William Jackson | Don't miss the forest for the trees
Connecting state and local government leaders
Commentary: Patch management across the full spectrum of application vendors is vital to IT security.
With all of the attention Microsoft security updates receive when they are released, it would be easy to think vulnerability management begins and ends on the second Tuesday of each month.This month's updates included nine patches, six of them rated critical and two important.But it is not just Microsoft that we need to worry about. Updates and patches to fix vulnerabilities that could allow remote code execution are coming from a wide variety of vendors at a growing clip.'There are an increasing number of attacks occurring at the application layer, illustrating the need for a cross-platform vulnerability management strategy,' said Paul Zimski, senior director of market and product strategy at PatchLink Corp. 'Paying attention only to Microsoft, no matter how serious this round of patches may be, does not promote a secure foundation.'IT administrators know this already, of course. But it is becoming increasingly important for those of us who spend most of our time at unmanaged desktop and notebook PCs to remember that patch management across the full spectrum of application vendors is important to us.That said, it is worth noting that Microsoft seems to be doing well in managing security and security updates, particularly in its newest operating system. Yes, on the downside, the patches just keep on coming. But, on the upside, the patches keep on coming. The automatic update process has become so integrated that it is difficult to avoid being patched by default if you are online at all. And the number of security updates for the Vista operating systems is not unreasonable for such a new piece of software.I am not a big fan of Vista. If Windows XP was a Ford station wagon that would get you somewhere without a lot of style, Vista is like an overloaded boxcar. When it is moving, it will get you where you want to go reasonably well, but starting and stopping take forever. And at times you get shunted to a siding where you are going nowhere ' and there's not a thing you can do about it. But given the amount of rewriting that went into the code there do not seem to be too many security problems.One problem in Vista that has received attention ' at the Black Hat Briefings this month and in GCN ' is the possibility of using the Teredo IPv6 tunneling service to bypass firewall rules. When Microsoft rewrote the network stack of Vista, it embedded IPv6 as the preferred protocol by default. Teredo tunneling lets clients with only IPv4 connectivity obtain and use publicly routable IPv6 addresses by using User Datagram Protocol packets to pass IPv6 traffic across IPv4 local networks through Network Address Translation devices and through firewalls.Microsoft took care of this one quickly with a July security update to ensure the Vista firewall does not pass unfiltered IPv6 traffic. So if you have been online since July 10, you probably are protected from this particular problem unless your firewall log files were missing or corrupted, in which case the patch did not install properly. Microsoft reissued the patch this month to correct these problems.Of course, this does not mean we are home free. 'Teredo raises a number of security concerns, some of them serious,' said Jim Hoagland, principal security researcher at Symantec Security Response, who discovered the firewall problem in an analysis of Vista's network-facing elements. Vista is designed to use Teredo as the 'IPv6 provider of last resort,' used only when native IPv6 or ISAP, another tunneling protocol, is not available. But Hoagland said his research revealed that Teredo was being used more frequently that Microsoft documentation indicated it should be.'The safest thing is to assume that Teredo will often be used,' he said. 'You should be applying as strong controls to Teredo packets as to IPv6.'But because Teredo packets can be difficult to find, the overhead of locating them could be prohibitive on a network. In the final analysis, blocking them and sticking to native IPv6 could be the better solution, he added.
GCN senior writer Bill Jackson