Unpatched software in a development environment

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A developer's laptop is missing three months of operating system security updates. What does this give an attacker?

A Nothing, because only production servers can be attacked

B Known flaws they can exploit to reach the source code stored on the laptop

2. Which statement about an unpatched build server is correct?

A It can let an attacker reach the code it builds and the secrets it holds

B It is safe because it only compiles code and never holds sensitive data

3. A patch for a flaw in a testing server was released two weeks ago but has not been installed. Which is true?

A The server is safe until the flaw is exploited in production

B The flaw is publicly known, so the server is exposed during this delay

4. Which software in a development environment can be unpatched and so create a risk?

A Operating systems, developer tools, libraries and servers

B Only the finished application running in production

5. Why is delaying the installation of a security patch risky?

A Attackers can exploit the known flaw while the patch is not installed

B The patch will stop working if it is installed late

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Unpatched developer laptop		AA developer's machine missing OS or tool updates, so attackers can use known flaws to reach source code and saved credentials
2Unpatched build server		BDev machines and test servers hold code and data too. Leaving them unpatched gives attackers a way in, so they must be patched as well.
3Patch gap: the delay between a patch being released and it being installed, during which known flaws can be exploited		CDelaying installation widens the patch gap. Known flaws stay open and attackers can exploit them, so patches should be installed promptly after testing.
4A development environment is only as secure as its oldest unpatched part, so every OS, tool, library and server needs patching		DA server that compiles and tests code but is missing security updates, so attackers can use it to tamper with builds or read project data
5Only patch the production server; leave developer laptops and test servers as they are		Efor each item in [OS, IDE, library, server]: if patch_available: install_patch(item)
6if patch_available: wait_until_next_year()		Fpatch_released = 1 June; patch_installed = 30 June; exposed_days = 29

Definitions

Unpatched software

Fill in the Blanks

Complete each line of code by filling in the missing parts.

if installedVersion _ patchedVersion: print("Update needed")

delayDays = installDay _ releaseDay

___ server in buildServers: applyPatch(server)

if delayDays _ 14: print("Patch overdue")

if devLaptopPatched == _____: print("Unpatched developer laptop")

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A FOR each pc IN devPCs

B IF pc.patched = FALSE THEN

C flag(pc)

D ignore(pc.updates)

E ENDIF

Question 2

A IF patchReleased = TRUE THEN

B skipPatch(buildServer)

C ENDIF

Question 3

A FOR each srv IN testServers

B IF srv.os > latest THEN

C updateOS(srv)

D ENDIF

E ENDFOR

Question 4

A FOR each lib IN project.libs

B latest ← getLatest(lib)

C IF lib.version = latest THEN

D update(lib)

E ENDIF

Question 5

A IF pc.autoUpdate = OFF THEN

B risk ← LOW

C ELSE

D risk ← HIGH

Answer Key

Unpatched software in a development environment

Section A: Quick Questions

B — Known flaws they can exploit to reach the source code stored on the laptop

A — It can let an attacker reach the code it builds and the secrets it holds

B — The flaw is publicly known, so the server is exposed during this delay

A — Operating systems, developer tools, libraries and servers

A — Attackers can exploit the known flaw while the patch is not installed

Section B: Match the Pairs

Unpatched developer laptop → A developer's machine missing OS or tool updates, so attackers can use known flaws to reach source code and saved credentials

Unpatched build server → A server that compiles and tests code but is missing security updates, so attackers can use it to tamper with builds or read project data

Patch gap: the delay between a patch being released and it being installed, during which known flaws can be exploited → patch_released = 1 June; patch_installed = 30 June; exposed_days = 29

A development environment is only as secure as its oldest unpatched part, so every OS, tool, library and server needs patching → for each item in [OS, IDE, library, server]: if patch_available: install_patch(item)

Only patch the production server; leave developer laptops and test servers as they are → Dev machines and test servers hold code and data too. Leaving them unpatched gives attackers a way in, so they must be patched as well.

if patch_available: wait_until_next_year() → Delaying installation widens the patch gap. Known flaws stay open and attackers can exploit them, so patches should be installed promptly after testing.

Section C: Definitions

Unpatched software — Software missing security updates, so known flaws stay open. In a dev environment, attackers can use them on developer machines or build servers to reach code and data.

Section D: Fill in the Blanks

if installedVersion < patchedVersion:
    print("Update needed")

delayDays = installDay - releaseDay

for server in buildServers:
    applyPatch(server)

if delayDays > 14:
    print("Patch overdue")

if devLaptopPatched == False:
    print("Unpatched developer laptop")

Section E: Spot the Error

D — A developer machine that is missing patches must have its updates installed. Ignoring them leaves known flaws open for attackers to use to reach the code. It should be install(pc.updates).

B — Once a patch has been released, it must be installed on the build server. Skipping it keeps the delay between release and installation going and leaves the server exposed. It should be installPatch(buildServer).

B — The test server needs updating when its OS version is older than the latest version, so the check should use <. With > the outdated servers would never be updated.

C — A library should be updated when its version is older than the latest one. Testing for equality only updates libraries that are already current, so outdated ones stay vulnerable. It should be lib.version < latest.

A — The risk is LOW when automatic updates are ON, because patches get installed. Testing for OFF gives a LOW rating to machines that are not being patched. The condition should be pc.autoUpdate = ON.