My last gig was as a CIO in a fairly large organization and we had stringent infosec requirements due to the industry we were in. Old operating systems and software are absolutely an issue, although it still doesn’t stop some companies from running them.
Most of the malware going around exploits patched vulnerabilities. It literally takes seconds and not exactly a high skill level to compromise a machine that’s missing security updates. Regular patching is without a doubt one of the best controls you can have in place. The other big issue was social engineering. If you don’t effectively tackle those two things it doesn’t matter what else you do because you will be breached.
Besides that, you’re mostly right. We were all over the security updates but didn’t care for other upgrades because they introduce instability. It’s the last thing you want with thousands of endpoints and a bunch of shitty enterprise apps. Run it until the wheels fall off or it’s approaching EOL for security updates.
Oh sorry if it came across as old software not being a security issue just that most places don’t care or plan around it (those ATMs running XP are running a very stripped and locked down version).
I remember quite a few places paying extra for a little bit longer for updates just due to how rough the change was going to be. I think most of the time when something did go wrong at a place it was (in this order):
Social engineering
Some sort of update that was not tested enough (or at all)
A new roll out going bad (this happened way more then it should have)
Hardware failure (often because a sales guy did not know the difference between “redundancy” and “reduced failure rate”
Actual disaster (I remember getting calls about a bank networking device calling home with fan errors as the building it was in was floating down the river)
My last gig was as a CIO in a fairly large organization and we had stringent infosec requirements due to the industry we were in. Old operating systems and software are absolutely an issue, although it still doesn’t stop some companies from running them.
Most of the malware going around exploits patched vulnerabilities. It literally takes seconds and not exactly a high skill level to compromise a machine that’s missing security updates. Regular patching is without a doubt one of the best controls you can have in place. The other big issue was social engineering. If you don’t effectively tackle those two things it doesn’t matter what else you do because you will be breached.
Besides that, you’re mostly right. We were all over the security updates but didn’t care for other upgrades because they introduce instability. It’s the last thing you want with thousands of endpoints and a bunch of shitty enterprise apps. Run it until the wheels fall off or it’s approaching EOL for security updates.
Oh sorry if it came across as old software not being a security issue just that most places don’t care or plan around it (those ATMs running XP are running a very stripped and locked down version).
I remember quite a few places paying extra for a little bit longer for updates just due to how rough the change was going to be. I think most of the time when something did go wrong at a place it was (in this order):