<story><title>Windows Server vulnerability requires immediate attention</title><url>https://www.cisa.gov/blog/2020/09/18/windows-server-vulnerability-requires-immediate-attention</url></story><parent_chain><item><author>jimrandomh</author><text>This refers to a vulnerability that was patched in August; any systems that are still unpatched are over a month behind. In general, most security patches (for any software that&amp;#x27;s in use) are urgent; once a patch is out, some adversaries are going to reverse-engineer the patch to find out what the bug was, and mass-exploit targets that haven&amp;#x27;t patched. Any server which is that far out of date on its patches is either in need of a sysadmin, or has a sysadmin who&amp;#x27;s being negligent. There is no excuse.</text></item></parent_chain><comment><author>acdha</author><text>You’re missing the biggest reason this is relevant: enterprise IT shops with strict change management processes amd, especially in government, years of austerity budgets cutting resources for both sysadmins and rigorous testing.&lt;p&gt;Either of the targets you mentioned are more the symptom than the root cause: management setting up bad incentives. If you have a charge management process which takes a month to approve updates, the problem is not the sysadmin. If years of skimping means that the operators are afraid to patch because they’ll be punished if it breaks things and they don’t have a robust testing process, the problem is not the sysadmin.</text></comment>
<story><title>Windows Server vulnerability requires immediate attention</title><url>https://www.cisa.gov/blog/2020/09/18/windows-server-vulnerability-requires-immediate-attention</url></story><parent_chain><item><author>jimrandomh</author><text>This refers to a vulnerability that was patched in August; any systems that are still unpatched are over a month behind. In general, most security patches (for any software that&amp;#x27;s in use) are urgent; once a patch is out, some adversaries are going to reverse-engineer the patch to find out what the bug was, and mass-exploit targets that haven&amp;#x27;t patched. Any server which is that far out of date on its patches is either in need of a sysadmin, or has a sysadmin who&amp;#x27;s being negligent. There is no excuse.</text></item></parent_chain><comment><author>gogopuppygogo</author><text>There are operating system patches that break third party software releases. Some of those vendors take more than a month to release a patch.</text></comment>