Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
The 10 Most Impactful Types of Vulnerabilities for Enterprises TodayManaging system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
User Rank: Apprentice
4/23/2012 | 5:36:33 PM
Macs are far from invulnerable and I've never seen an Apple ad that said they were. Still there are legitimate technical reasons why Macs have been deemed more robust, especially compared to older versions of Windows. These relate to the inherently secure nature of the Unix kernel. It's hard for malware to penetrate and hard for it to remain in place undetected. All of Unix's children inherit these qualities including OS X, iOS, Linux and Android.
IW has written several articles about this in the past and there are plenty of objective descriptions on the web as well. Bill Gates certainly acknowledged this when he chose to spend his last days at Microsoft heading the effort to harden Windows/Office. (No question that Microsoft has greatly improved in this area.)
The challenge today is in our n-tiered client server world, there many layers through which malware can attack and do harm and many places for it to lodge. Even if a bad actor can't take up permanent residence in the kernel, it can do a lot of damage before it's detected. Think of how much a burglar could remove from your home in 10 minutes were you to leave the door open while running a quick errand.
That's why anyone with common sense treats all PCs and mobile devices as being at risk, whether they be Windows, Mac or Linux. We all know the steps to take, ranging from anti-virus to WEP 2 Wi-FI to hardware/software firewalls, to absolutely never ever install upgrades from pop-ups of unknown origin. Dare I say that this is especially true for Adobe software?
Microsoft, Apple and Google must take the lead in educating users about risks and solutions. So far that hasn't happened to the extent that it should, perhaps because no vendor wants to publicly admit that its products have weaknesses. So in the meantime, users have a responsibility to learn what to do and to implement it.
In terms of Apple's post-attack behavior, it's WAY too soon to say that they failed a critical test. The problem is that their defensiveness in the past makes us not give them the benefit of the doubt. Apple will have to earn our trust by being more forthcoming and responsive when problems occur and evolving proactively as threats morph over time.
Sad as Mr. Job's departure is, Apple without him is starting to show signs of change in this area. May it continue so that they retain their deserved reputation for quality and security.