The most common way in
isn’t some brilliant new attack.
It’s a known hole, with a known fix,
that nobody got around to applying.
The patch existed.
We just hadn’t installed it yet.
“We’ll update later” always sounded reasonable.
It just means “we’ll stay open for now.”
I used to find patching tedious.
Then I sat through a postmortem
for a vulnerability that had been fixed for months —
everywhere except our servers.
Tedious is fine.
Tedious is cheaper than the meeting after.
Now I update the boring thing on time.
– Serguey Asael Shinder
Leave a Reply