Would you accept software updates from a company like SolarWinds, whose tainted update infiltrated thousands of customers? How do you rebuild trust?
Sort by:
One way that we've addressed that is our CSO talks to their CSO, and that level conversation helps inspire that trust. If you can get the right levels of management, to talk about what's happened, I think that goes a long way. If you can get the right levels of executive conversation to go back and forth, that is where the confidence gets inspired. And I've seen that numerous times, not only in my current role, and not just for supply chain compromises either. When you take a look at the ransomware landscape as well, it's the same thing. You've got to get the right people to say, "Yeah, it happened. Here's what we've done. Here's our assurance that this isn't going to happen again."
Yeah. You're probably in a better position at large bank than we would be at mid-sized company in order to have executive-level conversations.
Many large companies will thoroughly test updates before releasing them in to production, they'll alo have a grace period before they install them.
This protects the company, ensures that they don't introduce bugs into their environment, and prevents unnecessary down time.
They'll do this for both reputable companies and ones who have had issues in the past
While not foolproof, it is a smart approach.
The risk comes from the SaaS providers who's updates you have no control over. They can push straight to prod and you wear the impacts.
Like Microsoft and M365 last month.