If you worked in IT then you’ll know much about what happened last week. I started off pretty badly. On the Monday the SaaS hosted applicant tracking system of the company I work for went offline due to a cyber attack, later on a certificate authority in India was found to have used weak keys in their root certificates, and then finally PHP2Shell was disclosed which sent us all in a panic.

That’s just the headlines.

More With Less Is Dead

You’ve probably heard “we’ll be doing more with less from now” or variants of for a lot of your career. When I joined the workforce back in 2007 it was as the great global recession hit. Also since I’ve been in the workforce there’s been an insatiable movement to make do with less expenditure on people, services, equipment, warranties, support agreements, you name it. Basically anything counting as expenditure seems to get trimmed, and trimmed, until there’s no more to trim.

Things like PHP2Shell are exactly why that trend is now dead. No amount of automation, AI, “headcount restructuring”, or any other initiative is going to make things any better in terms of IT security and it’s time to wake up. In its place there needs to be a move to to well trained, well staffed, well equipped teams that have the resources to deliver modern IT services. We just can’t do that if the focus is always on delivery of shareholder value. We need to be shifting priorities to defence, retiring legacy systems, and improving skillsets for the future.

Special mention. We can’t have entire days where attackers can have a free run at the whole internet. When Log4Shell happenned there was much discussion about how much support (ok, cash) was given to the Log4J project given it was in use by so many commercial systems developed by multi-billion dollar multinationals. The open source projects that matter need real support now otherwise it’ll end up a bloodbath someday.

I don’t know when things will settle down with AI-driven bug hunting. In October’s patch bulletin from Microsoft well over 1000+ fixes were present in the Windows patch load. When PHP2Shell was leaked it was assumed there’d be a 15 minute window between the formal announcement & patch to attacks being mounted. We had to assume that the internet might just end up on fire. With frightening stats like that we need to have the resources necessary to protect the systems we look after.

All the best everyone. This is my manifesto.