Security holes are inevitable, but you don't have to fall in
Connecting state and local government leaders
It seems to make headlines at least once a week: 'Security hole discovered in X, Y and Z software.' Usually by the time you read the article a fix has been created and is available at one or several Web sites. But how do you know the fix works?
It seems to make headlines at least once a week: 'Security hole discovered in X, Y and Z software.' Usually by the time you read the article a fix has been created and is available at one or several Web sites. But how do you know the fix works? Not too long ago it was Apache Web software, developed by the collaborative Apache Software Foundation, that came under the gun when security vulnerabilities were discovered in this crucial bit of software used by more than half of all Web servers. The problem was that a third-party company from Atlanta called Internet Security Systems rushed out a fix, and the makers of Apache were never notified. That's like a nurse administering an antidote to a patient without telling the doctor. A bigger problem came when the fix turned out to be a flop and didn't plug the holes, which were related to remote server access and could leave a system open to a denial-of-service attack. The moral of the story: Stronger beta testing and more robust policies and protocols are needed when vulnerabilities are discovered in software. Problems with a key piece of software are routine in the computer industry. But if we went back to the days when beta testing took months instead of weeks as it does now'and were conducted by a hand-picked group of experienced professionals rather than novice users'the problems would appear sooner rather than later and so would the fixes. I'm sure many of you have served as crucial beta testers for Microsoft Corp. without knowing it'you volunteered by buying Windows 98, ME or 2000. It wasn't until XP came out that Microsoft got it right. Why? More extensive beta testing that covered all the data they had on what went wrong with previous Microsoft OSes.With XP, Microsoft also introduced automatic updates, which until then were found only in antivirus software. The result of Microsoft's extensive beta testing after the release of Windows 98 is the company's strongest OS ever.But this still doesn't tell us what to do about Apache or other software that might fail. That's where policies and standards come into play. The GCN Lab has been reviewing security software, such as Stormwatch from Okena Inc. of Waltham, Mass., that monitors networks for suspicious behavior.Stormwatch is designed to complement a network that has antivirus policies and firewalls already established. It acts as a general manager of security and, more important, as a monitor for suspicious behavior through a series of preprogrammed templates. These templates have parameters for how each part of your network'files and software included'should behave. Any unusual behavior will be frozen, and the administrator will be notified. In lab tests, we used hacking utilities to perforate an average secure network, and Stormwatch stopped the attack because the utilities acted against policy. That's just one example, but having effective monitoring software, firewalls and antivirus policies in place can prevent disasters despite vulnerabilities such as the one in Apache Web Server. And combined with good communication among security teams and better beta testing, you just might be able to stay out of the headlines.
Carlos A. Soto
NEXT STORY: Nuclear safety agency rejects IT audit