I saw in my old line of work that most business over a certain size just have a few key programs that need to work and could not give two shits about whatever new OS was out if it could not run those programs. The fact that in places like the banking sector many of the programs are UNIX era and need emulation just to use on a desktop and not being spied is often a requirement it would make no sense what so ever to upgrade. I have also seen an uptick in Linux and Mac workstations as both are looking more attractive then the wild ride windows has become.
Oh and in case people think security on older OS is a concern for companies I know for a fact that several ATMs in north America are still running on XP (upgraded about 7 years ago from 2000).
My last gig was as a CIO in a fairly large organization and we had stringent infosec requirements due to the industry we were in. Old operating systems and software are absolutely an issue, although it still doesn’t stop some companies from running them.
Most of the malware going around exploits patched vulnerabilities. It literally takes seconds and not exactly a high skill level to compromise a machine that’s missing security updates. Regular patching is without a doubt one of the best controls you can have in place. The other big issue was social engineering. If you don’t effectively tackle those two things it doesn’t matter what else you do because you will be breached.
Besides that, you’re mostly right. We were all over the security updates but didn’t care for other upgrades because they introduce instability. It’s the last thing you want with thousands of endpoints and a bunch of shitty enterprise apps. Run it until the wheels fall off or it’s approaching EOL for security updates.
Oh sorry if it came across as old software not being a security issue just that most places don’t care or plan around it (those ATMs running XP are running a very stripped and locked down version).
I remember quite a few places paying extra for a little bit longer for updates just due to how rough the change was going to be. I think most of the time when something did go wrong at a place it was (in this order):
Social engineering
Some sort of update that was not tested enough (or at all)
A new roll out going bad (this happened way more then it should have)
Hardware failure (often because a sales guy did not know the difference between “redundancy” and “reduced failure rate”
Actual disaster (I remember getting calls about a bank networking device calling home with fan errors as the building it was in was floating down the river)
For sure social engineering. That eventually becomes the most serious threat. The jackpot is getting to a user. They are the ones with access to money, confidential data, etc. and it often won’t set off alarms because it doesn’t look out of the ordinary. Get them to do something on your behalf or grab their credentials and you basically get to bypass security.
Yeah no way to make an alarm for say looking at their own confidential files. The key to social engineering working is having someone stupid with credentials, and you can not fix stupid. Oddly enough a lot of the issues I saw where on the call centre side (I guess paying people nothing to do that job may have been a mistake). Then again you you get access to a single helpdesk person you get a silly amount of access everywhere.
You’d be surprised at how effective some hackers are. I was in an industry where we generally employed smart and educated people. I always told them the person on the other side doesn’t eat if they don’t fool someone. We would push education and protocols. For example, multiple approvals for a wire transfer over different channels and verbal verification of the account number after positive identification.
These people are submitting phony job applications with infected resumes. They email back and forth posing as a prospective client and will even talk on the phone before sending infected documents. They send fake invoices. They call the help desk. They forge checks. They try impersonation wire transfer scams. They send you fake marketing type packages or gifts with infected USB drives. They try to set up bogus interviews for articles or award nominations and pump you for information. They pose as vendors like printer repair. Or someone with some bullshit excuse asking an office manager in a remote office to unlock the server room. Some asshole showed up once and tried to get a receptionist to plug in a thumb drive. They will try to exploit every function of an organization. They are relentless and whenever you think you’ve seen it all there’s something new.
Windows XP is also not actually that insecure. You just have to not download malware really. It’s not like just having an XP machine gives hackers free reign by default.
I saw in my old line of work that most business over a certain size just have a few key programs that need to work and could not give two shits about whatever new OS was out if it could not run those programs. The fact that in places like the banking sector many of the programs are UNIX era and need emulation just to use on a desktop and not being spied is often a requirement it would make no sense what so ever to upgrade. I have also seen an uptick in Linux and Mac workstations as both are looking more attractive then the wild ride windows has become.
Oh and in case people think security on older OS is a concern for companies I know for a fact that several ATMs in north America are still running on XP (upgraded about 7 years ago from 2000).
My last gig was as a CIO in a fairly large organization and we had stringent infosec requirements due to the industry we were in. Old operating systems and software are absolutely an issue, although it still doesn’t stop some companies from running them.
Most of the malware going around exploits patched vulnerabilities. It literally takes seconds and not exactly a high skill level to compromise a machine that’s missing security updates. Regular patching is without a doubt one of the best controls you can have in place. The other big issue was social engineering. If you don’t effectively tackle those two things it doesn’t matter what else you do because you will be breached.
Besides that, you’re mostly right. We were all over the security updates but didn’t care for other upgrades because they introduce instability. It’s the last thing you want with thousands of endpoints and a bunch of shitty enterprise apps. Run it until the wheels fall off or it’s approaching EOL for security updates.
Oh sorry if it came across as old software not being a security issue just that most places don’t care or plan around it (those ATMs running XP are running a very stripped and locked down version).
I remember quite a few places paying extra for a little bit longer for updates just due to how rough the change was going to be. I think most of the time when something did go wrong at a place it was (in this order):
For sure social engineering. That eventually becomes the most serious threat. The jackpot is getting to a user. They are the ones with access to money, confidential data, etc. and it often won’t set off alarms because it doesn’t look out of the ordinary. Get them to do something on your behalf or grab their credentials and you basically get to bypass security.
Yeah no way to make an alarm for say looking at their own confidential files. The key to social engineering working is having someone stupid with credentials, and you can not fix stupid. Oddly enough a lot of the issues I saw where on the call centre side (I guess paying people nothing to do that job may have been a mistake). Then again you you get access to a single helpdesk person you get a silly amount of access everywhere.
You’d be surprised at how effective some hackers are. I was in an industry where we generally employed smart and educated people. I always told them the person on the other side doesn’t eat if they don’t fool someone. We would push education and protocols. For example, multiple approvals for a wire transfer over different channels and verbal verification of the account number after positive identification.
These people are submitting phony job applications with infected resumes. They email back and forth posing as a prospective client and will even talk on the phone before sending infected documents. They send fake invoices. They call the help desk. They forge checks. They try impersonation wire transfer scams. They send you fake marketing type packages or gifts with infected USB drives. They try to set up bogus interviews for articles or award nominations and pump you for information. They pose as vendors like printer repair. Or someone with some bullshit excuse asking an office manager in a remote office to unlock the server room. Some asshole showed up once and tried to get a receptionist to plug in a thumb drive. They will try to exploit every function of an organization. They are relentless and whenever you think you’ve seen it all there’s something new.
Windows XP is also not actually that insecure. You just have to not download malware really. It’s not like just having an XP machine gives hackers free reign by default.
Even more so when used in a device that does not have a user.
Somewhere in the distance a mainframe sysop with blue tie is protesting that statement but nobody’s hearing him over the noise of the rotating drum.
Not allowed to wear the ties anymore (due to the rotating drum).