Following the news about Shadow Brokers Data Dump, IT security experts from Tenable and Cryptzone commented below.
Cris Thomas, Strategist at Tenable Network Security:
“The good news is that there appears to be a patch available for just about everything in the package. In some cases — such as the exploits for Windows XP and Windows Server 2003 — there will never be any patch since support for those products has long since been discontinued. Any CISOs who still have these older systems on their networks are now vulnerable to attack and will be defenseless targets to anyone who is able to get a foothold on those networks.
“Many of the patches for the exploits provided by the Shadow Brokers have only just recently been released, meaning that many organisations may not have had time to run those patches through their patch management processes and get them applied to their critical systems. Of course, just because a patch is available doesn’t automatically mean your organisation is safe. The pervasiveness and severity of some of the vulnerabilities in this drop makes it critical that you’re able to properly prioritise and patch every affected system in your environment.
“In some cases, those patches may never be applied, whether due to a conscious decision to preserve the operational status of a crucial system, or possibly due to imperfect knowledge about what’s on the network and the impact of these blind spots on overall security. A look at historical patch MS08-67 is an excellent example. This critical vulnerability from 2008 is one that lived for years within organisations. This is the first thing that penetration testers would look for when compromising a network. MS08-67 has now been replaced by MS17-10. While there is a patch available, there will always be one machine that someone overlooked that a penetration tester or an attacker will find and use to compromise your network.
“This is why conducting a proper system inventory is of such high importance to any commercial organisation or government agency. You can’t protect what you don’t know. You can’t patch it either.”
Leo Taddeo, Chief Security Officer at Cryptzone:
“Disclosure is important, but knowing about the vulnerabilities is not nearly enough. According to the 2016 Verizon Data Breach Investigations Report, most successful attacks exploit known vulnerabilities that have never been patched despite patches being available for months, or even years. So while it’s important that Microsoft publicly disclosed the vulnerabilities and issued a patch, the challenge for enterprises is to update their infrastructure with the latest supported version of the affected products.”
