Re:Disclosure of three 0-day iOS vulnerabilities
by smolder on Friday September 24, 2021 @12:56PM
(#28644973)
It would not certainly make everything more expensive. The cost of breaches is significant, though difficult to quantify, so the cost of effective prevention could be lower.
Re:Disclosure of three 0-day iOS vulnerabilities
by acdha on Friday September 24, 2021 @01:07PM
(#28645132)
That's _possible_ but fundamentally I'm looking at this from the perspective of requiring new work to be done by expensive people (infosec, dev, ops are all in-demand skills) — maybe some of that comes from changing team priorities, in which case the cost is less feature work, but in most cases I'd expect that to be hiring. There aren't many breaches which have direct costs greater than that because companies have been able to avoid penalties or compensation in most cases. If the cost of a breach was greater than, say, a year of free credit monitoring that calculation could change dramatically.
Ransomware has already changed this somewhat: now the cost is halting operations for a potentially lengthy period of time, and that has spurred a lot more awareness that the current model is insufficient but not from what I've seen significant efforts to change it.
Print Nightmare was part of a risky call in the printing subsystem design which was recognized as such when they made it in the 90s. That specific vulnerability was disclosed to Microsoft in 2020, accidentally disclosed in public in June, flailed at with incomplete patches and bad documentation all summer while ransomware gangs exploited it, and has theoretically finally been patched in the September release following multiple incomplete patches.
The Exchange auto discover bug announced yesterday had previously been reported with Microsoft telling the reporter that it wasn’t a bug. Oops.
This is hard but it’s also important to remember that this is an industry-wide failure because it’s been cheaper to clean afterwards than invest in proactive cleanup of old “stable” code, and it will likely continue as long as there are no financial consequences for a breach. Adding consequences would change that dynamic but would also be a massive change to the industry. It could endanger open source and would almost certainly make everything more expensive.