Default title

EXPLOIT WEDNESDAY

PATCH TUESDAY IS NOW FOLLOWED BY EXPLOIT WEDNESDAY

For years we were satisfied that within a couple of weeks after Patch-Tuesday the latest rounds of patches would go through deployment and stability testing then be applied to production systems in due time.

THIS WAS ACCEPTABLE UNTIL RECENTLY

Over recent months, using advanced reverse engineering technologies Advanced Persistent Threat organizations have been effectively using the patch releases for Microsoft Products against the very users of the products being patched. This significant change in posture is forcing organizations to shrink patch testing windows considerably and push more patches into production with less and less testing. While this of course is riskier behavior, security is always a balance of risk.

If you haven't reviewed your organizational patch management strategies recently it might be time to consider updating your policies. Automated Patch Deployment and Patch Testing systems are available to ensure organizations aren't unknowingly accepting risks that are completely avoidable. When was the last time you verified that all your servers and workstations were up to date. Have you verified that all patches were being applied to all needed software systems successfully, not every update can be applied using Windows Update.

IT SECURITY IS ABOUT DISPENSING WITH PRECONCEPTIONS AND BECOMING AWARE OF CHANGING REALITIES

Talk with ALT* about how our Managed Service Solutions can solidify your patch management strategies and help secure your business operations. We would be happy to review your systems and help evaluate and reduce your technology risks.

RECENT THREAT POSTS

- Lindsey O'Donnell
Amazon Dismisses Claims Alexa ‘Skills’ Can Bypass Security Vetting Process
Researchers found a number of privacy and security issues in Amazon's Alexa skill vetting process, which could lead to attackers stealing data or launching phishing attacks.
- Tara Seals
Stalkerware Volumes Remain Concerningly High, Despite Bans
COVID-19 impacted volumes for the year, but the U.S. moved into third place on the list of countries most infected by stalkerware.
- Elizabeth Montalbano
Lazarus Targets Defense Companies with ThreatNeedle Malware
A spear-phishing campaigned linked to a North Korean APT uses “NukeSped” malware in cyberespionage attacks against defense companies.
- Becky Bracken
Yeezy Fans Face Sneaker-Bot Armies for Boost ‘Sun’ Release  
Sneaker bots ready to scoop up the new Yeezy Boost 700 “Sun” shoes to resell at a huge markup.  
- Lindsey O'Donnell
Malware Gangs Partner Up in Double-Punch Security Threat
From TrickBot to Ryuk, more malware cybercriminal groups are putting their heads together when attacking businesses.
- Lindsey O'Donnell
Podcast: Ransomware Attacks Exploded in Q4 2020
Researchers said they saw a seven-times increase in ransomware activity in the fourth quarter of 2020, across various families – from Ryuk to Egregor.
- Pat Cooper
Protecting Sensitive Cardholder Data in Today’s Hyper-Connected World
Retailers that lacked significant digital presence pre-COVID are now reaching new audiences through e-commerce sites that are accessible anytime, from anywhere, on any device.
- Becky Bracken
Cyberattacks Launch Against Vietnamese Human-Rights Activists
Vietnam joins the ranks of governments using spyware to crack down on human-rights defenders.
- Elizabeth Montalbano
Health Website Leaks 8 Million COVID-19 Test Results
A teenaged ethical hacker discovered a flawed endpoint associated with a health-department website in the state of Bengal, which exposed personally identifiable information related to test results.
- Lindsey O'Donnell
Malicious Mozilla Firefox Extension Allows Gmail Takeover
The malicious extension, FriarFox, snoops in on both Firefox and Gmail-related data.

Archives

Leave a Reply

Your email address will not be published. Required fields are marked *

two + 2 =