3.1 - Life Cycle Management

Life Cycle Management

• End-of-life

– End of life (EOL)

– Manufacturer stops supporting the hardware

– May continue to provide security patches and updates

– May provide warranty repair

• End of support (EOS)

– Manufacturer stops updating a product

– Current version is the final version

– No ongoing security patches or updates

• Technology EOS is a significant concern

– Security patches are part of normal operation

Patches and bug fixes

• Incredibly important

– System stability

– Security fixes

• Service packs

– All at once

• Monthly updates

– Incremental (and important)

• Emergency out-of-band updates

– Zero-day and important security discoveries

Operating system updates

• Many and varied

– Windows, Linux, iOS, Android, et al.

• Updates

– Operating system updates/service packs, security

patches

• User accounts

– Minimum password lengths and complexity

– Account limitations

• Network access and security

– Limit network access

• Monitor and secure

– Anti-virus, anti-malware

Firmware management

• The software inside of the hardware

– The operating system of the hardware device

• The potential exists for security vulnerabilities

– Upgrade the firmware to a non-vulnerable version

• Plan for the unexpected

– Always have a rollback plan

– Save those firmware binaries

• Trane Comfortlink II thermostats

– Control the temperature from your phone

– Trane notified of three vulnerabilities in April 2014

– Two patched in April 2015, one in January 2016

Decommissioning

Managing asset disposal

– Desktops, laptops, tablets, mobile devices

– Sanitize media or destroy

• May be a legal issue

– Some information must not be destroyed

– Consider offsite storage

• You don’t want critical information in the trash

– People really do dumpster dive

– Recycling can be a security concern

Change management

• How to make a change

– Upgrade software, change firewall configuration,

modify switch ports

• One of the most common risks in the enterprise

– Occurs very frequently

– Often overlooked or ignored

• Have clear policies

– Frequency, duration, installation process,

fallback procedures

• Sometimes extremely difficult to implement

– It’s hard to change corporate culture