3 ms·
Here's the thing, network security needs to be balanced against organizational operations. Internet Explorer has been sold to organizations as a platform where
by dkokelley 14y ago
Here's the thing, network security needs to be balanced against organizational operations. Internet Explorer has been sold to organizations as a platform where thin client applications can be deployed cheaply. Internet Explorer doesn't update automatically because the last thing Microsoft wants to do to their clients is break all of their web apps through an untested update. Security updates also need to have backwards compatibility, or large firms won't upgrade, since their web apps might break.
Security and usability are at odds. Large organizations (thus far) tend to favor usability. It's a cost-benefit analysis, and the benefit of not redeveloping their web apps outweighs the cost of increasing security.
- fjarlq 14y agoConsidering the type of work that goes on at Oak Ridge, I'm not so sure they correctly calculated the true cost of using Windows and Internet Explorer....
- peeters 14y agoI'm not sure they (or any other really high-risk security company) calculated the true cost of connecting their network to the internet at all. A really simple, effective way of protecting sensitive data is to say that the network that hosts it will have absolutely no path outside. Then give your employee another machine on the same desk which connects to the internet but is on a completely network. It's annoying at first, but it works pretty damned well.
- reidrac 14y agoIf their applications break because of an upgrade of IE (or even if the apps doesn't work with a different browser/operating system), I'm not sure their problem is with security. It's true that after the attackers got the entry point, there are several thing wrong according to article (ie. "Four days after the e-mails arrived, administrators spotted suspicious traffic leaving a server." -- so they got a mail that used an IE vulnerability, and then a server got affected?).
- dkokelley 14y agoSure, once the attacker gains a foothold, targeting servers from inside the network is certainly possible, especially if the infected user has significant permissions on the network.
- reidrac 14y agoAs I said, that means there is something definitely wrong in their security policies. That should not happen. Ever.
- Joeri 14y agoI've had chrome updates that broke working standards-compliant code. There's some truth to IE stability between minor releases. The problem is that every major release of IE so far has required big changes (usually to take out IE-specific code). What they win on minor updates, they squander on the major ones. Chrome and firefox haven't had that much of migration pain in years.