Security Announcement: What Are You Waiting For?

-
VMSA-2020-0006 & CVE-2020-3952

Yes you read it correctly. There is a known vulnerability which may affect your vCenter Server running version 6.7 regardless is it on virtual appliance (vApp) or Windows. It affect new deployment as well as upgraded version from 6.x to 6.7.

Here is the article to read more about it.

Often to hear from some to wait for a while before patching. I like to bring out a point that software patches and security patches are two different subject.

Security patches
This affect an immediate vulnerability been address, it should be action on to avoid breaches and compromise. This is utmost important unless your organization does not deem security loophole been important to be addressed or your organization is claimed to be highly secured.

Software patches
This type of patches is to address bug fixes and some times to upgrade from and update or it can also be release of some features which was delayed, etc. Often, this may not impact many customers as some bugs or fixes affect only those who utilized it. Not everyone use 100% of every software features that is. Some like to wait to see what the community experience before applying. This is purely acceptable as you do not want to be affected by apply a patch that might affect your stable system.

So from the above you can see the differences between the two patches. However, we still see people who like to use the Software patches mentality to address Security patches.

Been utmost important, Security patches are typically to be applied as soon as it is released. The only reason I can think for someone who uses the Software patch mentality because it will affect your perfectly working system. But why would you worry about that unless:
  • You did not plan for availability for your system
  • You did not plan for redundancy for your system
  • You do not trust your backup restore strategy
If the above is not true, you would have just go ahead and patch your system. Every minute wasted means more time for compromise. That is why, security patches are release as and when they are discovered unlike bug discovery to software patches release.

To design a system, you must prepare for the worse case scenario. If you cannot, then either it is your requirement or there is a flaw in the design. Relook into your design.

Comments

Post a Comment

Popular posts from this blog

Why VMware or Why Not after Broadcom?

-
The Truth Yes, the news of VMware acquired by Broadcom has come to a realization. We cannot denied the truth since 22nd Nov 2023. Prior the acquisition, if you have made a multi-year purchase before that, you will have whatever you can consume after the acquisition. VMware after the acquisition has release new bundle of all their offerings and end the perpetual licensing offer to the market. The individual products are not make available and cannot be purchase as a standalone. But are offered via two bundle namely; VMware vSphere Foundation (VVF), VMware Cloud Foundation (VCF). Both of which are all subscription licenses. It also ends all sales and renewal of any perpetual licenses. Honestly, VMware has been trying to end its perpetual license and into subscription for the longest time. With the Broadcom acquisition, VMware has been one of the last major player that has moved to subscription license. Customer who are on VMware, has been enjoying the great pricing with no limit of cores...
Read more

VMware Certifications Updates

-
Image
New changes are coming your ways for VMware certifications. A blog article just been release. 1. Prices of VCP, VCAP, etc. are all standardize to one single price, USD250. This is definitely beneficial for many especially those who are keen to persue the advanced level exam but having difficult to afford the exam fee which was much higher. 2. A mandatory course is no longer needed as an exam requirement. This will help many professionals who are experienced to get certified without having to go through boring course and spend to drag through the requirement.  Will this then bring down the certification value since course was required to ensure certified professional walk the talk as what they hold in credential? Answer to point 2, for people who are new and managed to pass the exam and get certified by other means, it can be identified easily. As the digital badges will be differentiated whether the exam was passed with a accompanied course or not. So during an interview, it can i...
Read more

VMware vExpert 2025 Applications Starts Now!

-
It the time of the year to apply and renew your vExpert for another year for your effort contribution back to the VMware community over the last 6-12months.  The vExpert 2025 application is now open starting from 6th Dec 2024 and will closed on 10th January 2025. So hurry start your application and fill up all your contribution. You do not have to do it once through, you can always save it in draft and add on and submit before the closing date. If you have doubt reach out or look for your vExpert Pro nearest to you to to advise you accordingly. This year has been a very different year for VMware. However, the vExpert program was valued and carry on. The perks this year been a vExpert will be very different from the investment from Broadcom.  Head over and sign up now. Good luck! Update 13 Dec 2024 Check out the vExpert application announcement here .
Read more