Default title

EXPLOIT WEDNESDAY

PATCH TUESDAY IS NOW FOLLOWED BY EXPLOIT WEDNESDAY

For years we were satisfied that within a couple of weeks after Patch-Tuesday the latest rounds of patches would go through deployment and stability testing then be applied to production systems in due time.

THIS WAS ACCEPTABLE UNTIL RECENTLY

Over recent months, using advanced reverse engineering technologies Advanced Persistent Threat organizations have been effectively using the patch releases for Microsoft Products against the very users of the products being patched. This significant change in posture is forcing organizations to shrink patch testing windows considerably and push more patches into production with less and less testing. While this of course is riskier behavior, security is always a balance of risk.

If you haven't reviewed your organizational patch management strategies recently it might be time to consider updating your policies. Automated Patch Deployment and Patch Testing systems are available to ensure organizations aren't unknowingly accepting risks that are completely avoidable. When was the last time you verified that all your servers and workstations were up to date. Have you verified that all patches were being applied to all needed software systems successfully, not every update can be applied using Windows Update.

IT SECURITY IS ABOUT DISPENSING WITH PRECONCEPTIONS AND BECOMING AWARE OF CHANGING REALITIES

Talk with ALT* about how our Managed Service Solutions can solidify your patch management strategies and help secure your business operations. We would be happy to review your systems and help evaluate and reduce your technology risks.

RECENT THREAT POSTS

- Tara Seals
Attackers gain read-only permissions to snoop around Office 365 accounts, including emails, contacts and more.
- Lindsey O'Donnell
The Android malware comes from threat group APT-C-23, also known as Two-Tailed Scorpion and Desert Scorpion.
- Tara Seals
The cybercrooks spread the COVID-19 relief scam via Telegram and WhatsApp, and ultimately harvest account credentials and even pics of IDs.
- Lindsey O'Donnell
Despite Microsoft issuing patches almost eight months ago, 61 percent of Exchange servers are still vulnerable.
- Tom Spring
Popular ‘safe browsing’ padlocks are now passe as a majority of bad guys also use them.
- Tara Seals
The attempted compromises, which could allow full control over Active Directory identity services, are flying thick and fast just a week after active exploits of CVE-2020-1472 were first flagged.
- Aamir Lakhani
Botnets and IoT devices are forming a perfect storm for IT staff wrestling with WFH employee security.
- Tara Seals
A researcher said he discovered an open data cache with names, grades, birthdates and more, after the Clark County School District refused to pay the ransom.
- Tom Spring
Threatpost's latest poll probes telehealth security risks and asks for IT cures.
- Lindsey O'Donnell
Researchers warn of emails pretending to help business employees upgrade to Windows 10 - and then stealing their Outlook emails and passwords.

Archives

Leave a Reply

Your email address will not be published. Required fields are marked *

one × one =