Net-Flow Corporation

Patching vulnerabilities is essential for front-line defense, yet unpatched vulnerabilities remain a leading cause of data breaches. An overwhelming majority of people – including security professionals – tend to delay or put off updating or patching their systems. Survey data suggests that eight out of 10 CISOs and CIOs have postponed a patch simply because it would be inconvenient. Failure to patch is compounded by the fact that system updates are often regarded as “unimportant” by other employees. This could not be further from the truth.
While it is true that all patches are updates, not all updates are patches.

Further, not all vulnerabilities are fully resolved in a single patch; sometimes multiple patches are needed. Patching and performing system updates are both important, but knowing the difference can help you ensure critical vulnerabilities are resolved.
Understanding Updates

Software updates are issued by vendors for a variety of reasons. These can include fixes for performance bugs, new features and other improvements. “Updates” is a broad term that covers a lot of ground. But people don't update their software as much as they should. While many updates contain security fixes, there is no shortage of reasons why people skip out on updating their systems.
To many people, “updates” are just those annoying pop-up windows that appear on their computers or phones. Others have had bad experiences with updates, such as malfunctions or slower processing. These turn-offs can be especially hard to reckon with in an office environment; no one wants to be the guy slowing the business down. That's part of why so many CISOs and CIOs admit to postponing updates. Even when it comes to patching for vulnerabilities, security professionals are often put between a rock and a hard place when other business units don't grasp the importance of cybersecurity.

While you may be able to postpone fixes for performance bugs, patches are another story.

Patches, and Why Patching Is Important: While general software updates can include lots of different features, patches are updates that address specific vulnerabilities. Vulnerabilities are “holes” or weaknesses in the security of a software program or operating system. Malicious actors can then use code to exploit these vulnerabilities – unless, of course, you patch for it. Patches minimize your attack surface and protect your system against attackers.

“While general software updates can include lots of different features, patches are updates that address specific vulnerabilities.”
Even though patching vulnerabilities is vital for good cyber hygiene, far too few organizations take action when necessary. That's why 60 percent of data breaches are traced back to unpatched vulnerabilities. In late May, Microsoft issued multiple warnings about the necessity of patching for BlueKeep, a critical vulnerability discovered earlier in the month. Even the NSA has issued warnings about BlueKeep's potential threat, and yet, experts say not enough people are patching for it. Estimates suggest around a million machines on public Internet remain vulnerable.
Patching vulnerabilities in a timely manner may be what saves you from a breach. Automated patch management solutions can make the process of patching for vulnerabilities more streamlined – and help ensure that updates are deployed to every device in your network. Maintaining good cyber hygiene practices is essential for minimizing your attack surface and keeping breaches at bay.

Contact us [email protected] to learn more about our managed services we provide. Help us help you!

In the traditional IT support model, it’s common to find yourself paying premium rates for technicians to put out the same fires over and over again. That’s expensive and inefficient. Thankfully, there’s a better way.
A smart, cost-effective alternative to traditional break/fix support.
Our approach is different. It reduces IT costs, improves performance, and protects your network so your business can thrive.

Anti-Phishing Requires A Three-Pronged Strategy: technical controls, end-user controls and process automation.

This whitepaper explores how modern phishing techniques, such as business email compromise (BEC), ransomware, spear-phishing and advanced persistent threats (APTs) are meticulously designed to defeat traditional email security approaches and how Net-Flow Corporation advanced threat protection platform is uniquely built to addresses the contemporary techniques of phishers.

Data integration is often underestimated and poorly implemented, taking significant time and resources. Yet, it continues to grow in strategic importance to the business, as customer data and touch points grow with the emergence of cloud, social and mobile technologies. CIO

Multiple Cisco products incorporate a version of the OpenSSL package affected by a vulnerability that could allow an unauthenticated, remote attacker to retrieve memory in chunks of 64 kilobytes from a connected client or server.

The vulnerability is due to a missing bounds check in the handling of the Transport Layer Security (TLS) heartbeat extension. An attacker could exploit this vulnerability by implementing a malicious TLS or Datagram Transport Layer Security (DTLS) client, if trying to exploit the vulnerability on an affected server, or a malicious TLS or DTLS server, if trying to exploit the vulnerability on an affected client. An exploit could send a specially crafted TLS or DTLS heartbeat packet to the connected client or server. An exploit could allow the attacker to disclose a limited portion of memory from a connected client or server for every heartbeat packet sent. The disclosed portions of memory could contain sensitive information that may include private keys and passwords.

This advisory will be updated as additional information becomes available. Cisco will release free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities may be available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed

Cisco Security Advisory: OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products The impact of this vulnerability on Cisco products varies depending on the affected product.