Why “If It Ain’t Broke, Don’t Fix It” Doesn’t Work for IT

Let’s say you have network equipment that’s been in place for years and is working with minimal or no issues. Paying to maintain service and support on those items might seem like an unnecessary expense. Certainly that’s the way many businesses look at it when scrutinizing the IT budget and looking for items to cut. The logic to justify de-funding those contracts is pretty simple: “If it isn’t broke, why pay to fix it?” However, that is a risky position to take.

Late in 2019, a manufacturer of wireless access points announced that a number of security vulnerabilities — some with a “critical” rating — had been found in its products. They fixed the vulnerabilities in short order and distributed the fixes in the form of software upgrades to the affected products. Here’s the rub: businesses without active support contracts didn’t have access to the upgrades.

Why Service Contracts Are Vital for Critical Infrastructure

The access points in question are widely used in installations that call for reliable, widespread business-class wireless coverage. In other words, they’re an extremely critical element of the infrastructure for organizations that rely on Wi-Fi to run their business. With the prospect of a security vulnerability that would allow an intruder access and potentially bring the entire wireless network down, the seemingly minor risk of letting the service contracts lapse turned into a major risk overnight. All of a sudden, companies were faced with an unbudgeted expense. They either had to re-up the contracts for all of the controllers and access points, or else replace their entire wireless infrastructure.

The same scenario and risks apply to all manner of critical network infrastructure, including switches, routers, firewalls, VPNs and servers. Vulnerabilities are constantly being discovered and patched with updates. We often think of these devices as appliances or hardware, but the reality is, they have software inside that’s meant to be upgraded to improve performance, add features or address security problems. Those devices are at the heart of the network and hold the keys to keeping the business running.

Is the Gamble Worth It?

Many companies do take the risk of running without maintenance agreements on key pieces of network equipment. They have weighed the risks against the costs and reached the conclusion that the gamble is worth taking. While at FIT Solutions we don’t recommend this approach, we do respect that it is a business decision. We are more concerned with businesses that simply allow their service and support contracts to lapse as a cost-cutting measure, without fully understanding the risks and taking them into account.

At FIT Solutions, part of our service is knowing what the vendor policies are with regard to upgrades, support, and service agreements, and keeping track of whether your agreements are active. We use this information to help you understand the risks of running your critical network infrastructure without the benefit of a safety net. Want a true picture of these hidden risks? Give us a call at 888-339-5694 today.

Patch Tuesday & Hack Wednesday—Why Software Patching Is A Necessity

Applying software patches to fix security vulnerabilities is a key piece of system hygiene and protection against criminal computer attacks. Windows 10 is by default set up to handle this automatically. Unfortunately, for many users the prospect of having to stop the task at hand, wait for the updates to download and install, and hold off while the system restarts is too inconvenient. That leads many to delay the updates or tweak the settings so the updates can’t execute. This can be a big mistake—especially now.

The second Tuesday of every month is “Patch Tuesday”, when Microsoft rolls out the latest set of security patches to its operating systems and software. The set of patches first made available on April 14 closes many, many vulnerabilities. Every hour delayed in applying them leaves unpatched systems susceptible to attack.

A Whopper of a Patch Tuesday

This last Patch Tuesday was unusually large. It included:

  • 113 patches overall
  • 3 that close zero-day vulnerabilities/exploits for which no defense exists
  • 3 known to be actively used to infect systems “in the wild”
  • 17 deemed “critical”, which means a criminal can gain complete control over the system without any user interaction
  • 96 deemed “important”, which means that some user action is involved (with or without warning prompts)

The products impacted include the Microsoft Windows operating system itself, the Edge and Internet Explorer browsers, various Microsoft Office applications, Microsoft Office Services and Web Apps, Windows Defender, Microsoft Dynamics, Microsoft Apps for Android, and Microsoft Apps for Mac.

Why Prompt Patching is Vital

To help you quickly grasp the importance of patching, we’ll first define a few terms. The first two have specific meanings when applied to computer software security.

  • Vulnerability: A weakness or oversight in the way software is coded or structured. It allows the code to be overwritten or tampered with so that it performs some action other than what it was intended to do.
  • Exploit: Rogue software code that a criminal uses to take advantage of a vulnerability. Such an exploit could allow a criminal to gain unauthorized access to a system or gain administrator privileges. The aim is often to inject malicious software code into a running process, leading to the criminal gaining control of the system.
  • Zero-day:  A combination of a vulnerability and an exploit that either is unknown to the security community, or is so new that no defenses have been developed against it. A patch isn’t available to close the vulnerability. Security software hasn’t been updated or is unable to recognize the exploit and prevent it from being introduced into systems and executing.
  • In the wild: An exploit that’s out of the realm of being theoretical or a possibility. It’s being actively used to infect and take over systems.
  • Patch Tuesday: Microsoft’s monthly distribution of patches that close known vulnerabilities.
  • Hack Wednesday: What the security community calls the day after Patch Tuesday. When Microsoft releases the patches, criminal programmers are able to use the patches to understand the vulnerabilities. Within a day or two, the related exploits begin appearing for sale on the underground marketplaces of the “dark web”.

Put the above together, and you can see the importance of applying patches as soon as they’re available. The instant that the patches are released, criminals are racing to create the new exploits and infect as many machines as possible before the systems’ owners can get around to installing the patches.

How to Ensure Systems are Properly Patched

Assuming you’re running Windows 10, click on the Start button, then Settings, open Update & Security, then Windows Update. Here you can immediately check for updates, as well as review your settings to make sure you’re not effectively blocking the update process.

If you’re running a business with multiple machines, managing the update process to be sure that essential patches have been applied can be a time-consuming headache. As a managed service provider (MSP), here at FIT Solutions we use sophisticated tools to administer your systems and ensure your systems are up-to-date with the current patches—without inconveniencing your users. If you could use help with patch management, give us a call at 888-339-5694.

Get in touch.

Fill out the form and our team will get
back to you as soon as we can!