Кибербезопасность: города переходят от массовых обновлений к приоритизации уязвимостей

Arlington, Texas, CISO Bryce Carter likes a piece of advice that came from his city manager: “We can do anything, but we can’t do everything.” Looking back at a summer in which monthly patch lists hit staggering highs, the advice holds. To put it in perspective, Microsoft’s July security updates addressed 663 common vulnerabilities and exposures, followed by another 457 in August, although totals vary depending on how analysts count them. But what is agreed upon is that level of patching is basically unprecedented. In fact, some experts are referring to this new flood of AI-driven vulnerability discoveries as the “Patch Apocalypse.” And so trying to apply every fix recommended by a software vendor becomes a numbers game that is difficult to win, Carter said. Instead, cybersecurity teams need to understand their own risk environments and separate critical vulnerabilities from lower-priority weaknesses before then applying fixes accordingly. “We really have to risk-weight things today,” Carter said. Previously, the response might have been: “Microsoft released a new update. Let’s go ahead and roll it out to everyone.” “But wait. Are these really our most critical vulnerabilities? I think now it’s framing priorities: what is publicly facing? Is it exploitable? What’s the criticality? These things matter to me. I care less about the number of things you can patch. I care more about patching the right things.” The record patch volume comes as frontier AI systems gain the ability to find and exploit software vulnerabilities. Anthropic introduced Claude Mythos Preview in April, accelerating both defensive discovery and concerns about how bad actors access and use AI for attacks. Carter said that “chasing zero” is an impossible goal and that organizations must avoid a cookie-cutter approach as departments within a city have unique risk profiles. But Carter, obviously, is not the only cybersecurity leader battling the Patch Apocalypse. Robert Branch, CISO for Virginia Beach, Va., also emphasized the risk perspective, saying his considerations include whether a system is Internet-facing, what security controls are in place and what functions the system supports, among other things. For example, some systems are exceedingly vital. Public safety departments support life-and-death operations, while water systems also make for very attractive targets. “Let's look at it from a real risk perspective,” Branch said. “Not, ‘Now Microsoft has 600 vulnerabilities, so we’ve got to go back.’ We’re still going to have to do that, but how many of those are really critical?” His advice is to prioritize exploitable vulnerabilities and systems that are attractive to threat groups, pinpointing those as the highest-priority actions. Branch pointed to a recent vulnerability affecting on-premises Microsoft Exchange servers as an example. Although Microsoft rated it fairly high, Virginia Beach’s servers were not exposed to the Internet, reducing the city’s immediate risk. “We’re already on the latest patch and just need to install a hot fix,” Branch said. “Do we have other mitigations that we’ve already tweaked and knobs we’ve turned and sliders we’ve moved up and around? Yep.” Those safeguards did not eliminate the need for the hot fix, but they meant engineers did not have to install it immediately. Other organizations could face greater urgency if their Exchange servers were Internet-facing and several versions behind. Arlington has more than 400,000 residents, while Virginia Beach has more than 450,000. As such, both cities have dedicated in-house technology staff and modern security tools, but even so, the work still can be time-consuming. Virginia Beach brought in temporary outside staff to help manage the volume through mid-October. Branch leads a 10-person cybersecurity team, including a three-person risk and compliance group that oversees vulnerability management. But what about smaller municipalities? They may need shared services or outside support, and so they can lean on their peers, use Cybersecurity and Infrastructure Security Agency resources or join the Multi-State Information Sharing and Analysis Center, Branch said. This all marks a relatively recent change from how patching has been done in the past. Vulnerability management had matured into a largely manual process in which a newly disclosed flaw generated a ticket, Carter said. But growing volume due in part to AI is making that model increasingly difficult to sustain. Both CISOs say they believe AI will ultimately help human teams prioritize vulnerabilities by analyzing far more information than practitioners can process themselves, including system exposure, asset criticality, existing safeguards and emerging threat activity. “I don’t think we are yet at a point where you can just kind of give it to an AI agent or an AI system and let the system run itself,” Branch said. “But we’re going to have to start looking at that automation and adding that intelligence layer into cybersecurity operations across the board, whether that’s vulnerability management or threat detection and response. We have to be able to automate it. We can’t just rely on human response time.”