Craig Peterson's Tech Talk

Ransomware crews have been breaking into Cisco firewalls since January, Craig told Jim, using a vulnerability that was fixed months earlier. The fix was published. The door stayed open because nobody installed it. Craig runs Cisco gear in his own business and still calls Cisco the 800-pound gorilla of network security — which is the point: the equipment was not the weak part. That is the same gap Craig keeps coming back to. A patch that exists and a patch that is installed are different things, and the distance between them is measured in months. He paired it with a bug in Chrome that lets an attacker onto a machine with no click at all — no attachment, no link, nothing the user does wrong — where the patch is already available and the only remaining question is whether anyone applied it. The mechanism worth repeating: attackers have moved upstream into the open-source libraries that almost every modern program is built from. Nobody writes software from scratch anymore — you pull in a library that handles cre