On one hand I hope people are smart enough to run updates to critical systems on a test environment, first. On the other hand I’ve learned that that is not at all the case yesterday.
Many security products have no test option. One I’m using has a best practice of a 15 minute delay between test and prod and no automation to suspend besides relying on the vendor to pull the update it within 15 mins if it were to go full crowdstrike.
The problem her was that this wasn’t a traditional update. It was delivered automatically as a “content” update (like how old av would have definition update). We were given no room to test.
The point is that it could have. Or maybe some unknown 0-day gets used by someone out to cause chaos instead of collect random.
That’s true
On one hand I hope people are smart enough to run updates to critical systems on a test environment, first. On the other hand I’ve learned that that is not at all the case yesterday.
Many security products have no test option. One I’m using has a best practice of a 15 minute delay between test and prod and no automation to suspend besides relying on the vendor to pull the update it within 15 mins if it were to go full crowdstrike.
The problem her was that this wasn’t a traditional update. It was delivered automatically as a “content” update (like how old av would have definition update). We were given no room to test.