158

Your statement makes two faulty assumptions: Your firewall(s) is/are fully correctly configured and has no vulnerabilities that would allow an attacker to compromise it and that perfect state will continue. Everyone in your organisation is trustworthy and presents no risk. You should always operate on a defence in depth approach and secure every layer ...


153

There are various utilities in different operating systems which allow hot-patching of running code. An example of this would be kpatch and livepatch features of Linux which allow patching the running kernel without interrupting its operations. Its capabilities are limited and can only make trivial changes to the kernel, but this is often sufficient for ...


101

I watched a presentation at a security conference by a Netflix employee. They don't patch at all. Instead, when a patch is required, they stand up new instances and then blow away the unpatched ones. They are doing this almost constantly. They call it red-black deployment.


64

The short answer is: They do reboot. You seem to assume that Amazon and Google run on a single server, and if that is rebooted, the whole site/service is down. This is very far from the truth - large services typically run on many servers that work in parallel. For further reading, look at techniques like clustering, load balancing and failover. Google, ...


57

This is an age-old question and always has the same answer. You cannot depend on your attackers being unable to access your network. All it takes is a single employee clicking on a phishing email and the attacker has a toehold on your network. If you leave everything unpatched, they will have a field day.


56

Excellent question. Yes, your understanding is correct, as well as your rationale behind it. Staggering roll outs for new features often makes good sense. Staggering roll outs for security patches rarely is a good idea. As you pointed out, this gives even more opportunity for the vulnerabilities to be exploited. Perhaps even more importantly, the ...


40

What are the strengths of each team member that I will work with regularly? (i.e. programming, linux, networking, regulations, etc.) Where is our documentation? You hopefully have a wiki, a knowledge base, or set of documents somewhere that explain your processes and policies. If you don't, be a hero and get started on one. What are the current projects the ...


33

The crux of the problem is that with only a few notable exceptions, every phone ships with a fork of Android, not with the software written by Google. So Google can't push changes to Samsung's phones any more than FreeBSD can push changes to Apple's Macbooks. Android is Open Source, which is a bit unusual. This is the first time a major consumer operating ...


27

Threat reports routinely find that you are significantly more at-risk from your own colleagues than you are from outsiders. From this 2015 report, for instance, we have the following figures: 74% of breaches originate within the extended enterprise – either amongst employees (40%), third parties (22%) or ex-employees (12%) – with 26% originating ...


18

The official site is www.chiark.greenend.org.uk/~sgtatham/putty, you can find the download in the download section. If you want to play it safe, you can verify the signature of the download. In my opinion compiling it from source is as safe as downloading the binary and checking the signature (make sure to also verify the key itself with at least one ...


14

Well there's a couple of potential attack vectors which could be relevant. First up ports. Surprsingly some ATMs do indeed have USB ports and have been attacked via them (more info here as an example and also this CCC presentation on infecting ATMs with malware). However you'd hope that ATMs have decent physical security to help mitigate that class of ...


13

Yes, you do need to patch internal systems. Let's assume the following is true (which it probably isn't): your internal system is 100% impenetrable from the outside world (or you are fine with every internal system being taken over in case of a breach). you 100% trust everybody in your organization (or more accurately anybody with access to the intranet, ...


11

If a company were to actually patch all their systems, then Metasploit would have very little to offer in that environment. However, it's extremely common for companies not to patch all of their systems for any of a number of reasons: Bad inventory management -- some companies don't even know all the systems they have 3rd party software that's only ...


10

Patching addresses known risks while introducing unknown risks, like new unknown vulnerabilities, bugs, performance issues, etc. That's why places like banks wait a while to quantify the unknowns before patching. Patching is not something that should be done without a risk assessment. Do you leave known vulnerabilities in place because you fear ...


10

You can check "Deployment Activities" under "Software Deployment". A common method is to use a Load Balancer in-front of your services and redirect traffic accordingly. In a technique called "blue-green deployment", you redirect traffic from "blue" to "green" servers. This does not have any user-side downtime, provided of course that the application can ...


9

Personally I don't think that the support end of Windows XP, is such a great deal for embedded systems like ATMs. I gave a quite detailed answer to this here. It definitely matters for the consumer market, though. In regards to your question on how these things might get exploited, refer to this blog entry for a few examples from the past. I think you are ...


9

Auto-updates greatly improved security by fixing any non zero-day vulnerabilities. Most vulnerabilities only become known to the general public after a patch for it is released. Years ago, when auto-updates were not the norm, black-hat hackers used to reverse-engineer any security updates, found out what vulnerabilities they fixed, wrote exploits for it and ...


8

I doubt you'll find any virus which is completely benign (even fixing a vulnerability after exploiting it is still malicious behavior, even if it is intended to be beneficial), but there are plenty of examples of exploits which are. The most well-known would have to be jailbreak exploits, where a vulnerability in a proprietary and closed system is attacked ...


7

You could use nmap to get a better view of the (network)services it is running: nmap -sS -v <your_server> -sV -p1-65535 and lsof to view the current inbound/outbound connections to the box. lsof -i If there are no processes listening on any port then the server is reasonably safe. If new services are installed(i.e. ssh server) it is recommended ...


6

Your question is a good one as it is used by some marketing department to praise their own Linux distribution. Most often Linux distributions are not the patches authors: as their name states they are just distributing otherwise already existing content. A security vulnerability is discovered and notified privately to the software development team, The ...


6

I've been maintaining a private fork of a CMS for approx. 7 years. The initial release had some serious security issues which did not get fixed properly by the original vendor in time. This is why I have fixed it myself and this is where I have lost the compatibility to most of the original patches/upgrades. This is possible, it takes a lot of time. And it ...


6

For critical bugs, the PCI DSS 3.1 Quick Reference Guide covers this in no uncertain terms: 6.2: Protect all system components and software from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release. This is mirrored in the official documentation for PCI DSS 3.2 (I ...


6

To explain metaphorically: A firewall, in the usual meaning of a directional packet filter/NAT masquerading gateway, will keep the rest of the world from force feeding your "people" poison. It will also keep them from causing too much damage to the rest of the world if they go insane and violent in case someone still does poison them. Unless you keep them ...


6

Insecured Intranet-only services and applications are often the end-target of breaches. Sadly, more often than not over-confident (and dare I say naive) system/network admins) neglect to secure them. What if a normally trusted intranet user's machine contracts a virus, or trojan, or botnet malware, or what have you, that scans your intranet from within, and ...


6

Short answer: It erases the volatile memory, which is where the plug-ins are stored that you're referring to. This was what was doing the heavy-lifting of the malware. To fully get rid of malware, you are correct that the router's firmware will need to be upgraded or wiped and re-installed, but the malware referenced here used various plug-ins that lived ...


5

There are way too many factors to consider in your question. older software has had a chance to have its bugs discovered and fixed older software might have known bugs that have not been fixed or can't be fixed (famous IE examples over the years) newer software has not had a chance to have the same level of review and might have unknown bugs newer software ...


5

Windows security patches are now cumulative which means that each new patch should contain the previous month's security fixes. If you have any of the following patches installed you should be safe. May, 2017 Security Monthly Quality Rollup for Windows 7 (KB4019264) April, 2017 Preview of Monthly Quality Rollup for Windows 7 (KB4015552) April, 2017 ...


5

This question includes two parts: why we have so many bugs in the first place and why not all bugs gets detected and solved given enough time. Why we have software bugs Writing software takes resources, i.e. time, knowledge of developers and money. There is always a shortage of time (to go to market) and the number and experience of developers. Also, more ...


5

Software vulnerabilities is an issue that is difficult to mitigate with specific measurement unless it is fully tested. So no vendor can answer you such question unless they are very sure about the mitigation method using firewall. In fact, you should asked whether the patch will break your current application and process, whether it can be rolled back.


5

I cannot find any official statement from Adobe about the problem. But, Flash seems to have bytearrays shared between workers which are similar to SharedArrayBuffer in Javascript and probably can be used for high precision timing. Therefore I think that running Flash content can actually increase the risk of a Meltdown/Spectre attack. Still, given the ...


Only top voted, non community-wiki answers of a minimum length are eligible