Slashdot Mirror
26% of Companies Ignore Security Bugs Because They Don't Have the Time to Fix Them (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: A survey compiled last month at the RSA security conference reveals that most companies are still behind with proper security practices, and some of them even intentionally ignore security flaws for various reasons ranging from lack of time to lack of know-how. The survey, which compiled answers from 155 security professionals from the companies present at the RSA conference, revealed that only 47% of organizations patch vulnerabilities as soon as they are known. Most worrisome is that some companies wait quite some time before applying patches, exposing their IT infrastructure to attacks. More precisely, 16% wait for one month, while 8% said they only apply patches once or twice a year.
It's not that I don't have enough time, I do.
It's that the powers at be only want to spend time on something if a client pays for it.
Yea, no shit. You don't just apply a vendor supplied patch to prod and hope it doesn't break anything.
Fix your shit or be run out of business. I think I speak for the majority when I say we're all sick and bloody well tired of having every gods-be-damned thing on the planet hacked by whoever because the firmware/software is written poorly.
No support from Microsoft for over four years but still over 10% market share for the security hole OS It will get even worse when Firefox drops support.. It gets to the point where it's easier to reformat every few months than to keep updating. Most viruses probably get great firewalled anyway.
74% of companies lie on surveys.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Correct security is about depth of defense. If you -have- to patch immediately every time then you've already failed.
Take your time. Do it right. If you understand your security posture and have designed it well, patching once or twice a year may well be sufficient.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
it's because of the lack of consequences, not because of time.... they would take the time to fix the issues if there would be appropriate consequences if they don't
even if they were to hire penetration testing services they were sure the pen-testers wouldn’t expose any new risks or flaws. The sheer ignorance of such statement somewhat explains why some respondents admitted to not having time to apply security patches
We hired a pentester and they didn't expose any flaws, we already knew about all of them. Phishing email, macro or exploit to powershell to downloaded binary to credential theft via LLMNR/NBNS to pass the hash to admin account, and so on. If you are hiring a pentester solely to expose new flaws, you are doing it wrong. Much like the author of this article.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Purely from academic interest and in the cause of like research and al that, which 26%?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
If you have a labor vs. time issue you hire more people with the abilities needed to do the job. That means it is really a money problem or a cheap problem. Where you run into this is when you are a consumer. you have an issue. You make a phone call. You run into fruitless robotic replies that do not address your issue at all and every time they steer you to another robotic responder you end up at another dead end. The penny pinchers have gained control. It is one heck of a lot cheaper to jerk people around with poorly functioning answering machine programs. And it gets a lot worse. The next treat is that when you finally find a way to connect with a human they are usually so under trained or adequate for their jobs that the answers you get are way off base and make things even worse than they were before. I have found the way to get around those voice robots and that is to call the sales department. No business is dumb enough to insult potential buys with no human answering the phone. The sales department will usually transfer you to an employee who supposedly is familiar with the issue. If you want practice at this madness simply become a Comcast customer. You can have a real thrill as they can't figure out that you were double billed for over four months. Rarely can the people who answer the phones that you are lucky to reach, actually know what they are doing. And more of a howler the typical employee thinks they are super good at their job.
Most organizations don't have resources to hold a fall back copy of their production server(s)
for Microsoft. And if you want hardened firmware for the tablet you give your kid to watch youtube be my guest. It'll be $1500. Me? I'll stick to my $60 el-cheapo. I don't always need perfect security.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
..don't have the technical competence
Security is hard
when your Corporate name is being dragged through the mud, the Litigation Monster makes an appearance, your share-holders are getting out the torches and pitch forks and management is frantically looking through the list to see which Junior Developer they can pin the blame on for the ' bug ' in the code.
THAT is the only time companies take security seriously because, let's be honest, there are otherwise no consequences for being the Corporate equivalent of an incompetent fuck up. A slap on the wrist, a mediocre fine, maybe a name change and it's back to business as usual.
Once upon a time, a brand name MEANT something. $brand could command a higher price tag because $brand was synonymous with a quality product.
Those days are long gone.
Thus the era of Incompetence has arrived. Where some decent Q/A or even realistic Beta Testing may have caught your problem long before it became that giant Iceberg you're sailing into.
But no ones cares. We have enough life boats.
Full speed ahead ! :|
. . . I run a Secure Code Analysis team. I am **CONSTANTLY** bombarded with "well, this is legacy code, there's no budget left for security. . . ."
Dude. One of the requirements in the contract was to comply with the appropriate regulations and best practices. Which, despite my team bugging you for literally YEARS, and pointing out where the contract specifically requires code reviews. . . .I get told "when did this requirement come in" and "we don't have the money for that." But apparently they had the money for three extra Vice Presidents and their staffs. . . /boggle
. . . anyone who has studied for a CISSP or SANS GIAC Cert knows about risk management.
1. How likely is the bug to be exploited (x times a year)
2. How much damage will the bug cost ? (y dollars per attack")
. . . and THEN: how much will it cost to fix the bug. ( call it "z": recoding, testing, review. distribution of fix)
Then you do the math: If z is less than x times y, it makes sense to fix the bug. If z is more than x times y, and especially much more, you accept the risk. And you revisit the question periodically, as security is a ongoing process, not a single pass-it-and go state.