The automated fix is in for DOD patches

For the first time, 500 million Defense Department computers on the Global Information Grid will automatically have software vulnerabilities patched as soon as the fix becomes available.

A Nov. 3 policy directive requires the military services to phase out their manual processes and use commercial and government tools to immediately repair holes in applications that reside on DOD's classified and unclassified networks.

'The DOD GIG is probed and scanned hundreds of times each day by sources looking to take advantage of vulnerabilities in the system,' said Timothy Madden, spokesman for the Joint Task Force for Global Network Operations. 'One of the ways to counter these intrusion attempts is by employing tools designed to automatically repair vulnerabilities as soon as the patches become available, rather than wait for individuals to update their systems. The results would be that all patches would be installed immediately.'

The Communication Tasking Order, a policy directive from the commander of the Strategic Command that has not been made available for general release, sets a phased timeline for compliance and allows for operational necessities, Madden added. JTF-GNO operates and defends the GIG.

The new directive is the first step toward standardizing patch management.

'There are various tools available now, both in the commercial sector and in the government, that are capable of providing such remediation,' Madden said. 'The JTF-GNO is directing the use of such tools across the GIG, and [will require] that such tools be standardized by a certain time.'

Patching the network

For years, the Defense Department has implemented security patches across its networks.

The process, across DOD, in- volves first identifying vulnerabilities in Information Assurance Vulnerability Alerts. They are reported monthly to the chairman of the Joint Chiefs of Staff.
The alerts also are posted on military networks and warn of basic security measures needed to ward off viruses, worms or hackers.

Some Defense agencies also have implemented advanced security products that identify network devices, automatically install patches and run vulnerability scans.

Prior to the directive, automated patch rollout hadn't been the norm across DOD, officials said.
Air Force Lt. Gen. Charles Croom, director of the Defense Information Systems Agency, said the problem lies not just in identifying vulnerabilities and implementing patches, but the time it takes to complete the process.

'When there's a vulnerability identified in a particular piece of software, they [software companies] push those patches to us and we push those patches to the services and require implementation,' Croom said. 'Obviously, the trick is how fast can you get them and how fast can you implement them. And so, I think you see us focusing on the techniques, tactics and procedures to do that better.'

Croom, who also serves as commander of JTF-GNO, said the new policy would make the rollout of patches an instant process.

'We don't do the patches' instantly now, he said. 'But we get viruses instantly'so even days are too long to implement patches, and for us it takes days and weeks.'

Some companies are ahead of the curve in providing automated security software tools to Defense agencies.

John Menkart, di-rector of government sales for Ops- ware Inc. of Sunnyvale, Calif., said the Army and Defense Intelligence Agency are using Opsware's Server Automation System and Network Automation System to counter intrusion attempts and to repair software vulnerabilities.

'Right now, we're seeing a lot of adoption by the DOD community based upon the recognition that a network infrastructure is only as robust and vulnerable as its weakest component,' Menkart said.

'You could have a range of servers patched, but it's your vulnerable servers that will be attacked. It becomes imperative that you maintain those components,' he said.

Through Ospware's software, DIA and the Army have a complete record of the configuration of their agency's machines and receive detailed reporting of system models so managers know which ma- chines have various strengths, Menkart explained.

Configuration and components

'Known vulnerabilities are a result of the way a machine might be configured and the components on that machine,' he added.

Configuration management is key to network security, Croom said.

'The vision for the future is, you get the person out of the loop and you get machine-to-machine ability so you have the patches automatically distributed and loaded on whatever piece of equipment needs to be patched,' Croom said.

'It helps if your desktop is locked down so configurations are all exactly the same so when you push that patch down to the end terminal, it recognizes that terminal configuration and can load that patch and there's nothing stopping it from doing that,' he said.