You don’t have to patch!
summary
Patching often takes weeks: testing, vendor coordination and rollouts delay fixes and patches sometimes fail to remove the vulnerability. Concrete mitigations shrink blast radius: use SBOM and Content Security Policy to remove unneeded libraries, network segmentation and iptables to limit lateral movement, system sandboxing with seccomp and AppArmor to block ImageMagick command injection, and browser-side isolation with WPI which stops XSS-driven form exfiltration while the app remains unpatched.
AI-written summary · about
chapters (9)
- 0:00Introduction and provocative title
- 1:27Why patching is hard
- 3:34Myth of patching as moral obligation
- 7:11Attack surface reduction strategies
- 11:07Network isolation demo
- 12:11System isolation with AppArmor
- 16:05Application isolation with WPI
- 20:41Alternatives to patching
- 22:34Q&A session
related talks
23mConflicts in Vulnerability Management and Patching
28mSo You Think You Can Patch
22mGive up! Just stop patching vulnerabilities!
18mWhat it Takes to Patch High Impact Vulnerabilities: A Retrospective on WebP CVE
53mThe Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android
35mMeasuring change: Responding to cyber material risk
30mThe **** we've seen
40mEmbracing Security - A Changing DevOps Landscape