Are One in Three Breaches Really Caused by Unpatched Vulnerabilities?

Oli Thordarson, CEO of Alvaka Networks, begs to differ... This is an interesting article I read in ZDnet, Cybersecurity: One in three breaches are caused by unpatched vulnerabilities, about software vulnerability patching. I found it interesting because I took some [...]

Are One in Three Breaches Really Caused by Unpatched Vulnerabilities?2020-03-27T16:34:30-07:00

Software Patch Management is Geographically Undesirable

Many organizations continue to find themselves between a rock and hard-place when it comes to consistently applying security updates or “patches” across their environments. On one hand, they recognize their unpatched software exposes them to risk of a disruptive and [...]

Software Patch Management is Geographically Undesirable2020-03-27T17:06:52-07:00

Meltdown and Spectre news round-up for week of February 5, 2018

A running log of Meltdown and Spectre news can be found at Meltdown & Spectre: How to avoid the biggest cyber threat in modern computing. February 5, 2018 - At this point in time, Alvaka Networks is not advising [...]

Meltdown and Spectre news round-up for week of February 5, 20182020-02-04T01:49:22-08:00

“Are the risks from Meltdown and Spectre overblown?”…asks an IT professional

I participate in IT professional industry forums, where peers ask questions of other peers. Someone in the forum made a somewhat disjointed post questioning the severity for the recent Meltdown and Spectre security vulnerabilities. I paraphrase his long question: About [...]

“Are the risks from Meltdown and Spectre overblown?”…asks an IT professional2018-03-01T10:55:39-08:00

What 12 Security Things Should I Focus on to Be Defensible in 2016?

Here is a sneak-peek and what is likely my most important blog for the upcoming New Year.  This is just a partial teaser....


Irvine, CA - I was recently asked by a roundtable of CEOs to advise them on network security.  They had a lot of questions and a lot of misinformation.  I was surprised as this was a group of technology company CEOs and what I quickly found out is that they did not know much more than my non-tech company CEO clients.  From that discussion they asked me to come back and present to them a short list of actions they should take in 2016 to better secure their systems.  Initially I wanted to present them with a list of 10 things they should focus upon.  For anyone that knows, it is easy to create a list of 100 things that should be done to secure a system. However, I decided in order to make the list actionable and not overwhelming I needed to focus on the 10 things I have seen in the past year or two that have caused the most real-life grief for our new and existing clients.  I wanted to keep the list to 10 items, but I had to fudge a bit and expand to 12 core items. Then I added three bonus items for those who are over-achievers and another three for those in regulated businesses like healthcare, financial services and Sarbanes-Oxley.

This list is not complete nor absolute.  It is a list I have created largely in order of my perceived importance based upon the real-life hacks, breaches and other maladies related to failures of network security to keep the bad guys out.  You will need to assess the requirements that are appropriate for your firm.  If you are looking for a good place to start, I offer up my suggestions below.

1.       You need to do a vulnerability assessment or security assessment.  It is impossible for you to know what actions you should take to properly secure your systems without first doing an assessment.  Assessments are common practice at many firms, yet completely ignored at others.  It is fairly easy for you to order a vulnerability assessment and the best part is that it takes very little time and participation from you and your IT staff.  The cost for this service ranges from a few thousand dollars for a very small firm to several tens-of-thousands or even hundreds of thousands of dollars for larger enterprises.  These should be done at least once per year just like your financial audit.

2.       Patching for Software Security Updates is perhaps one of the most overlooked and under-rated security measures you can implement to better secure your systems.  I maintain that good software patching measures are in some ways more important than your firewall.  A firewall is a formidable device that once it gets set-up has a number of ports opened up so that your firm can transact business.  That is where it gets weak.  Through these legitimately opened ports attackers will send nasty payloads that compromise your system, often without you knowing.  Imagine a hardened castle all buttoned up, but the draw bridge must be opened in order to conduct commerce.  Through that legitimately opened bridge come the sneak attacks, the scammers, crooks, mischievous and spies....

What 12 Security Things Should I Focus on to Be Defensible in 2016?2015-11-12T03:10:52-08:00

Software Patching Best Practices – 18 Must Do Tips

There are many other benefits to applying software patches including in some cases adding features, fixing bugs that make the software run slow or not work right.  All software needs to be patched. Whether the software sits on a disk and runs on a server, resides on a chip within a firewall, or is an app that is in your tablet devices, it all needs to periodically be updated and patched in order to be secure.

The following list of 18 software patching best practices is what we follow at Alvaka Networks when delivering on our Patchworx(SM) Patch Management Service.  It is important to note that all these steps are important, but not always are all them utilized or they can be utilized in different ways depending upon the needs of the client. Like us, you will need to decide what your patch management plan needs to look like to best suit your needs.

18 recommended best practices for patching your software:

Software Patching Best Practices – 18 Must Do Tips2020-07-14T22:42:21-07:00

Why are Patch Management and Change Management Important?

Alvaka Networks has arguably the best and most sophisticated patch management process in the Orange County, Los Angeles County and possibly the US.  Not many firms can deploy vast quantities of patches to valuable high availability servers and PCs with smoke testing qualify control while following the sun globally during selected narrow service windows.

Change Management
Change management is vital to every stage of the patch management process. As with all system modifications, patches and updates must be performed and tracked through the change management system. It is highly unlikely that an enterprise-scale patch management program can be successful without proper integration with the change management system and organization.

Like any environmental changes, patch application plans submitted through change management must have associated contingency and backout plans. What are the recovery plans if something goes wrong during or as a result of the application of a patch or update? Also, information on risk mitigation should be included in the change management solution. For example, how are desktop patches going to be phased and scheduled to prevent mass outages and support desk overload? Monitoring and acceptance plans should also be included in the change management process. How will updates be certified as successful? There should be specific milestones and acceptance criteria to guide the verification of the patches' success and to allow for the closure of the update in the change management system....

Why are Patch Management and Change Management Important?2020-07-14T22:39:51-07:00

Expect a Big Microsoft Patch Tuesday on February 12th

Microsoft is releasing 12 patches on Tuesday for a near record 57 vulnerabilities.  This release is only bested by the 64 vulnerabilities of April 2011.Five of the patches are critical.  Two of those five are for Internet Explorer versions 6, [...]

Expect a Big Microsoft Patch Tuesday on February 12th2013-02-11T23:01:00-08:00

The Java Problem Just Got Worse

Be careful where you go to update your Java software.  There is new malware masquerading as a Java update. If you are a current client and your company is concerned about this security risk and you feel you need some [...]

The Java Problem Just Got Worse2018-08-22T11:22:39-07:00