Extended Support Isn't Extended Security: Managing Vulnerabilities in ELS Linux Environments

Summary

You have a Linux server. It is running an enterprise operating system. The operating system is still under vendor support. Your vulnerability scanner reports 37 vulnerabilities. The application team says: "The OS is supported. Why are you asking us to patch it?" The vulnerability team says: "The scanner says it's vulnerable." Now you have a meeting between security, infrastructure, application, and risk teams. So who is right? The answer is: It depends. This is where Extended ...