full-disclosure - Re: Getting Off the Patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110119150854.GK11487@kevin>
Date: Wed, 19 Jan 2011 07:08:54 -0800
From: cpolish@...ewest.net
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Getting Off the Patch

Cor Rosielle wrote:
> I don't agree with the statement: "From a security standpoint, patching is
> better than not patching.  Period.".
> 
> Sometimes patching is the right solution, often it is not. Since some asked
> experiences from larger companies, here is one:
<snip>
> I did not know about the OSSTMM in those days. If I did, I could have
> explained why patching is not always the best solution: it interferes with
> your operations. And if it influences you operations, you better control it.
> Not blindly execute it and install the patch using an automated update
> process, but actually control it. 
<snip>

Here's another factor to consider: with $VENDOR's kit you can't
get support unless all the released patches are in place.
$VENDOR doesn't field the resources to support n differently
patched systems in the field; they're already coping with n
different *configurations* of their product. At our shop some
vendors are more critical re support than others so there's not
a blanket policy. Management would not be amused if $SYSTEM was
down but wasn't in a $VENDOR-supported state. This isn't
theoretical - it happened, it was ugly, it came with extended
downtime. 

TLDR: site patching policy is not always homogenous.

-- 
Charles Polisher

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/