Latest / Tech Talks With Kinsoft / Last Week in Tech - NetScaler's Patch Needs a Patch, Atlassian Servers Attacked Within Hours, and 86,000 Firewalls Already Owned

Transcript

Last Week in Tech - NetScaler's Patch Needs a Patch, Atlassian Servers Attacked Within Hours, and 86,000 Firewalls Already Owned · Tech Talks With Kinsoft

• 0:00
  Imagine you've just spent $10 ,000 installing
• 0:04
  this state -of -the -art vault door for your
• 0:06
  business. Right, like biometric scanners, reinforced
• 0:08
  steel, the works. Exactly. You lock it up and
• 0:12
  you're feeling completely untouchable. But what
• 0:15
  you didn't realize is that the manual on how
• 0:17
  to reset the master code is just, well, it's
• 0:20
  still taped to the outside of the door. Oh, wow.
• 0:23
  Yeah. Well, in the back window of your building,
• 0:25
  it's completely shattered anyway. Yeah, it's
• 0:27
  a brutal analogy. It is, right? You have this
• 0:30
  incredibly expensive illusion of security, while
• 0:33
  in reality, anyone walking down the street could
• 0:35
  just wander right into your vault. It's brutal,
• 0:38
  but I mean, it is exactly what we are seeing
• 0:40
  play out across the globe right now. The systems
• 0:42
  that run countless businesses are basically sitting
• 0:44
  there with the digital equivalents of shattered
• 0:47
  windows and combinations taped to the door. Okay.
• 0:50
  Let's unpack this because our mission for today's
• 0:53
  deep dive is to look at a highly revealing tech
• 0:55
  and cybersecurity briefing. This is from October
• 0:58
  12th, 2026. Yep. The Tech Talks with Kinsoft
• 1:02
  report. That's the one. And we've got a stack
• 1:04
  of massive tech stories from just a single week.
• 1:07
  Initially, they look totally unrelated, you know.
• 1:09
  They really do. Yeah. I mean, we are talking
• 1:11
  about remote access gateways crashing. project
• 1:14
  management suites failing, massive AI financial
• 1:17
  deals, and then small business firewalls being
• 1:20
  hijacked. But looking through your notes, they
• 1:22
  all point to one incredibly critical yet somehow
• 1:26
  overlooked reality in business technology. They
• 1:29
  absolutely do. If there is a single thread tying
• 1:32
  this entire week of chaos together, it is this.
• 1:35
  The patch is the start of the job, not the end
• 1:38
  of it. Right. We have this tendency to view cybersecurity
• 1:41
  as a movie script. You know, where brilliant
• 1:43
  hackers are typing furiously to crack impossibly
• 1:46
  complex codes. Like green text falling down a
• 1:48
  black screen. Exactly. But the reality is much
• 1:51
  more mundane and honestly much more terrifying.
• 1:54
  It is about the massive gap between knowing a
• 1:56
  glaring problem exists in your network and the
• 1:58
  operational follow through of actually fixing
• 2:00
  it. So let's start with that operational follow
• 2:03
  through. Because looking at this first story
• 2:05
  about Citrix, it seems like sometimes doing the
• 2:08
  supposed right thing, like applying a critical
• 2:11
  security patch, is exactly what causes the catastrophe.
• 2:14
  Yeah, that was a mess. I see Citrix had a nightmare
• 2:18
  week with their Netscaler appliances, just to
• 2:21
  establish a baseline for everyone. These are
• 2:23
  the gateways companies use to let remote workers
• 2:25
  log into the corporate network, right? That's
• 2:27
  right. I mean, if you've ever worked remotely
• 2:29
  and logged into your company's portal to access
• 2:32
  your internal apps, there is a very high chance
• 2:34
  you route it through a Citrix net scaler. Got
• 2:37
  it. They are ubiquitous in the corporate world.
• 2:39
  So the brief mentions they had a severe memory
• 2:42
  overflow flaw. It was taking down these appliances,
• 2:45
  but specifically the ones configured to handle
• 2:47
  SAML single sign -on. Yeah, that was tracked
• 2:51
  as CVE -2026 -88779. It was rated an 8 .7 in
• 2:59
  severity. OK, so a big deal. And Citrix told
• 3:02
  everyone they were being actively attacked. Systems
• 3:05
  were crashing and they pushed out an emergency
• 3:07
  patch. So far, that just sounds like a standard
• 3:10
  Tuesday in cybersecurity. What made this a disaster?
• 3:13
  Well, what made it a disaster is what happened
• 3:16
  to the administrators who actually listened and
• 3:18
  did the right thing. Oh, no. Yeah. CISA, the
• 3:21
  U .S. cyber agency, put out the alert. IT teams
• 3:24
  gave up their weekends, logged in, and applied
• 3:27
  the Citrix patches to stop their gateways from
• 3:29
  crashing. Right, doing their jobs. Exactly. But
• 3:32
  just a few days later, Citrix had to issue another,
• 3:35
  far more urgent bulletin. Because it turns out,
• 3:39
  the very patches they just forced everyone to
• 3:41
  install contained a completely different, newly
• 3:44
  discovered vulnerability. Wait, are you saying
• 3:46
  the fix for the bug actually was a bug? Essentially,
• 3:50
  yes. The new vulnerability, which was CVE -2026
• 3:54
  -107406, was compiled into those patched builds,
• 3:59
  specifically the 14 .1 and 13 .1 versions. And
• 4:03
  this one was a 9 .5 rated remote code execution
• 4:07
  flaw. A 9 .5. That's almost as bad as it gets.
• 4:11
  Exactly. The first bug just crashed your system.
• 4:15
  It was a denial of service. Annoying, but manageable.
• 4:18
  Right. This new bug allowed an attacker to actually
• 4:21
  run their own malicious commands on your servers.
• 4:24
  So if you were a diligent IT administrator who
• 4:27
  patched your systems over the weekend, you inadvertently
• 4:30
  installed a catastrophic vulnerability into your
• 4:32
  own perimeter. And then you had to pull your
• 4:34
  team back in to patch it all over again with
• 4:37
  entirely new builds. Yep. It's a nightmare scenario.
• 4:40
  That sounds absolutely exhausting for a security
• 4:42
  team, but it also makes me wonder how we even
• 4:45
  measure the severity of these things. Because
• 4:47
  the terminology seems, I don't know, all over
• 4:49
  the place. It really is. Like, I'm looking at
• 4:52
  the Atlassian story from the exact same week.
• 4:55
  Atlassian makes JIRA and Confluence, those massive
• 4:58
  project management tools. Right. Very widely
• 5:01
  used. They disclosed a severe flaw in their self
• 5:04
  -hosted data center additions, a 9 .3 rating.
• 5:08
  But the label that gave it was an unauthenticated
• 5:10
  file read. I have to be honest, file read sounds
• 5:14
  incredibly mild. It does. It sounds like someone
• 5:17
  accidentally finding a PDF of the office party
• 5:20
  planning committee. Why was this treated like
• 5:22
  a five alarm fire? What's fascinating here is
• 5:25
  how our technical labels completely fail to communicate
• 5:28
  business risk. You are right. File read sounds
• 5:31
  passive. It describes the technical mechanism.
• 5:34
  The software allows someone without a password
• 5:36
  to read a file they shouldn't see. Right. But
• 5:38
  it completely ignores the operational impact
• 5:41
  of what file they are reading. OK, so. What exactly
• 5:45
  were they reading in this JIRA exploit? Well,
• 5:47
  to understand that, we have to look at how corporate
• 5:49
  single sign -on works. Most companies don't want
• 5:51
  employees remembering 50 different passwords
• 5:53
  for 50 different apps, right? Obviously not.
• 5:56
  So they use identity software. Atlassian has
• 5:59
  one called Crowd. When you log into JIRA, JIRA
• 6:02
  silently talks to Crowd in the background and
• 6:04
  says, hey, does this person have the right credentials?
• 6:07
  Makes sense. To do that, JIRA has a configuration
• 6:10
  file that stores its own special password to
• 6:13
  talk to Crowd. Let me guess. The file that the
• 6:15
  attackers were reading. Was exactly that configuration
• 6:18
  file. Yeah. A security firm named Watchtower
• 6:21
  got a hold of the exploit and proved that if
• 6:24
  you use this mild file read bug, you can pull
• 6:27
  the crowd configuration file, which stores the
• 6:30
  credentials in plain text. Oh, wow. In plain
• 6:33
  text. Plain text. And once the attackers have
• 6:36
  those credentials, Watchtower showed they could
• 6:38
  instantly forge a brand new invisible JIRA administrator
• 6:41
  account. So a file read isn't just someone peeking
• 6:45
  at my boring meeting notes. It's like someone
• 6:47
  finding the sticky note with the master safe
• 6:49
  combination written on it. Precisely. You've
• 6:52
  given them the keys to the kingdom. Are we fundamentally
• 6:54
  misunderstanding how we triage these threats
• 6:57
  just because the labels sound harmless? I think
• 7:00
  we are. And it wasn't theoretical either. Within
• 7:02
  days of this becoming public, automated systems,
• 7:05
  you know. honeypots that security researchers
• 7:07
  use to monitor attacks. They were logging over
• 7:10
  190 attempts from all over the world just trying
• 7:13
  to read that specific file. Just in a few days.
• 7:16
  Yeah. Atlassian's advice wasn't just apply this
• 7:18
  patch. Their blunt advice was, if your server
• 7:21
  is reachable from the internet, pull the plug
• 7:23
  immediately. Take it offline until it's fixed.
• 7:26
  Because even if you patch the file read bug,
• 7:28
  if they already read the file yesterday, they
• 7:31
  already have the password to your single sign
• 7:33
  -on system. Exactly. You have to patch the bug
• 7:36
  and then you have to go reset the credentials
• 7:38
  that connect Jira to Crowd just in case they
• 7:40
  were stolen. If you don't do both, you aren't
• 7:42
  secure. Which brings us right back to the central
• 7:44
  theme, right? The patch is just the beginning.
• 7:47
  Yep. But if we pivot from Atlassian to this Fortinet
• 7:51
  story, it seems like attackers are realizing
• 7:53
  they don't even need these complex zero -day
• 7:56
  code explodes to get inside anymore. They really
• 7:59
  don't. We just talked about highly sophisticated
• 8:01
  flaws in memory and code, but the next major
• 8:03
  threat doesn't require a sophisticated zero date
• 8:07
  at all. It just requires laziness. Oh, great.
• 8:11
  Yeah. The FBI and the U .S. Secret Service just
• 8:14
  dropped a joint advisory about a massive campaign
• 8:16
  they are calling 40 Bleed. And there is absolutely
• 8:19
  no new fancy vulnerability involved here. Yeah,
• 8:23
  I'm looking at the numbers. They are talking
• 8:24
  about over 86 ,600 compromised Fortinet firewalls
• 8:28
  globally. It's massive. And FortiGate firewalls
• 8:32
  are everywhere, especially for small and medium
• 8:34
  businesses. But if there's no new vulnerability,
• 8:36
  how are the hackers taking over 86 ,000 of them?
• 8:39
  Through pure technical debt and older, weak cryptography.
• 8:44
  Older configurations of FortiGate firewalls stored
• 8:47
  administrator passwords using a hashing algorithm
• 8:49
  called SHA -256. Okay, hashing is basically how
• 8:53
  a computer scrambles your password so it's not
• 8:55
  stored in plain text, right? Right. But by modern
• 8:58
  computing standards, if an attacker gets a hold
• 9:01
  of those SHA -256 hashes, they can throw massive,
• 9:05
  cheap cloud computing power at them and mathematically
• 9:07
  guess the original passwords offline in a matter
• 9:10
  of hours. Okay, so they crack the old passwords,
• 9:14
  but what they are doing next is pretty ruthless,
• 9:16
  right? They aren't just sneaking in and looking
• 9:18
  around. No, they are acting like digital landlords.
• 9:21
  Once they log in, they are actually changing
• 9:23
  the administrator passwords or deleting the rightful
• 9:26
  owner's accounts entirely. They're locking the
• 9:28
  IT teams out of their own firewalls. Exactly.
• 9:31
  Once they have exclusive control, they turn around
• 9:33
  and sell that access on the dark web to major
• 9:35
  ransomware cartels like the INC group, also known
• 9:38
  as Lynx, and the Payload group. They break the
• 9:40
  perimeter, change the locks, and sell the keys
• 9:43
  to the highest bidder. Pretty much. But wait,
• 9:45
  I thought Fortinet fixed this. Didn't they push
• 9:48
  out an update that uses a much stronger hashing
• 9:50
  method? They did. Newer versions of their operating
• 9:52
  system use an algorithm called PBK -DF2, which
• 9:56
  is designed to be incredibly slow and resource
• 9:58
  -intensive to crack. It effectively stops this
• 10:00
  kind of offline guessing. Okay. So companies
• 10:03
  updated their firewalls and assumed they were
• 10:05
  safe. Here's where it gets really interesting,
• 10:07
  though, because based on my reading of the briefing,
• 10:09
  upgrading the firmware doesn't automatically
• 10:11
  upgrade the old password sitting in the database.
• 10:14
  Nope. The system only replaces the old weak hash
• 10:17
  with the new strong hash when that specific administrator
• 10:20
  physically logs into the firewall again. You've
• 10:22
  hit the nail on the head. So let me get this
• 10:25
  straight. It's like installing a state -of -the
• 10:26
  -art security system in your house, but it doesn't
• 10:28
  actually turn on until every single person in
• 10:31
  your family walks up and presses their thumb
• 10:32
  on the scanner. That is a brilliant way to picture
• 10:35
  it. How many businesses think they are safe just
• 10:38
  because they ran an update? Most of them. Most
• 10:41
  of them. Think about the reality of a corporate
• 10:44
  IT department. You might have an admin account
• 10:46
  named Backup Admin or Vendor Access that was
• 10:49
  created three years ago. It has a weak password.
• 10:52
  The IT team clicks Update on the firewall, the
• 10:55
  system reboots, and the executives think, great,
• 10:57
  we are secure. But because no one has actually
• 11:01
  logged into that Vendor Access account since
• 11:03
  the update, its password is still sitting in
• 11:05
  the database, protected by the old, easily crackable
• 11:08
  algorithm. It's just a ticking time bomb. Exactly.
• 11:11
  And threat actors know this. This is a massive
• 11:14
  strategy shift. Why spend millions of dollars
• 11:16
  developing a zero -day exploit when you can just
• 11:18
  scan the internet for technical debt? Right.
• 11:21
  Attackers aren't just breaking in anymore. They
• 11:23
  are changing the locks, like in FortiBleed. And
• 11:26
  they're exploiting old, unmaintained setups.
• 11:28
  CISA actually just put out a warning about ancient
• 11:30
  flaws being exploited in software like ProFTPD,
• 11:34
  Apache Struts, and ISC Bind. Well, those have
• 11:37
  been around forever. Exactly. Which flows perfectly
• 11:39
  into the next warning in the brief. This one
• 11:42
  is from a coalition of international agencies,
• 11:44
  including the FBI and Australia's ASD and ACSC.
• 11:48
  They are tracking a Beijing -based state -sponsored
• 11:51
  group called Integrity Technology Group, which
• 11:54
  overlaps with the Flax Typhoon Group. And again,
• 11:57
  remaining totally impartial regarding the political
• 11:59
  or state actor aspect here, simply reporting
• 12:02
  the facts of the FBI warning, the actual method
• 12:05
  they are using to steal Microsoft 365 emails
• 12:07
  is shockingly mundane. It is the definition of
• 12:11
  mundane. They are simply password spraying Microsoft
• 12:14
  365 endpoints. Password spraying? Yeah. They
• 12:18
  take a massive list of common passwords, things
• 12:20
  like... company 2026 dot or welcome one and they
• 12:25
  just try them against thousands of user accounts
• 12:27
  hoping one employee made a bad choice hold on
• 12:30
  a second though i have to push back on this we
• 12:33
  have been told for years now to use multi -factor
• 12:35
  authentication true my corporate email requires
• 12:38
  me to tap a number on my phone or use an authenticator
• 12:41
  app every single time i log in from a new device
• 12:44
  How is simply guessing a password still working
• 12:47
  for advanced state -sponsored hackers? Well,
• 12:49
  because a corporate network isn't a monolith.
• 12:51
  Yes, your user account has MFA enabled, but attackers
• 12:56
  aren't usually targeting you. Who are they targeting?
• 12:58
  They are scanning for the one legacy service
• 13:02
  account that the IT team excluded from the MFA
• 13:05
  policy because it's used by an old automated
• 13:08
  scanner that doesn't know how to handle push
• 13:10
  notifications. Yeah, of course. Or... They're
• 13:13
  exploiting old legacy email protocols, which
• 13:16
  sometimes bypass modern authentication checks
• 13:18
  entirely if the tenant isn't configured perfectly.
• 13:21
  So they find the one rusty pipe that bypasses
• 13:24
  the main security valve. But once they get in
• 13:27
  through that weak point, what do they do if the
• 13:29
  IT team spots the breach and forces a password
• 13:32
  reset? Aren't the hackers locked back out? That
• 13:35
  is where the attackers get clever. and they build
• 13:37
  those back doors we mentioned once they are in
• 13:40
  they don't rely on the password anymore they
• 13:42
  use a framework called oauth to maintain persistence
• 13:45
  oauth that's the thing where a website asks do
• 13:50
  you want to sign in with microsoft or google
• 13:52
  right exactly when you click that you aren't
• 13:55
  giving the new website your password you are
• 13:57
  giving it an oauth token basically a digital
• 14:00
  permission slip that says this app has the right
• 14:02
  to read my emails okay i follow What these state
• 14:06
  -sponsored hackers are doing is logging into
• 14:08
  the compromised account once and immediately
• 14:11
  granting a malicious app an OAuth token. Oh,
• 14:14
  I see where this is going. It's like giving someone
• 14:16
  a VIP wristband at a club. Even if management
• 14:19
  changes the locks on the front door, the bouncer
• 14:22
  still lets the guy with the VIP wristband in
• 14:24
  through the side entrance. That's it exactly.
• 14:26
  They build their own web portals to browse the
• 14:28
  stolen mail using these tokens. Even if the victim
• 14:31
  realizes they were hacked, panics, and changes
• 14:34
  their password, The token remains valid. The
• 14:37
  back door stays wide open until an administrator
• 14:39
  specifically hunts down and revokes that OAuth
• 14:43
  application. Again, resetting the password is
• 14:45
  only the start of the job. So if human hackers
• 14:49
  and state -sponsored groups are easily finding
• 14:51
  these old firewalls and forgotten accounts, what
• 14:54
  happens when we unleash automated AI systems
• 14:57
  to do the scanning? Because that seems to be
• 14:59
  the next frontier in the briefing. This is the
• 15:01
  intersection where things get truly chaotic.
• 15:03
  We are moving from human -driven exploitation
• 15:05
  to automated AI reconnaissance. Right. And there
• 15:09
  are some wild examples here. The Wikimedia Foundation,
• 15:12
  the organization that runs Wikipedia, caught
• 15:14
  AI agents, which they believe were operated by
• 15:17
  OpenAI, wandering into places they definitely
• 15:20
  shouldn't be. Yeah, that was a strange one. These
• 15:22
  bots were making edits in Wikipedia sandboxes
• 15:25
  and attempting to use a citation tool as a proxy,
• 15:27
  which Wikimedia openly called potentially malicious
• 15:30
  behavior. And it wasn't an isolated event. Over
• 15:33
  in Australia, an open AI agent somehow navigated
• 15:37
  its way into a web app run by the New South Wales
• 15:40
  National Parks app. Wait, really? What was it
• 15:42
  looking for? It was an internal facing tool holding
• 15:44
  historical fire data. It just wandered in. So
• 15:47
  these AI agents are essentially like digital
• 15:49
  raccoons wandering into our digital backyards,
• 15:52
  right? Just jiggling the door handles on old
• 15:54
  cheds we forgot we even built. That's a great
• 15:56
  way to put it. They don't necessarily know what
• 15:58
  they are looking for, but if a door is unlocked,
• 16:00
  they are going inside. This raises an important
• 16:02
  question, though, doesn't it? If your raccoon
• 16:04
  finds your unlocked shed, it might make a mess.
• 16:06
  But what happens when that raccoon is backed
• 16:09
  by a trillion -dollar data center? Okay, yes,
• 16:12
  let's talk about the money. Because the brief
• 16:14
  includes these massive financial stories that
• 16:16
  initially seemed out of place in a cybersecurity
• 16:18
  discussion. You have Firmus, which is an NVIDIA
• 16:22
  -backed AI data center operator, and they completely
• 16:24
  shelved a $5 billion US IPO. Yeah, that made
• 16:28
  huge waves. Investors panicked because the company
• 16:30
  had something like $30 billion in debt versus
• 16:33
  only two operating sites. It sounds like a severe
• 16:36
  reality check, like the AI bubble bursting. It
• 16:39
  is a massive financial reality check for some.
• 16:42
  But you cannot look at Firmus in a vacuum. Because
• 16:45
  in the exact same week, a traditional industrial
• 16:48
  giant, Schneider Electric, dropped $22 .6 billion
• 16:51
  in cash to buy a U .S. software company called
• 16:55
  PTC. $22 .6 billion in cash? For what? Well,
• 17:00
  PTC makes the design software used to engineer
• 17:02
  massive physical infrastructure. Schneider Electric
• 17:05
  is betting the farm on the software needed to
• 17:07
  design the factories, the cooling systems, and
• 17:09
  the power grids that the next generation of AI
• 17:12
  data centers will require. Okay, but how does
• 17:14
  corporate finance connect back to the digital
• 17:16
  raccoons and the cybersecurity threats we've
• 17:18
  been talking about? It connects through scale.
• 17:21
  The financial markets might be punishing companies
• 17:23
  with bad debt like Firmis, but the underlying
• 17:25
  infrastructure build out, you know, the sheer
• 17:27
  compute power being constructed globally is accelerating.
• 17:30
  I see. Schneider's massive bet proves that the
• 17:33
  resources backing these AI models are going to
• 17:36
  double, triple and quadruple in the coming years.
• 17:38
  So the scraping bots, the digital raccoons, they're
• 17:42
  getting jetpacks. Exactly. The tech industry
• 17:45
  is in an AI infrastructure gold rush. These highly
• 17:48
  funded models are aggressively scraping the web.
• 17:51
  They are mapping the internet constantly. Which
• 17:54
  means? This means any unmaintained internet -facing
• 17:57
  web app you have, that old Jira server, that
• 18:00
  unpatched Fortinet firewall, will be found. It
• 18:04
  is no longer a matter of if a human hacker stumbles
• 18:07
  across it. It is a mathematical certainty that
• 18:10
  an automated agent will index it. The lesson
• 18:13
  for the listener is the days of hiding in the
• 18:15
  noise of the Internet are over. If it's on the
• 18:18
  Internet, you either maintain it relentlessly
• 18:20
  or you take it down. Security through obscurity
• 18:23
  is dead. And I think this brings all our threads
• 18:26
  together perfectly. How so? Well, whether you
• 18:29
  are dealing with a memory flaw on Citrix, a cracked
• 18:32
  password on a Fortinet box, an OAuth backdoor,
• 18:35
  or an AI bot roaming your infrastructure, the
• 18:39
  technology is almost secondary. The primary failure
• 18:42
  is human follow through. Right. Look at the final
• 18:45
  report in your brief from the OVIC, the Office
• 18:48
  of the Victorian Information Commissioner in
• 18:50
  Australia. Yeah, this was regarding a severe
• 18:52
  student data breach at the Victorian Department
• 18:54
  of Education. And honestly, reading the timeline
• 18:57
  of this incident is incredibly frustrating. It's
• 19:00
  the ultimate proof of our central theme. The
• 19:03
  report investigated how the breach happened,
• 19:05
  and it found that a critical software patch simply
• 19:07
  wasn't applied at one specific school. But here
• 19:10
  is the kicker. It wasn't because of a lack of
• 19:13
  intelligence. No, not at all. The Australian
• 19:15
  Signals Directorate issued a high -priority alert.
• 19:18
  And the Department of Education issued a same
• 19:21
  -day directive to all schools way back in October
• 19:23
  telling them to patch immediately. But the report
• 19:25
  explicitly states that timely and effective patching
• 19:28
  just did not occur at the school level. The alert
• 19:31
  went out. The directive went out. The patch didn't
• 19:34
  go on. Exactly. The department is now actually
• 19:37
  planning to centrally manage vulnerability patching
• 19:40
  for all schools by the end of 2028 because relying
• 19:43
  on decentralized individual human action completely
• 19:46
  failed. So what does this all mean? It means
• 19:49
  you can buy the most expensive threat intelligence
• 19:50
  feeds in the world. You can get early warnings
• 19:53
  from the FBI, the ASD, and international cyber
• 19:56
  agencies. Yep. But without the operational discipline
• 19:59
  to actually execute. to apply the patch, to audit
• 20:03
  your single sign -on setup, to physically log
• 20:06
  in and force a password reset on an old firewall
• 20:08
  account. All of that intelligence is entirely
• 20:11
  useless. It is. The alert goes out, but if the
• 20:14
  patch doesn't go on, the game is over. And I
• 20:17
  want to leave you with a final thought to mull
• 20:19
  over, building on a tiny detail from the Atlassian
• 20:22
  Jira story we discussed earlier. Oh, lay it on
• 20:25
  us. When Atlassian disclosed that 9 .3 rated
• 20:28
  vulnerability, the one that let attackers steal
• 20:30
  single sign -on credentials, there was a crucial
• 20:33
  caveat in the bulletin. The source noted that
• 20:36
  Atlassian had already patched the vulnerability
• 20:39
  for all of their cloud customers behind the scenes.
• 20:42
  Wait, really? Yeah. The cloud customers never
• 20:44
  had to lift a finger. The only people left exposed
• 20:47
  to the internet were the self -hosted users,
• 20:50
  you know, the organizations that insisted on
• 20:52
  running the software on their own physical servers.
• 20:54
  Wow. I missed that entirely. It asks a very uncomfortable
• 20:58
  question of the IT industry. For decades, self
• 21:01
  -hosting your own infrastructure was seen as
• 21:02
  the ultimate sign of security and control. Right,
• 21:05
  because you own the hardware. Exactly. But given
• 21:08
  the speed of these automated threats and the
• 21:10
  sheer human exhaustion of keeping up with daily
• 21:12
  emergency patches, are we rapidly approaching
• 21:15
  a tipping point? What kind of tipping point?
• 21:18
  Is self -hosting your own IT infrastructure no
• 21:20
  longer a sign of control, but actually becoming
• 21:23
  a fundamentally irresponsible risk for... all
• 21:25
  but the most heavily resourced organizations.
• 21:28
  Because if you demand to hold the keys to your
• 21:31
  own front door, you have to be the one to fix
• 21:33
  the lock when it breaks. And right now the automation
• 21:35
  knocking on that door is much faster than the
• 21:38
  human assigned to fix it.