It's pretty important to me to not turn to a life of crime, but I appreciate everyone laying off their security teams, and putting all their most valuable data in one place, just in case I should change my mind...
I'm not going to change my mind, but it's awfully considerate anyway.
Fucking hell, man, with how many very publicly visible security problems they had last year, you'd think the stakeholders would be on board with doing security for a bit.
In the last few years we used to do windows updates quarterly on our production servers as required by PCI DSS. In the last year though, we’ve had to do updates every single month due to critical CVEs needing to be patched. It’s becoming ludicrous actually, yet they’re cutting security folk.
Think we patch monthly regardless in and outside of PCI scoped environments. The issue recently is that customers want even more frequent patches, like within a few days of the CVEs