|
 |
Looking back over the last CISO Update, I keep returning to the point at which an organisation decides that an incident is over: an upgrade completes, the service comes back, the vulnerability ticket closes. Each is a useful milestone, but none answers the question that matters most—does somebody else still have access?
That question connects much of this fortnight’s reporting. NetScaler and Cisco require urgent attention because the affected systems occupy trusted positions. FortiMail raises concerns about unauthorised changes to an email-security appliance. FortiBleed makes the continued value of stolen credentials explicit. The Warlock research shows what can happen after an attacker gets beyond the initial server.
My concern is how easily the reporting process compresses these different problems into a single status. “Remediated” can mean an update was installed, an access rule changed, or an investigation completed. Those are substantially different claims. When they appear as the same green cell in a management report, the distinction disappears precisely where it needs to remain visible.
I would rather see an unresolved question stated plainly than a reassuring status supported by incomplete evidence. That is not an argument for keeping every incident open indefinitely. It is an argument for agreeing what closure requires before the pressure to restore service takes over.
This fortnight offers several useful tests of that discipline.
This fortnight’s big news
NetScaler and Cisco put trusted infrastructure first
Citrix’s bulletin confirms exploitation of CVE-2026-88771 and CVE-2026-88772 against unmitigated NetScaler deployments...
Continue reading this post for free in the Substack app
|