2KKUU7ita

326
Part VI: Ethical Hacking Aftermath
In Chapter 16, I cover the basic issues of determining how important and
how urgent the security problem is. In fact, I provide real-world examples in
Table 16-1. You should also look at security from a time-management perspective
and address the issues that are both important (high impact) and
urgent (high likelihood). You don’t want to try to fix the vulnerabilities that
are just high impact or just high likelihood. You might have some high-impact
vulnerabilities that, likely, are never exploited. Likewise, you probably have
some vulnerabilities with a high likelihood of being exploited that, if they are
exploited, won’t really make a big difference in your business or your job.
This type of human analysis and perspective will help you stand out from
the scan and run type assessments than many people perform and keep you
employed for some time to come!
Focus on tasks with the highest payoff first — those that are both high impact
and high likelihood. Ideally, this will be the minority of your vulnerabilities.
After you plug the most critical security holes, you can go after the less
important and less urgent tasks when time and money permit. For example,
after you plug such critical holes as SQL injection in web applications and
missing patches on important servers, you might want to reconfigure your
tape backups with passwords, if not strong encryption, to keep prying eyes
away in case your backups fall into the wrong hands.
Patching for Perfection
Do you ever feel like all you do is patch your systems to fix security vulnerabilities?
If you answer yes to this question, good for you — at least you’re
doing it! If you constantly feel pressure to patch your systems the right way
but can’t seem to find time — at least it’s on your radar. Many IT professionals
and their managers don’t even think about proactively patching their systems
until after a breach occurs. If you’re reading this book, you’re obviously
concerned about security and are hopefully way past that.
Whatever you do, whatever tool you choose, and whatever procedures work
best in your environment, keep your systems patched! This goes for operating
systems, web servers, databases, mobile apps and even firmware on your network
infrastructure systems.
Patching is avoidable but inevitable. The only real solution to eliminating the
need for patches is developing secure software in the first place, but that’s
not going to happen any time soon. A large portion of security incidents can
be prevented with some good patching practices, so there’s simply no reason
not to have a solid patch management process in place.