4 ms·
Of course, disabling those auto updates will have you fail the external security audit and now your security team needs to fight with the rest of the leadership
by izacus 2y ago
Of course, disabling those auto updates will have you fail the external security audit and now your security team needs to fight with the rest of the leadership in the company explaining why you're generating needless delays, costs against the "state of the art in security industry" and why your security guys are smarter than the people who have the power to approve or deny your security certification.
- chii 2y ago> you fail the external security audit aka, you fail the cover-your-ass security, rather than actual security.
- izacus 2y agoyep, but "trust us, we're secure, pinky promise by our internal employees" doesn't really work either.
- ryandrake 2y agoDon't forget the press releases all saying "We take security very seriously!"
- StefanBatory 2y agoEmployees would rather care for their employment and keeping boss happy rather than going against their orders.
- lysp 2y agoOr lose IT/security insurance for not installing or disabling it.
- nlitened 2y agoWell, let’s see how much insurance companies will pay now
- deleted 2y ago[deleted]
- scott_w 2y agoIt’s not about whether they pay out, large enough customers demand you have insurance as a condition of sale. It’s cover your arse all the way down!
- mdip 2y agoKind of a big thing most people don't understand about the various forms of "Business Insurance." For the most part, businesses have whatever insurance whatever they are doing requires them to have. Those requirements are set by laws/regulations applied to those entities and the various entities they want to do business with. At every small shop I've worked when the topic of Business Insurance came up with one of the owners, the response was extremely negative -- basically summarized as "it's the most you will ever pay for something you won't ever be able to use".
- scott_w 2y agoYep, it’s pretty much a toll on doing business with entities. I’ve no doubt the intention is so your customer can sue you without you winding up, whether it actually works… no idea.
- guax 2y agoWell. Now you have something to point to. Next RFO you can ignore the blameless part and point to a executive override of a technical decision.
- throwaway7ahgb 2y agoI have been in these audits and nowhere does it say that software has to be 'auto updated', this is a ridiculous statement and requirement. What a proper audit will look for is a update and testing control with supporting evidence.
- skywhopper 2y agoSounds like your employer has better auditing processes than most places.
- anchochilis 2y agoWhat I don't understand is why they don't have a canary update process. Server side deployments do this all the time. You would think Windows would offer that to their institutional customers, for all types of updates including (especially) 3rd party.
- luma 2y agoThis isn't a Windows update (which absolutely does let you do blue/green deployments vis SUS), but rather a Crowdstrike update which also lets you stage rollouts and I expect several administrators are finding out why that is important.
- vladvasiliu 2y agoI know about update policies, but afaik those are about the “agent” version. Today’s update doesn’t look like an agent version. The version my box is running was released something like a week ago. Is there some possibility tu stage rollouts of the other stuff it seems to download?
- btbuildem 2y agoI've taken part in some security audits where I work. They're not a joke only because they're a tragic story of incompetence, hubris, and rubberstamping. They 100% focus on checking boxes and cargo-culting, while leaving enormous vulnerabilities wide open.
- remram 2y agoWhy do we call managers "leaders" now? That's not what they are.