Author Archive

The number of vulnerabilities contained within production code is growing rapidly. As a result, organizations struggle to keep up with their patch management. This inability to patch vulnerabilities poses a significant threat to website security.

Organizations must adopt a more scalable approach to patch management in order to keep up with the growth of exploitable vulnerabilities. The use of prioritized patching and virtual patching are essential to minimize an organization’s exposure to cyber risks.

 

Vulnerability Numbers are Growing Rapidly

Software is written by human beings, and humans make mistakes. As a result, it should come as no surprise that software contains bugs. While some of these software errors are minor and have little or no impact on the software’s operations, this is not true of all of them. Some bugs are vulnerabilities that can be exploited by a malicious user to force the software to take actions not anticipated, intended, or desired by the software’s developer.

Over time, the number of these vulnerabilities that are discovered in production software are growing rapidly. In 2019 alone, 22,316 new vulnerabilities were discovered and publicly disclosed. Of these, over a third had a Common Vulnerability Scoring System (CVSS) v2 score of 7 or above, meaning that they are labeled as high severity.

Organizations Cannot Keep Up

As the number of software vulnerabilities grows, organizations can no longer keep up with their patching requirements (if they ever could). With over 22,000 new vulnerabilities discovered in 2019, over 60 new vulnerabilities are reported each day on average.

Not every newly discovered vulnerability will impact an organization since it will not be running every affected piece of software. However, determining if the organization is affected by any of the day’s 60 vulnerabilities and addressing the fraction that are relevant can create a significant burden for an organization.

For many organizations, patching a vulnerability is not as simple as allowing the update to run on every employee’s workstation. Several factors can affect the update process, including:

  • Vulnerability Location: If a vulnerability exists in production code, then addressing the issue could require a new software release. The new code must be created and fully tested before being deployed to production.
  • Patch Compatibility: Any software update may include deprecating some functionality provided by a program. If an organization’s existing software depends upon deprecated functionality, then applying a security patch may require a potentially expensive and time-consuming rewrite of the software.
  • System Stability: For organizations with high availability requirements, such as critical infrastructure, it is essential to ensure that a patch does not break any critical functionality. This requires extensive validation in a realistic test environment.

Not every vulnerability that exists within an organization’s systems or the software that it uses has these issues. However, every software update carries some overhead, no matter how small, and applying some updates requires significant time and resources. As the number of vulnerabilities to be addressed grows, organizations can quickly and easily fall behind in their patching processes.

Prioritized Patching is Essential

With the rapid growth of vulnerabilities, organizations cannot keep up and need to find a way to effectively manage their cyber risk. Patching every vulnerability is difficult or impossible, so vulnerabilities should be patched based upon the risk that they pose to the organization.

The risk associated with a vulnerability is usually quantified based upon two factors. These are the probability that the vulnerability will be exploited and the impact if an exploit occurs. The impact part of this equation is readily available for any vulnerability. The CVSS scoring system labels vulnerability severity as low, medium, or high in version 2 and low, medium, high, or critical in version 3.

The probability of exploitation can be more difficult to determine. Not all vulnerabilities are actively exploited by cybercriminals, meaning that a “critical” vulnerability on the CVSS scale may pose little or no real-world risk to an organization. Of the over 22,000 vulnerabilities disclosed in 2019, 37% of them had known exploit code or a Proof of Concept that would make it easy to develop a workable attack. Prioritizing these vulnerabilities in patching would be a good idea.

However, even more detailed information is available regarding the risk of certain vulnerabilities. In May 2020, the FBI and DHS CISA published a list of the top ten most exploited vulnerabilities over the last four years. This report indicated that cybercriminals commonly target Microsoft Office products, Apache Struts, and vulnerabilities within VPN products. Prioritizing these particular vulnerabilities – and generally any vulnerability in these types of software – enables an organization to dramatically decrease its risk of exploitation.

A Scalable Solution to Vulnerability Management

The problem with even a prioritized approach to vulnerability patching is that it is not a scalable or perfect solution to the problem. As the number of vulnerabilities in production software grows, organizations will be increasingly unable to keep up.

Virtual patching, a function offered by web application firewalls (WAFs) and runtime application self-protection (RASP), is a potential solution to this problem. Rather than applying patches to vulnerable applications, virtual patching trains the WAF or RASP solution to identify and block attempts to exploit the vulnerability. Since a virtual patching solution’s list of vulnerabilities is easier to update than the applications containing these vulnerabilities, this provides a more scalable solution to organizations’ vulnerability management problem.

DTG: Originally posted at datechguyblog.com on Dec 31st 2016 2nd of 3 special re-posts. This one replacing Baldilocks Tuesday evening post which will return in 2021.

This is the 2nd of three guest posts I did for Ladd Ehlinger’s site back in late 2011.  I’m reprinting them here (With Ladd’s permission) because I think the election of Donald Trump is a significant event in the culture wars and these posts (and the follow ups that I intend to write) serve to explain what happened to our friends on the left who are still pulling out their hair over the events of November.  While Ladd’s old blog isn’t there you can find the original piece via the wayback machine.

One of the things about the passage of time is that it changes perspective.

In the 50’s the producers of the British TV series The Adventures of Robin Hood used Ring Lardner Jr., unwelcome in the US for TV capposter1work due to his communist connections (which he stated as late as 1987 he did not regret) under an assumed name to write episodes that he gleefully described as attacks on Capitalism. When viewed today, however, these stories that supposedly celebrated collectivism instead come across as a love letter to the Catholic Church and a bastion against tyranny. A message that modern liberals, normally happy to view Lardner’s work, do not appreciate.

This dynamic comes to mind when examining the 1937 pictureCaptains Courageous starring Spencer Tracy, Freddie Bartholomew and Lionel Barrymore.

Let’s look at the IMDB summary of the plot:

Harvey Cheyne is a spoiled brat used to having his own way. When a prank goes wrong on board an ocean liner Harvey ends up overboard and nearly drowns. Fortunately he’s picked up by a fishing boat just heading out for the season. He tries to bribe the crew into returning early to collect a reward but none of them believe him. Stranded on the boat he must adapt to the ways of the fishermen and learn more about the real world.

It sounds like a liberal wet dream: A rich kid, one of the 1%, throwing his weight around and oppressing his schoolmates, made to see how the other half lives and taken off his high horse. Give that summary to a liberal film teacher who hasn’t seen it and they will book a showing in their classroom faster than you can say “racist tea party”.

Alas poor liberals, it turns out the movie is chock full of conservative themes and highlights modern liberal foibles.

You would think the early scenes showing poor little rich kid Harvey (Freddie Bartholomew) throwing his weight around in school, at the school paper and playing on other student’s fears of joblessness to be full of promise for our instructor, but unfortunately Harvey seems to resemble a Harvard yard occupod, a member of the elite, a child who has never been disciplined or told “no”. That resemblance hits too close to home for our socialist instructor, the vision of too many campus protesters come to mind.

It takes a plan gone wrong for his widower father (Melvyn Douglas) to bluntly inform Harvey that his sobbing act will no longer work. Determined to get more involved in his son’s life, he includes him on a trip to Europe by steamship where, as he hides over horseplay, he promptly falls overboard. If he had drowned our instructor could have talked about the bad karma of wealth but instead Manuel Fidello (Spencer Tracy) a fisherman from the Schooner We’re Here, out of Gloucester Massachusetts, fishes him out of the water and takes him aboard the ship and the Movie shifts.

Once again our instructor has hope, our rich kid is among the common men, the 99%.

At first the Captain (Lionel Barrymore) is willing to let Harvey’s attitude go and offers to make him part of the crew beside his son Dan (Mickey Rooney). He refuses to work, he starts ranting about sending the entire crew to jail unless they take him to New York, disrupting the ship.

Remind you of any group of people protesting in the streets lately? Remind you of an entire generation of children who will have what they want when they want it from their $600 iPhones to the latest video games? Our film instructor is torn seeing a mirror and not liking the reflection, and that’s where one of the pivotal moments in the film takes place.

Captain Troop, with the good of the ship and the livelihood of the entire crew to worry about, notes he can’t risk months of fishing on a boy’s yarn. When Harvey still rants Troop finally concludes: “I guess there’s nothing left for it.” He rears back and gives Harvey a slap that knocks him flat. Harvey for perhaps for the first time in his life doesn’t know what to say:

You HIT me!

“Now you just sit there and think about it.”

It is here, with the establishment of discipline, that the movie begins to shift. Harvey gets out of the way a bit but still refuses to work. The crew believes that Harvey is a “Jonah” because he is a passenger and not a crew member insisting Manuel do something about it as he fished him out. Manuel reluctantly takes him under his wing and slowly through trial and error begins teaching him the realities of life.

Harvey, now given direction and discipline for the first time in his life, slowly warms to Manuel as a father figure and mentor and Manuel, still missing his father, warms to him. The situation comes to a head as Manuel and Long Jack (John Carradine) get into an argument over hand lines vs. a trowel. Manuel wagers his new razor vs half a buck that that he and Harvey can out-catch LongJack and his partner Nate. When Harvey manages to catch a halibut Manuel is proud like a father, but Harvey apparently Harvey hasn’t shaken his old scheming habits.

Disappointed, Manuel brings Harvey back to the ship and finishes the day fishing alone. Easily losing his bet, he brings his razor in payment to Longjack who stayed out fishing despite injuries, and hooks in his skin from his tangled trowel. He insists someone had fouled his lines. Manuel tries to laugh it off but as Longjack gets angrier Harvey steps in, admitting what he’s done not just to Longjack and the crew. When Jack prepares to go after him Manuel is ready to throw down.

From this point he begins to earn the crew’s respect and begins to learn the ways of a fisherman. We see the boats at the final fishing area rushing to fill their holds and sail for home. Troop seemingly fills his hold first, but his arch rival Walt Cushman as we have seen a few times before, has stolen a march on him and the race for port is on. Both ships cram on all possible sail, and after a game of chicken it looks like Troop has the race won, when tragedy strikes.

Spencer Tracy death scene

Here again, we see a different set of values.

Manuel doesn’t rage against fate, he doesn’t blame Troop or the race, telling his captain that he’ll beat Walt Cushman next year. He simply accepts his fate, says goodbye to Harvey, declares that he’s going to see his father, and then drowns.

Here is a person, comfortable, well off, pampered and well educated, a person told all his life how special he is and given what he wants when he wants it. As if that isn’t enough he has just managed one of the most miraculous feats of luck that one can achieve, being rescued after falling overboard on an ocean liner in the dark in the middle of the ocean without even a life jacket. What is his response to his good fortune? Anger, indignation and demands, after all… he’s entitled.

The end is almost anti-climatic; the ship gets home, and Harvey’s father is informed by wire that he’s alive. He flies back from Europe to find a son changed and matured from hard work and discipline. After a memorial service to the sailors who did not survive the fishing season they head home.

Pity our poor liberal film teacher who can take no pleasure in this picture.

Not from the spectacular visuals of the ships and sailing nor of the performances from a fine cast such including Lionel Barrymore in one of his last roles on two legs, child Star Freddie Bartholomew, who managed a normal life when all was said and done, A young Mickey Rooney, already with ten years under his belt in film and the only actor in history to appear in movies made in 10 different decades, John Carradine, one of the most prolific actors of all time, and of course, Spencer Tracy, in the role that would earn him the first of back-to-back Academy Awards.

Even with all of this history, our instructor is stuck with a picture advancing conservative values, hard work and personal responsibility. Our instructor isn’t even able to take solace in the bringing down of a rich kid, since the catalyst of this entire process is an act that would shock the modern sensibilities of the instructor, who would have had the captain brought up on charges in an instant. In fact, the very concept of a pre- teen like Harvey doing such menial work has been a line of attack on a presidential candidate who dared suggest that those who don’t have the model of a work ethic needed such an example.

Perhaps with a different election cycle it will be less painful, but the illustration and the parallels showing that our friends on the left just are no longer connected with the common man.

That’s why in universities both history and classic film are things the left will want to keep on the shelf.

So let me get this straight:

The NYT & the MSM don’t have a problem with Doxing (that is giving out the home address of) Tucker Carlson.

https://platform.twitter.com/widgets.js

The Democrats Mayors are united in demanding the President Trump not send in or remove the Department of Homeland Security in cities where they’ve been deployed protect federal property (like Portland Oregon) as they cede control of their cities to the mob:

https://platform.twitter.com/widgets.js

BUT we are told by these same people that when strangers call their house to ask them who they are going to vote for, any suggestion that a large cross section of GOP voters in general and Donald Trump supporters in Particular are not being forthcoming is nonsense.

Seriously?

Note DTG: This “re-post” was originally put on my own site on 12/9/2016 but with the current culture wars in full swing and Pat Austin out for the day I thought it was a good time to move it to the new site. I’ll “re-post” parts 2 and 3 later this week. (note corrected some “meh” sentences in the manly virtue paragraph by adding “It’s celebrated when” in three sentences when it was left out.

This is the first of three guest posts I did for Ladd Ehlinger’s site back in late 2011.  I’m reprinting them here (With Ladd’s permission) because I think the election of Donald Trump is a significant event in the culture wars and these posts (and the follow ups that I intend to write) serve to explain what happened to our friends on the left who are still pulling out their hair over the events of November.  While Ladd’s old blog isn’t there you can find the original piece via the wayback machine.

“The trouble is you don’t want a man for a husband! You want a coward who will run out on his friends! Well, that’s not me, never was, and never will be. I don’t care how much I love you! And I do very much. I’m a soldi… I mean I’m a man first!”

gungadinposterEven a person with a casual knowledge of movies knows the number 1 movie of 1939, because “Gone with the Wind”is the highest grossing movie of all time. If you asked them what picture was number 2 that year, odds are they haven’t heard of RKO’s “Gunga Din”.

A 70 year old action picture is unlikely to generate a lot of interest from the denizens of the CGI-YouTube era and with the left practically owning film studios, a period piece depicting the British Empire suppressing a murderous cult in colonial India is not going to be high on the view lists of professors.

This is a shame because it’s a movie that deserves attention from viewers, not only for conservative themes, but on its technical merits, historical influence, strong cast and the story itself.

First, one can’t watch this movie without seeing shades of pictures from “Indiana Jones” to “Butch Cassidy and the Sundance Kid”. When viewed by the unaware, the reaction is much like that of a teen who has watched “Family Guy”for years who sees the opening of “All in the Family” for the first time.

Second, consider the scale of the film. Over and over you see groups of hundreds of men in formation, both marching and on horseback with great sweeping views over spectacular landscapes. For people used to CGI it’s quite a change to see real people and real animals reacting in real ways. This is 1939. What we would call “computers” were two to six years in the future and where they would exist was the size of Cuba. If you wanted a shot of a group of men charging on horseback, you needed…a group of men charging on horseback, if you wanted an incredible background vista, you either had to have incredible background paintings, or actually shoot at a such a location. And a fall off a roof meant someone actually had to take that fall or you needed good modeling. For the modern filmmaker or student used to manipulating massive groups with a click of a mouse, the concept of having to control hundreds of men and animals for a shot is way above their pay grade.

Third, check out this cast: Douglas Fairbanks Jr.; a legendary name who, in a few short years after this film would match his on screen valor in actual combat. Victor McLaglen; a two time Oscar winner who had faced two heavyweight champions in the ring and fought in Iraq before he ever appeared in front of a camera, and Cary Grant, acknowledged as one of the greatest actors who ever lived. Talk about holding three aces in a hand.

Finally there is the story, and what a story: After a patrol and a village drops off the map a force is needed to repair the telegraph lines and investigate. Three sergeants freshly pulled from a brawl are assigned to lead the party which includes a regimental bhisti (water bearer) named Gunga Din. While the troops begin repairing the line at the village the sergeants start searching the village and come across some suspicious characters whose arrest is a prelude to an ambush.

After a running fight the sergeants get their surviving troops out and report. Their commanding officer recognizes a captured weapon as a sign of the murderous thuggee cult that the British had suppressed decades ago (funny how things like the thuggee cult, the slave trade, Caribbean piracy and Suttee were all suppressed only by the actions of those evil colonial Brits)

A new advance force is prepared sans Ballantine, (Fairbanks Jr.) who is due to marry and leave the army in six days. In a hilarious scene, Cutter (Grant) & MacChesney (McLaglen) manage to temporarily incapacitate his replacement forcing Ballantine into the expedition. When they reach the village and set camp, Cutter, after being locked up to prevent it, sets off to find a temple of gold that Din, (Sam Jaffe) who dreams of being the company bugler, has told him is nearby. Din and Cutter find the temple beyond a mountain pass which turns out to be the base of a thuggee army they are looking for led by the cult leader (well played by Eduardo Ciannelli). Cutter prepares to send Din back to get with the exit blocked deliberately gets himself captured to clear the way.

With the prospect of his friend in deadly danger, MacChesney sets off with Din after him. Ballantine, end of enlistment or not, insists on joining them over the entreaties of his fiance. (Joan Fontaine, the only cast member still alive). They blunder right into the Guru’s trap hoping to lure the regiment to an ambush in the pass.

The following passages contain major spoilers, if you don’t wish to know how the movie ends, skip the following two paragraphs.

The heroes manage by means of a ruse to grab the guru and find themselves in a Mexican standoff that persists until the guru, after a speech that could have been made by any of the heroes in the pictures, sacrifices himself in order to allow the attack to go forward. With their hostage gone the thuggees take the Brits, bayonetting both Din and Cutter in the process.

The thuggees ignore the wounded Cutter and Din and drag Ballantine & MacChesney to the edge of the parapet to watch the ambush of their regiment. As the guards concentrate on their impending victory, Din, still bleeding from his wounds with bugle in hand slowly climbs to the top of the temple dome and blows “stand to arms”. He is shot down but he manages it long enough for the regiment to deploy, avoiding the trap and allowing the army to rout the thuggees. Din is given a hero’s burial and posthumously made a regimental corporal listed “on the rolls of our honored dead.”

Through the entire picture manly virtue is celebrated: It’s celebrated when the survivors of the first battle, after an arduous trek bearing their wounded, form to march into the camp parade in good order. It’s celebrated as Din, with Cutter’s support, dreams of being a soldier instead of a water bearer. It’s celebrated when Cutter allows himself to be taken so Din can give warning.  It’s celebrated when  Ballantine refuses to leave his friend in the lurch even for the woman he loves. It’s celebrated when Cutter and MacChesney endure torture. and when Din gives his life to warn the regiment.  It’s even celebrated when the villain of the piece sacrifices himself in the hope of victory for his cause.

These manly values are not only conservative values, but are instinctive human values that since 9/11 the left has been unable to suppress. It certainly isn’t matched by the left protesters who cry oppression if they are evicted from other people’s property at little personal risk.

But what about colonial cultural inequality? I’m glad you asked, let’s look at the first battle scene again.

While the men are repairing the telegraph wires (and given water by Gunga Din) the sergeants search the village for clue to what happened. Ballantine finds a first a single man then a group he is trying to conceal. When they fail to convince him they are poor villagers who survived the raid, one tries to jump him. He finds himself in an outnumbered brawl. Cutter and MacChesney enter, and rather than drawing weapons join in the brawl till the men are subdued. Our politically correct friends might point to this one might question one European handling a group alone, but only if they didn’t pay attention to the larger British group they handled at the film’s start. When they fail to provide adequate answers, they prepare to take them back when the leader lets out a cry signaling a group of snipers on rooftops to fire and a wave of riders to pounce upon them.

The entire British force other than the sergeants consists of Indian troops, yet nowhere in the scene from the start to the end is there any sense that these troops are different than any other. They fight as a unit, throughout the running battle and retreat through and over the rooftops the town against overwhelming odds. The sergeants lead from the front, take the biggest risks and you will note are the last to make the jump that predated Redford and Newman’s by 30 years. Just before the last of them jumps, he checks on a fallen private soldier to see if he’s can be saved, and when the survivors march into camp, they march in together with heads held high.

There was a time when this message was the norm, and it’s not a coincidence that it was also the time of the greatest generation. When we ceded the culture wars we ceded our message, the message of Judeo Christian values, the message of a shared culture and belief in not only right and wrong but what makes a culture and a people thrive as our forefathers did. If we are unwilling to fight the culture wars by supporting our own cultural message, then we need to remember those who already did so effectively in years gone by.