Wikileaks have dumped another huge cache of data ex-filtrated from behind the closed doors of three-letter acronym agencies: BBC, ABC, Independent.
Apple’s comments was wonderful, according to the BBC link above:
Apple’s statement was the most detailed, saying it had already addressed some of the vulnerabilities.
This is the crux of good security posture. Vulnerabilities exist in so much of what we use, the point is to be continuously addressing the issues and applying security before it is a problem.
I see patch cycles in organisations that can be measured in tectonic plate movement intervals. There are security updates available every few hours, yet organisations wait sometimes years to apply these.
Its simple:
- Do you know more than the software vendor about security?
- Probably not; therefore, take their advise and apply all pending security updates.
- Yes, I do!!; no, you probably don’t. See 1 above.
- Do you want to have an exploit situation caused by a KNOWN vulnerability with a KNOWN patch?
- No, cause I’d look pretty foolish if this happened. Apply security patches.
- Yes, because that’s the corporate policy and I don’t care about my job!
There’s not much we can do about UNKNOWN vulnerabilities, except that over time, some of the UNKNOWN become KNOWN, and they then become the PATCHED.
Now take this approach to your entire operating environment. Production servers, monitoring servers, CI systems, bastion hosts, VPN servers, proxy servers, Wikis, revision control systems, routers, switches, printers. The list goes on, but they all require maintenance, because writing good software is hard, and what looks like good practice today may become relegated tomorrow.