Top 10 Security SNAFUs of 2010

This article appeared in PC World about 2010 security “whoops”. Those in it would have preferred not to have appeared. Cisco, Google, McAfee, and the U.S. government are among the entities mentioned in the article. For the complete article, go to http://www.pcworld.com/article/214914/top_10_security_snafus_of_2010.html

Updates and issues with dat files are frequently the problem and cause these “whoops” to occur.

5958 will forever be a bad number in the minds of McAfee(and their customers). This was the file delivered to customers in April that paralyzed corporate PCs http://www.networkworld.com/news/2010/042110-flawed-mcafee-update-paralyzes-corporate.html (discussed in the article)

Symantec, who had problems in January when their Endpoint Protection Manager Server product erroneously marked signature updates issued in 2010 as out of date, dodged a bullet by not being included in this article. The same is true for AVG Technologies, whose customers had major problems when they downloaded “3292” in December.

Problems like this go as far back as April 2005 (and earlier). "Trend Micro Apologizes for Update Snafu” was an April 2005 headline. http://www.betanews.com/article/Trend-Micro-Apologizes-for-Update-Snafu/1114456043

High level takeaways from these incidents? Move quickly when problems occur with updates. Ignore standard operating procedures and help customers quickly. If a large number of customers are affected, an executive needs to be visible, making a statement, discussing the problem, and talking about how processes will be changes to help mitigate future occurrences. AVG Technologies, McAfee, and Trend Micro all did this to varying degrees.