Maintain Your &%$#* Systems! A Mantra for IT Professionals in the Wake of Equifax

Once again, we have a basic failure in cyber hygiene causing a massive data breach. This one affects potentially half of the U.S. population and compromises particularly sensitive personal information that can be used by criminals to wreak havoc on people’s bank accounts, credit scores and identities.

I’m referring, of course, to the Equifax breach. What I find particularly disturbing is that criminals took advantage of a known vulnerability for which a patch had been available for two months. Let that sink in for a moment -- two months is an eternity of exposure to hostile internet actors when efficient systems management and compensating controls are readily available. In fact, the Tenable team had published this post in March about this particular Apache Struts vulnerability and the availability of Tenable plugins. In an era where companies are continuously updating their software, IT and security teams should be consistently patching bugs and closing vulnerabilities as they are reported. 

These types of attacks take advantage of the worst and most common habits -- the avoidance of doing something as simple as maintaining good cyber hygiene and patching systems.  Cyber criminals don’t need to waste a precious and rare zero-day exploit when they can easily get into your network using a known exploit of an unpatched vulnerability. 

Every organization has a responsibility to know what systems it operates and which ones it relies on.  To know those systems are exposed and to efficiently manage and reduce cyber risk, frequently through patching and compensating controls.  This isn’t sexy work, but it gets the job done. Maintaining good cyber hygiene is so fundamental to building a solid, scalable and IT program that it ought to be a requirement against which all IT functions are measured. Imagine the benefits to the business if CIOs and CISOs rewarded their teams for maintaining top rate systems hygiene and celebrated defense and prevention? 

Just as doctors take the Hippocratic oath to “first do no harm,” IT and security teams ought to adopt a similar mantra, “Maintain your systems.” That is the surest way to keep the business healthy and safe from cybercriminals. And it's the only way we're going to stop this vicious cycle of breaches and the inevitable face palm that results from knowing the breach was entirely preventable.