Re:Equifax Releases Details on Cybersecurity Incident, Annou...
by cmiles74 on Saturday September 16, 2017 @08:13AM
(#15264282)
I disagree with the fatalist tone. Sure, it can be hard for big, slow moving businesses to take a time out from writing million dollar checks to C-suite executives to spend money on a competent operations and security team. But it can happen and in this case it should have happened.
I don't think "better architecture" is handwavy. If you have old legacy apps that can't be updated and maintained, don't provide them with a path to the public internet. Or front then with some infrastructure and adequate alarms to detect something going wrong.
I think it's reasonable to respond to a CVE with an update to your app or infrastructure within one week. Most of the time rapid testing will be fine as your patching a library or component, like Struts or Tomcat.
These companies are hardly providing 100% uptime, in the case where an update like this needs a rollback, it won't be a big deal. If you have a good team and you spend the money on them.
I don't think "better architecture" is handwavy. If you have old legacy apps that can't be updated and maintained, don't provide them with a path to the public internet. Or front then with some infrastructure and adequate alarms to detect something going wrong.
I think it's reasonable to respond to a CVE with an update to your app or infrastructure within one week. Most of the time rapid testing will be fine as your patching a library or component, like Struts or Tomcat.
These companies are hardly providing 100% uptime, in the case where an update like this needs a rollback, it won't be a big deal. If you have a good team and you spend the money on them.