Heartbleed FUD: scarier than Jedward as triplets?

The potential seriousness of such a vulnerability as Heartbleed cannot be downplayed, that's for sure. However, arm waving and running around informing everyone the sky is falling is not the way to deal with any crisis though. Indeed, even if the sky were falling down it wouldn't do much good.

As the media, the IT security industry, open source pundits and Joe User alike get swept away by the story so the FUD floodgates have opened. And FUD (that's Fear, Uncertainty and Doubt) would be a more unwelcome trio than if Jedward were triplets.

Not every site out there has been touched by this vulnerability, not every site uses OpenSSL. But plenty have and do. It's not the end of the internet, and it's not open day for the bad guys either as although grabbing sensitive data is by all means possible it's by no means a walk in the park.

From the enterprise perspective the FUD-free advice is for your pre-existing disaster plans to kick in and find those machines which are vulnerable, patch them and do the revoke and reissue thing before auditing the nature of any potential exposure and getting on with your business.

From the end user perspective, there are tools out there already which will tell you if a service was vulnerable to Heartbleed and, importantly, whether it has patched, revoked and reissued; if it has it will then recommend you change your password for that service.

As for the bad guys, I expect a flood of fake password reset notifications to start rolling out real soon now. I didn't think I would end this piece with a Celine Dion reference, but I imagine the Heartbleed FUD will go on...

Davey Winder

Davey is a three-decade veteran technology journalist specialising in cybersecurity and privacy matters and has been a Contributing Editor at PC Pro magazine since the first issue was published in 1994. He's also a Senior Contributor at Forbes, and co-founder of the Forbes Straight Talking Cyber video project that won the ‘Most Educational Content’ category at the 2021 European Cybersecurity Blogger Awards.

Davey has also picked up many other awards over the years, including the Security Serious ‘Cyber Writer of the Year’ title in 2020. As well as being the only three-time winner of the BT Security Journalist of the Year award (2006, 2008, 2010) Davey was also named BT Technology Journalist of the Year in 1996 for a forward-looking feature in PC Pro Magazine called ‘Threats to the Internet.’ In 2011 he was honoured with the Enigma Award for a lifetime contribution to IT security journalism which, thankfully, didn’t end his ongoing contributions - or his life for that matter.

You can follow Davey on Twitter @happygeek, or email him at davey@happygeek.com.