All operating systems have security issues
Best patch management practices enable you keep on top of the security issues that are constantly being discovered. It seems as soon as one patch is released to deal with xyz security issue, another issue is discovered and another patch released.
For IT professionals, this never-ending release of patches can be a nightmare to manage, but it is essential that best patch management practices are adopted to prevent hackers exploiting operating system vulnerabilities.
All operating systems have security issues, and no operating system is less prone to them than another. Below we provide an overview of some of the most recently discovered security issues affecting the major operating systems.
Windows network security issues
In the last forty years, Windows has done much to mitigate the risk of certain vulnerabilities, but the Wintel 8086 architecture has several inherent issues that are not easily resolved. For example, one process should not be able to read the memory of another. Consequently Windows is susceptible to buffer overflow attacks in which a hacker adds their own instructions to the end of a field.
In this example, a hacker could look in the computer´s memory for .DLLs to load and run. Some older .DLLs do not have the security requirement that programs are signed before they can be executed and, if there is no root certificate for the signature, an error is thrown.
In some scenarios, a hacker does not need to exploit a buffer overflow to load and run a .DLL – the computer user does it for them. This most commonly occurs when a browser loads an ActiveX control like the Adobe Shockwave platform using the OBJECT and CLASSID HTML tags.
This code, for example, would be how you would instruct Adobe Shockwave play a video on a specific URL:
Brian Krebs, a former Washington Post IT blogger and now writing for Krebs on Security, believes that best patch management practices are not enough to cope with the security issues on Adobe Shockwave and, in 2014, he published an article Why You Should Ditch Adobe Shockwave.
Krebs claims that 80 percent of webmasters have already quit using Adobe Shockwave because of security issues. He references a security expert that says because of security issues with Adobe Shockwave, “an attacker may be able to execute arbitrary code with the privileges of the user.”
However, before you decide to abandon best patch management practices for Adobe Shockwave, we recommend that you read the comments at the end of the article to understand some of the other issues that can arise from ditching the platform.
Macs have security issues too
Contrary to popular belief, Mac operating systems are not without security issues of their own – maybe not as many as Windows operating systems, but it is still advisable to adopt best patch management practices if you want to blockade your computer(s) from would-be hackers.
Google’s security researchers recently found this issue with the Bluetooth drive on Yosemite:
You can´t get away from security issues if you use a Linux OS
Just because Linux is an open source operating system, it does not mean it is free of security issues. One massive vulnerability was discovered in February 2015 which, had a hacker discovered it before a security researcher, could have been used multiple times over to devastating effect as it affected the root directory of Samba – a tool which allows the sharing of drives between Linux and Windows.
Best patch management practices
To avoid hackers exploiting vulnerabilities in your computer´s operating system, it is crucial that you adopt best patch management practices. Stay on top of patching, patch all applications and operating systems. If you are responsible for the security of a workplace network, layered network security, continuous security audits, and employee education about security threats are also essential.
SMEs with a small IT unit may be able to assign one employee to keep up-to-date with security issues by following security bloggers such as Brian Krebs and subscribing to security bulletins. If you software supplier is a cloud vendor, some of the best patch management practices will already be taken care of. However, it can save a lot of grief further down the line if you do not rely too heavily on your software vendor and keep abreast of best patch management practices.
