Test System Security
Importance of Installing Security Updates
The first NI screen we see is the LabVIEW launch screen and then either the project selection dialog or we just doubled the lvproj file and it opens directly.
3 suggestions from the top of my head:
1. Show the update status in the main project dialog and the project selection dialog.
a. A never check for update could be shown clearly as bad idea
2. The update preferences should be front center in each main NI application instead of hidden away in a separate application
3. Important update should be announced in product as an extra dialog pop-up which should be harder to ignore than just clicking cancel or enter, to make people evaluate the message, ignoring will be willful then
NI package manager should also show the update and possibly highlight patches for high CVE scores
Also I think it's a good idea to publish a white paper on the NI architecture for update distribution from the NI Update Service all the way to the hardware firmware both in development and with deployed applications and targets. The current mention of the Securty Update is a one liner, we need to be able to plan and for that we would like more information on how updates are designed to flow down to the nooks and crannies of the Ni ecosystem.
Hi Evan,
Many reasons that patch isn't applied :
1. Where I work, every updates are checked first by an internal security team. Therefore, the NI update service is disabled on every client computer.
Updates are packaged and distributed through our internal channel. Released pushed by NI are considered 'untrustable' until they are verified.
So users do NOT see these updates. And there is no notification that pops-up where it couldn't be missed (Windows notification, LV/TS/VS/MAX splash screen, ...)
2. First thing a user see when opening NIPM is that NIPM must be updated... Automatic updates are forbidden where I work. Therefore NIPM must be audited first by an internal security team. So we're back at point 1. It is a nonsense that NIPM must be so frequently updated, many people told NI many times about this.
3. Since NI shifted to subscription schema, we didn't see any change regarding LV updates for example. Peole are still used to update their installation only twice a year, at most. If NI were regularly publishing updates on their major tools (LV, TS, VS), maybe people would get used to update their installations more regularly.
4. Release documentation is historically very poor with NI product, even on the major ones.
When an update is published, customers require the update to be well documented (list of all changes, dependencies, behavior changes expected, registry modifications, etc) and explained.
One more suggestion reading the last post :
I receive an average of a hundred email per day. Between work email and commercial emails, I sometimes do not take a deep look at all the emails.
I would suggest prefixing the email subject with 'NI SECURITY UPDATE' (or something similar). It would better catch the eye.
When I read 'NI Releases New...' I think first about a commercial email for some new product rather than a critical update that I should apply in no time.
Having the sender of those messages defined would help just as well.
Yet that would be convenience provided by NI 😉
Don't think we can make NI responsible for our Inbox-Mess 😀
My suggestion is simply that the email subject should better reflect the importance of the message, rather than being perceived as a promotional or commercial email.
