rubber-stamp of acceptability in the food chain of business IT. I'm sorry if you find this comment to be incendiary, and an attack against you in particular. It most certainly is not. I do understand that there's a wide chasm between the state of the industry and the intentions of individual people. If it's any consolation, I've found that my own work is mostly a kind of rubber stamp too, and lately I've begun to question the entire endeavor. What are we actually working to do anymore? Beats me, really. But, I do find some irony in a statement like "it is critical, it will be applied immediately, breaking systems and important presentations of the C-whatever. If the business has something against me then feel free to escalate to my management" when the title of the article we're talking about is Report: 95% of employees say IT issues decrease workplace productivity and morale. If you don't see the connection between "I don't care how this affects you" and "IT causes low productivity and morale", well then I guess all I can do is laugh, and be glad I've left IT desk work for data center technician work.
  - BrandoElFollito 4y ago
    I am in the same boat, about 30 years of IT and moved to information security 15 years ago because it was a very interesting challenge. I understand your rubber-stamp thing (I see it a lot with "audits") but I refuse to be one. This is a lot of friction but ultimately I got the trust of the company (a very big company). One of the things I changed about 6 or 8 years ago was the patching process. Patching was done during maintenance windows and froze during quarter ends and similar. OTOH a wormable vulnerability, a ero day or similar will not wait - so I requested a decision of the owners of the data: either availability or security. They asked me all kind of questions such as "what is the probability" to what I answered that I have no idea. But if the recommendation of the vendor is to patch NOW then utr is also mine. And our systems are always patched, and I sleep better, they sleep better, everyone sleeps better. If you work in IT you know what this is either the useless dept that puts barriers, or the saviour when there is trouble. Nobody from these 95% realize that there may be reasons for the restrictions, even if at home they do not need a password or backup or patch or something. It would be much easier to work in some "added values" departments such as marketing and not in the water^H^H^H^H^H IT one.But I love my work.
jodrellblank 4y ago
Your earlier comment is about an IT department "overwhelmed, overworked, under appreciated, and fed up with the BS" who also had no control over the patching installs anyway, and didn't care, and your conclusion is ""What's our exposure here? Can it wait a few days?" would be a reasonable thing to ask." of them? I can't see that adding "now every single patch forever is up for argument" as likely to improve such a situation. Even in a competent and interested IT department, the change from "patch Tuesday, same time every month" to "now every patch is up for negotiation" seems like a non-trivial overhead, given that we assume it's desirable to install them all eventually. Exercising power for power's sake. One off asking "can we eat later today" is reasonable but if dinner is always inconvenient for someone then decide once "dinner is later" or "we eat separate dinners", don't have a dinnertime negotiation every day.

pixl97 4y ago

>Whether your production environment is actually at risk for the exploit being patched is a reasonable thing to ask in all scenarios. "What's our exposure here? Can it wait a few days?" would be a reasonable thing to ask. You would think it do be that way, but it don't.... Especially with things like Microsoft's megapatches they distribute these days. You are asking for the potential impact of anywhere from 10 to 100 patches custom tailored to the particular applications you're running on your server. Now you're asking for some large number of manhours of in depth analysis in a department that's already short on time. And as often as there is a patch that breaks the application, there is a patch that was released as a low impact that suddenly is high impact because it can be chained into an exploit, and now IT/SecOps is looking at the servers history to make sure it wasn't exploited at some time in the past. What is helpful here is not delaying patches, but instead having good testing environments that run the same version of the production application so the patch can be tested there first. Of course that costs a lot so you don't see it as often as you should.

BrandoElFollito 4y ago

> You've presented a scenario that's false in it's premise: either your data is safe or it isn't. Do you work in cybersecurity? have you done security assessment - the real, technicals ones before? I did. I coded (a tiny, tiny) part of the Linux kernel. My teams break systems for a living. If you have actually done security assessments than you know, of course, that there is no way to assess whether a vulnerability is low or high before shit hits the fan. When MS says "critical", then I say "critical" as well. I am not going to plat smart ass and then realize that in the shitty cathedral of systems businesses build there is THE configuration that allows for an exploit. Anything lower than critical - I do not care/ This can be done later. Bit is it is critical, it will be applied immediately, breaking systems and important presentations of the C-whatever. If the business has something against me then feel free to escalate to my management and tell them that they do want their data to be insecure. Because this is what they do want. Some tried - their systems are patched as the others. Everyone today is a doctor, football coach an,d recently cybersecurty expert. Yes, maybe your IT team sucks, but others just want to do their fucking dmn, work.

hn_version_0023 4y ago
You know, I've worked in IT long enough -- 25 years now! -- to watch the rise of "the cybersecurity professional", and their place as a rubber-stamp of acceptability in the food chain of business IT. I'm sorry if you find this comment to be incendiary, and an attack against you in particular. It most certainly is not. I do understand that there's a wide chasm between the state of the industry and the intentions of individual people. If it's any consolation, I've found that my own work is mostly a kind of rubber stamp too, and lately I've begun to question the entire endeavor. What are we actually working to do anymore? Beats me, really. But, I do find some irony in a statement like "it is critical, it will be applied immediately, breaking systems and important presentations of the C-whatever. If the business has something against me then feel free to escalate to my management" when the title of the article we're talking about is Report: 95% of employees say IT issues decrease workplace productivity and morale. If you don't see the connection between "I don't care how this affects you" and "IT causes low productivity and morale", well then I guess all I can do is laugh, and be glad I've left IT desk work for data center technician work.
- BrandoElFollito 4y ago
  I am in the same boat, about 30 years of IT and moved to information security 15 years ago because it was a very interesting challenge. I understand your rubber-stamp thing (I see it a lot with "audits") but I refuse to be one. This is a lot of friction but ultimately I got the trust of the company (a very big company). One of the things I changed about 6 or 8 years ago was the patching process. Patching was done during maintenance windows and froze during quarter ends and similar. OTOH a wormable vulnerability, a ero day or similar will not wait - so I requested a decision of the owners of the data: either availability or security. They asked me all kind of questions such as "what is the probability" to what I answered that I have no idea. But if the recommendation of the vendor is to patch NOW then utr is also mine. And our systems are always patched, and I sleep better, they sleep better, everyone sleeps better. If you work in IT you know what this is either the useless dept that puts barriers, or the saviour when there is trouble. Nobody from these 95% realize that there may be reasons for the restrictions, even if at home they do not need a password or backup or patch or something. It would be much easier to work in some "added values" departments such as marketing and not in the water^H^H^H^H^H IT one.But I love my work.

jodrellblank 4y ago

Your earlier comment is about an IT department "overwhelmed, overworked, under appreciated, and fed up with the BS" who also had no control over the patching installs anyway, and didn't care, and your conclusion is ""What's our exposure here? Can it wait a few days?" would be a reasonable thing to ask." of them? I can't see that adding "now every single patch forever is up for argument" as likely to improve such a situation. Even in a competent and interested IT department, the change from "patch Tuesday, same time every month" to "now every patch is up for negotiation" seems like a non-trivial overhead, given that we assume it's desirable to install them all eventually. Exercising power for power's sake. One off asking "can we eat later today" is reasonable but if dinner is always inconvenient for someone then decide once "dinner is later" or "we eat separate dinners", don't have a dinnertime negotiation every day.