Just turn updates off

Posted by jesuiscanard@reddit | sysadmin | View on Reddit | 16 comments

We all know the reason for this, and why we never should be doing it. But how do you explain this to a director who is adamant on getting something from spare parts as soon as possible (despite it being a pentium that hasn't been switched on for 2 years). I say bin it and delay the project until we have hardware that can manage the process and receive security updates.

Reply to Post

16 Comments

[-]

nohairday@reddit

Okay. If I can just get your email confirmation that you want to run x/y/z without security updates and are accepting any risk associated with x/y/z, I'll get right on that. In fact, I'll send you an email detailing the risks. All you have to do is reply confirming you still want to proceed.

[-]

l4p1n@reddit

Don't forget to print the confirmation and stash copies in some place in case Stuff Happens.

[-]

NotSoSolidAdvice@reddit

Funny how you decided to spell “when 100%” as “in case” :-)

[-]

jesuiscanard@reddit (OP)

I don't like politics. Things are easier. They simply respond to what people do. They don't start reversing the work you do

[-]

dozack@reddit

I guess you don't do much printer support? Evil boxes of despair and mess.

[-]

jesuiscanard@reddit (OP)

I try to steer clear of evil. I'm not a priest, so I can't exorcise the demons from those boxes of dispair.

[-]

Mister_Brevity@reddit

No you request that it is added to your file with hr

[-]

thoemse99@reddit

Managers gonna sign this instantly and with a smile. Knowing damn well: if the worst case scenario happens, it's still in the IT's responsibility to get it fixed. All the manager has to do is sitting there and writing a mail once per hour asking about the progress and demanding to work faster, because the company loses money every minute the IT department loiters around, you know...

[-]

nohairday@reddit

The risks include being on the hook for any ramsomware or similar attacks, which wouldn't be covered by insurance because of the decisi9n to allow vulnerabilities. I've never known any manager so completely removed from reality so as not to see the potential risk of putting their own name to a very costly risk. And, if manager isn't absolute top dog in the whole company, they're going to shit bricks over assuming liability. And if they are top dog. They should be able to visualise their business suddenly disappearing under them if they assume liability. And, if they can't see the possible ways that could crucify them. Well, it's really only a matter of time before the shit hits the fan anyway. Time to start planning your exit.

[-]

thoemse99@reddit

Oh, I did back in the days working (as external service provider) for that company. Quick summary: the owner refused to let us implement MFA for all employees (about 30), right after the mail account of a project manager was hacked and dozens of mails were sent and all mails in the mailbox were deleted. "Was not a big deal as your reaction was very fast and you were able to restore all deleted mails. And, you know, letting you implement this and train the users to set up an Authentication app costs too much". We were talking about 2 hours to activate it and "train the trainer".

[-]

djgizmo@reddit

Oof. Cyber insurance will have a field day with this.

[-]

jesuiscanard@reddit (OP)

Yeah but it's only going to slow it down 🤷

[-]

djgizmo@reddit

If your cyber insurance requires yearly audits (and most do), if it is discovered that you’ve disabled updates without a valid technical business reason, they may drop you or exclude those devices from the policy. This means if a maleware / crypto locking incident happens, and it started from those devices that aren’t updated, the entire claim will be disavowed even though you’re paying a monthly premium. The financial risk from not updating ‘just because’ is stupid.

[-]

bitslammer@reddit

Others have mentioned possible issues with cyber insurance so I'll add that you may also want to look at and compliance issues this will cause. This would be a flat out "no go" in the org I work in.

[-]

Interesting-Gear-819@reddit

Often insurance will not cover (or partially not cover) incidents that might have resulted out of the usage of outdated soft and hardware. The costs of a new system are nothing compared to insurance not paying in case of something happening.

[-]

jesuiscanard@reddit (OP)

Investigating...