Following the news that a serious flaw was found in secure email tech, PGP, IT security experts commented below.
Laurie Mercer, Solutions Engineer at HackerOne:
CVE-2017-17688 and CVE-2017-17689 were reserved on December 15th 2017. Nearly 5 months have passed since this date, yet many email clients have no patch. Patch management cannot protect organisations if no patch exists. This raises questions about how software vendors, standards organisations and open source projects can best coordinate with security researchers to ensure that vulnerabilities are reported to the right people and remediated before being disclosed publicly.”
Dr Guy Bunker, SVP of Products at Clearswift:
“Some vulnerabilities impact millions of users, some, like that found in Drupal has an impact on 100,000’s. In most cases, the challenge the organisation has is to stay up-to-date with the list of flaws which are being released – and there are a number of sites which break the news. This should then be followed by ensuring that any patches which have been released by the vendors are applied in a timely manner, before the vulnerability is exploited.
“While it is relatively simple to apply patches to a laptop or a desktop, applying to servers or to systems in the cloud (where the organisation might not have any control over timing) is more challenging. For many organisations, patches have to be tested before they can be applied to production systems, and this can take weeks or months – not just hours or even days. For a large database application server there could be patches for the OS, database, application, middleware and even the web server, so a system might be in a permanent state of being patched against critical vulnerabilities. Lack of patching opens the organisation up to an attack and, for systems which face the Internet, finding out this information is all too easy.
“Organisations rely on Open Source software, even if they don’t always realise it. It does come with risks but understanding the risks mean they can be ameliorated. Closing your eyes and ignoring them could be devastating to any organisation.”
Steven Malone, Director Of Security Product management at Mimecast:
“Privacy and security often have competing demands that need to be carefully balanced for any organisation”