I have been thinking about this for sometime now, if finding the vulnerability first is the new security trend?
After browsing through various public vulnerability exploit database, my answer to the question was simple to find.
First lets find a vendor whose application is vulnerable and check when exactly it was publicly available. Let's check IE
Let's check when when it became public. Published on 24th of June2014.
Let's now check when vendors in the market has released a patch for the same:
When was it exactly?
Cool, our customers are safe even before it was public!!!
(only if they have applied it in IPS policy....this makes me realize how many customers are really following these vulnerabilities and applying them timely. Or what if we can automate these new fixes based on policy they have applied. I am sure most vendor should have implemented long ago.)
After browsing through various public vulnerability exploit database, my answer to the question was simple to find.
First lets find a vendor whose application is vulnerable and check when exactly it was publicly available. Let's check IE
Let's check when when it became public. Published on 24th of June2014.
Cool, our customers are safe even before it was public!!!
(only if they have applied it in IPS policy....this makes me realize how many customers are really following these vulnerabilities and applying them timely. Or what if we can automate these new fixes based on policy they have applied. I am sure most vendor should have implemented long ago.)
No comments:
Post a Comment