Patch management software grows up

The second Tuesday of every month has become a red-letter day for computer security professionals. Microsoft has turned it into Patch Tuesday, the day that heralds the latest round of hot fixes and bug patches for the Windows operating system and other Microsoft programs.The Redmond giant picked a specific day to drop its load of fixes on administrators' shoulders in part for the admins' benefit. This way, at least, folks can plan ahead for a day of pain.Multiply the number of patches in a month by the number of computers that need them, and you'll grasp the math of misery that faces an organization with no automated way to deal with the task. And while Microsoft's patch parade represents a majority of the software fixes foisted on IT professionals, it certainly isn't the only source of them.The problem is, the bad guys get the patch data on the same day, or sooner. And every hour that passes between the announcement of a new patch and its actual installation on vulnerable systems raises a network's risk level. Last year's SQL Slammer worm and the infamous Code Red attack of 2001 both exploited known vulnerabilities Microsoft had already issued patches for.Then there's the issue of compatibility. Some patches may actually break an application already installed on a network. Clark Owen, network engineer for the City of San Jose's Transportation Department, said one Microsoft patch disabled Microstation, a computer-aided design package from Bentley Systems that the department relied on.So it's easy to see why patch management software'tools designed specifically to test and deploy fixes for software defects and other potential security vulnerabilities'has become one of the fastest-growing segments of the software market. Analysts from Yankee Group in Boston expect the global patch management market to grow from $70 million in 2003 to $300 million in 2008.Patch management tools don't just automate rolling out patches. They help prevent many of the problems a patch rollout can cause. Depending on the number of systems in an organization'and how critical their operation is'the workflow elements of a patch management tool can be just as important as its ability to deliver the patches.The first part of the process is determining which systems are vulnerable. Scans are done either by remotely examining a system through a series of service requests and remote procedure calls, or by running a script or agent software program on the machine being examined.The next step is to make sure patches will work'and that they won't break other software. Some tools, such as Citadel's Hercules, include a subscription service from their vendors that includes certification of patches, including a full dependency check.Finally, admins must get the patches out to the machines. An important workflow feature to look for'particularly if you're managing a large network or multiple sites'is patch staging.Distributing patches over the network from one server to a few thousand clients, even during off-peak hours, can create a glut of network traffic and slow rollout. Staging servers distribute patches from various places throughout a network, closer to the target machines.After rollout, patch management tools can also ensure that new systems on the network'such as mobile users connecting from a laptop'are quickly brought up to the proper patch level. And if, after all that, a patch turns out to cause more problems than the vulnerability it fixes, patch management tools help remove or roll back the offending fix.San Jose's Transportation Department started using St. Bernard's UpdateEXPERT software two years ago, according to Owen. 'Before that,' he said, 'we had to do [patch deployment] machine by machine for our 100 desktops.'The resulting savings in man-hours have been dramatic. Now Owen tells users to leave their systems on at the end of the day and schedules a deployment of patches overnight. 'It's been very good. I'm pretty comfortable with it,' he said. 'But I still do the servers manually.'Several products in this guide also allow administrators to establish a required state for client systems, a combination of patches, configuration settings and active services.'Patch tools go after software defects, but those are only 25 to 30 percent of your overall vulnerabilities,' said Dave Donovan, vice president of public sector for Citadel. Citadel's Hercules software is one of a new breed of tools for automated vulnerability remediation. AVR software is focused not just on delivering software patches to computers that need them, but on enforcing an overall configuration policy.In fact, Citadel offers out-of-the box templates for meeting the Defense Information Systems Agency's Security Technical Implementation Guides, as well as Federal Information Security Management Act standards. NetIQ Vulnerability Manager, a companion product to that company's patch management tool, also helps with FISMA compliance.AVR software has already been widely adopted by federal agencies, including the Department of Defense; DISA has purchased enterprise licenses for Citadel and eEye's solutions, for example.But the first line of defense for the average networked agency is still well enforced user policies and standardized systems. Patch management can at least help system administrators keep focused on those, while taking the grunt work of Patch Tuesday off their hands.