How MuleSoft patched a critical security flaw and avoided a disaster

guest · Sep 1, 2019

How MuleSoft patched a critical security flaw and avoided a disaster
MuleSoft deals with a sensitive security issue and sets up an example for the whole industry to follow
September 1, 2019
https://www.zdnet.com/article/how-mulesoft-patched-a-critical-security-flaw-and-avoided-a-disaster/

John is a software engineer and a pretty good one. He works for a company that processes online payments. On Thursday, August 1, John's bosses pulled him into an urgent security meeting.

MuleSoft, a company now owned by Salesforce, makes middleware. Middleware is what engineers call "software glue." You can find it in all big companies across the world.
Middleware can be used to link cloud apps distributed across tens, hundreds, or thousands of servers, but it can also be used on smaller networks, to translate data as it moves between apps that work in different formats. Everybody uses middleware. Everybody!
THE SECRET MULESOFT NOTIFICATION EMAILS
As he sat through the meeting, John learned about a security vulnerability in MuleSoft's Mule runtime and API gateways, two of the company's most popular products.

MuleSoft had asked the recipients of the emails not to share the security alert's content with anybody, not even verbally. The company described the vulnerability's existence as a "need to know" issue.
Obviously, the email leaked. It leaked on Twitter, in Slack and Discord channels, and on Telegram groups.
Click to expand...

A NOVEL APPROACH TO NOTIFYING CUSTOMERS
Furthermore, Sarid said that MuleSoft had taken an unprecedented step of seeking out and talking to each company's security and DevOps departments, and not just secretaries or sales representatives.

"We literally had thousands of calls with these customers, and the interesting thing is that the customer feedback you might imagine would be worrisome, but it's actually been overwhelmingly positive," Sarid told ZDNet in a follow-up phone call this Friday.
Sarid hopes that other companies follow MuleSoft's approach when dealing with a major security flaw, instead of dumping a security advisory on a support page buried somewhere on their websites, where very few people know to look, without bothering to notify customers via something as basic as an email, let alone a phone.
Click to expand...

Log in or Sign up

How MuleSoft patched a critical security flaw and avoided a disaster

guest Guest

Log in or Sign up

How MuleSoft patched a critical security flaw and avoided a disaster

guest Guest

Useful Searches