I’ve been in IT my entire adult life. There is generally two mantras to IT.
- “If its not broken, don’t fix it.”
- “Update often.”
“If its not broken, don’t fix it.”
You know the people I’m talking about. “My uptime on this system is 1287 days! It is rock solid!”
I get it. Its great to have a system you can rely on. Stability and system uptime is the holy grail. You want your systems to be 100% available because that means you can focus your time on more important tasks than break/fix.
These people are also a security expert’s nightmare. Vulnerabilities get exposed and new exploits are created regularly. Its not enough to protect your perimeter anymore, you have to protect every aspect of your environment.
This mantra has outlived its usefulness. Uptime of 1287 days on a system is no longer a badge of honour, its downright scary. We’re not talking highly available services here where you can take individual components down to patch them, we’re talking those individual components themselves.
“Update often.”
Update often is the only mantra that matters anymore. Whether its firmware, drivers, system patches, version upgrades, etc. All these need to be examined on a regular basis, or you flirt with disaster.
Many security updates are no longer clearly specified or able to be applied individually - they are simply bundled with the next release version. If you’re lucky, release notes contain notes about these vulnerabilities being patched, but not all do. If a vulnerability was disclosed privately to a organization, they may silently fix the offending code and no one would be the wiser.
Major companies do this regularly, and at times only disclose the vulnerability after its been patched and released for a long while. Don’t believe me? Pay attention to CVE releases and check to see which versions they were patched in, you may be surprised to see the patched version was released weeks/months back.
Note I’m not advocating for bleeding edge all the time in every circumstance. You need a plan. You need to analyze your compatibility matrices. But you do need to upgrade eventually, that’s just life as we know it now in IT. The days of “If its not broken, don’t fix it” are over, because it is broken, you just haven’t realized it.
So check your OS’s, servers, switches, routers, storage arrays and if you have IOT devices, perhaps even your fridges. Check your services. Are you patched?
