Slashdot Mirror
26% of Companies Ignore Security Bugs Because They Don't Have the Time to Fix Them (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: A survey compiled last month at the RSA security conference reveals that most companies are still behind with proper security practices, and some of them even intentionally ignore security flaws for various reasons ranging from lack of time to lack of know-how. The survey, which compiled answers from 155 security professionals from the companies present at the RSA conference, revealed that only 47% of organizations patch vulnerabilities as soon as they are known. Most worrisome is that some companies wait quite some time before applying patches, exposing their IT infrastructure to attacks. More precisely, 16% wait for one month, while 8% said they only apply patches once or twice a year.
It's not that I don't have enough time, I do.
It's that the powers at be only want to spend time on something if a client pays for it.
Yea, no shit. You don't just apply a vendor supplied patch to prod and hope it doesn't break anything.
Fix your shit or be run out of business. I think I speak for the majority when I say we're all sick and bloody well tired of having every gods-be-damned thing on the planet hacked by whoever because the firmware/software is written poorly.
No support from Microsoft for over four years but still over 10% market share for the security hole OS It will get even worse when Firefox drops support.. It gets to the point where it's easier to reformat every few months than to keep updating. Most viruses probably get great firewalled anyway.
You have to figure Windows 10 and its nightmare of patches and re patches has to make this worse. Not only dealing with security but also the fixes can create their own issues. I think back to Equifax and a patch that was released months ago that never got installed in Equifax servers.
Nobody with any experience installs a patch immediately when its released if they aren't forced to. It only takes one time borking your entire network/domain by being the unwitting beta tester to learn that lesson.
What does "as soon as [the vulnerabilities] are known" mean? Does it mean when DSA or USN is issued, which can be months after the CVEs are assigned and public? Or does it actually mean as soon as the vulns are made public?
That's one of reasons why I prefer Gentoo in production. The ability to bump port version, build and push to testing extremely easily, not needing to backport any patches across versions and in the process break stuff and introduce regressions, as Ubuntu and Debian often demonstrate.
74% of companies lie on surveys.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
"Put a dot on the map, we'll come back to that."
Which is said just to dismiss the issue demanding attention.
Correct security is about depth of defense. If you -have- to patch immediately every time then you've already failed.
Take your time. Do it right. If you understand your security posture and have designed it well, patching once or twice a year may well be sufficient.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
it's because of the lack of consequences, not because of time.... they would take the time to fix the issues if there would be appropriate consequences if they don't
The only thing that really matters is to have someone to throw under the bus when the shit hits the fan. Everything else is irrelevant.
Truth is security isn't a concern, I would bet most companies make new products that are vulnerable to a number of disclosed CVE's
Time and schedule for new features, people assume it's secure until proven otherwise
Purely from academic interest and in the cause of like research and al that, which 26%?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
If you have a labor vs. time issue you hire more people with the abilities needed to do the job. That means it is really a money problem or a cheap problem. Where you run into this is when you are a consumer. you have an issue. You make a phone call. You run into fruitless robotic replies that do not address your issue at all and every time they steer you to another robotic responder you end up at another dead end. The penny pinchers have gained control. It is one heck of a lot cheaper to jerk people around with poorly functioning answering machine programs. And it gets a lot worse. The next treat is that when you finally find a way to connect with a human they are usually so under trained or adequate for their jobs that the answers you get are way off base and make things even worse than they were before. I have found the way to get around those voice robots and that is to call the sales department. No business is dumb enough to insult potential buys with no human answering the phone. The sales department will usually transfer you to an employee who supposedly is familiar with the issue. If you want practice at this madness simply become a Comcast customer. You can have a real thrill as they can't figure out that you were double billed for over four months. Rarely can the people who answer the phones that you are lucky to reach, actually know what they are doing. And more of a howler the typical employee thinks they are super good at their job.
Many companies I've worked with are still focused on edge security and front end patching, making an invalid assumption that their greatest security risks are the bad guys trying to break in from the internet. The reality is that disgruntled employees and on-site 'visitors' present far greater risks to the security of the back end, where all that juicy sensitive data is stored but usually with a lot less protection. I only have moderate technical skills and every client I've EVER worked with could have been completely owned with fairly limited effort if I was ever asked to.
Most organizations don't have resources to hold a fall back copy of their production server(s)
don't have time to do their homework.
for Microsoft. And if you want hardened firmware for the tablet you give your kid to watch youtube be my guest. It'll be $1500. Me? I'll stick to my $60 el-cheapo. I don't always need perfect security.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
..don't have the technical competence
Security is hard
when your Corporate name is being dragged through the mud, the Litigation Monster makes an appearance, your share-holders are getting out the torches and pitch forks and management is frantically looking through the list to see which Junior Developer they can pin the blame on for the ' bug ' in the code.
THAT is the only time companies take security seriously because, let's be honest, there are otherwise no consequences for being the Corporate equivalent of an incompetent fuck up. A slap on the wrist, a mediocre fine, maybe a name change and it's back to business as usual.
Once upon a time, a brand name MEANT something. $brand could command a higher price tag because $brand was synonymous with a quality product.
Those days are long gone.
Thus the era of Incompetence has arrived. Where some decent Q/A or even realistic Beta Testing may have caught your problem long before it became that giant Iceberg you're sailing into.
But no ones cares. We have enough life boats.
Full speed ahead ! :|
. . . I run a Secure Code Analysis team. I am **CONSTANTLY** bombarded with "well, this is legacy code, there's no budget left for security. . . ."
Dude. One of the requirements in the contract was to comply with the appropriate regulations and best practices. Which, despite my team bugging you for literally YEARS, and pointing out where the contract specifically requires code reviews. . . .I get told "when did this requirement come in" and "we don't have the money for that." But apparently they had the money for three extra Vice Presidents and their staffs. . . /boggle
. . . anyone who has studied for a CISSP or SANS GIAC Cert knows about risk management.
1. How likely is the bug to be exploited (x times a year)
2. How much damage will the bug cost ? (y dollars per attack")
. . . and THEN: how much will it cost to fix the bug. ( call it "z": recoding, testing, review. distribution of fix)
Then you do the math: If z is less than x times y, it makes sense to fix the bug. If z is more than x times y, and especially much more, you accept the risk. And you revisit the question periodically, as security is a ongoing process, not a single pass-it-and go state.