Regular fix

Hackers launch attacks moments after security vulnerabilities are announced. The FBI reports that 90 percent of security breaches take advantage of known software vulnerabilities.Put those two facts together and you can see why it's essential to apply fixes to software as soon as possible. Not only do you want to protect private or confidential information, you also want to avoid the downtime and the cost of recovering from attacks.Unfortunately, the patch situation is so complex that IT staff often can't handle the task manually. Vendors of operating- system and application software are constantly issuing patches to fix problems, whether security or nonsecurity.Moreover, some patches actually interfere with other patches. And many organizations have hundreds or thousands of servers and desktop clients, some at remote locations, with many different hardware configurations running several versions of OSes and applications.This is why software to manage patches is so useful'and so popular.The idea behind patch management software is simple. The program, or a vendor's service, monitors for announcements of new patches. It downloads the ones that are pertinent to your computer configurations and installs the patches at the appropriate time.'Patch management overlaps both systems management and security management,' said Phebe Waterfield, analyst of security solutions and services for the Yankee Group, a research and consulting firm in Boston.Patch management software has many advantages. It helps protect systems against the worms and viruses that take advantage of known vulnerabilities, so you don't have to worry as much about reports of a new virus.Many products also handle nonsecurity patches, so that your applications have the latest fixes for annoying, but nonlethal, bugs. In addition, you can gain valuable information about your systems, since many products scan computers automatically. This can help with inventory, planning purchases and upgrades.Perhaps most important, it frees your IT staff for more important tasks, or can reduce your staff requirements.In an ideal world, that would be the end of the story, but the situation isn't quite as simple and rosy as that.In some cases, for example, applying a patch might cause one or more applications not to work properly. Yet if you don't apply the patch, you're left with a possible security hole.That's why testing patches is important, whether it's done by your staff or by the vendor. Some vendors do extensive testing of new patches and let you know what issues can arise from their use; others leave that to you.Network bandwidth is another problem. If you pass all new patches'some of which are quite large'to your hundreds or thousands of computers, you could seriously interfere with users' work. But any delay represents a security risk. Some products monitor a network without using more than a selectable percentage of available bandwidth.Remote users present a similar issue. They may only connect occasionally and, when they do, they probably have better things to do than wait for patches to install.A continuing debate in the patch management community is between agent-based and agentless'or scanner-based'systems. An agent-based system places a software agent on each computer to monitor its particular patch needs. Agentless systems use a central server that scans all computers to assess their patch requirements.Proponents of agent-based products claim they ensure that every machine is covered, do a better job of supporting mobile clients, reduce network traffic and simplify access to individual computers.Fans of agentless solutions point out that it takes a lot of effort to install agents on every computer, that agents might interact negatively with other applications, and that agents may not be available for hardware such as routers and switches.The more computers you support, the more attractive agentless products look. Also, if a disastrous attack occurs, agentless systems generally are faster.As with most such debates, the ideal is a compromise: a largely agentless system, with agents deployed on remote or isolated computers.'Agentless systems are limited in how well an external machine can control another,' Waterfield said. 'Still, with either system, it's important to ensure that users cannot override the patch management process.'Many patch management products are actually part of broader system management tools, or offer other capabilities themselves. For example, some products can also deploy new software in the same way they deploy patches. Many products do some degree of inventorying.Still, it's security that sells the product. Agencies that must maintain certain standards of security or privacy compliance may find the automatic reports useful.You can simplify your patch situation considerably by establishing baseline configurations for your computers. Settling on one version of one OS will make it easier to judge which patches you need and which you can safely ignore. Your organization also should have clear guidelines to define the security policy that patch management supports. Murky rules lead to gaps in protection, or a system made unusable by continuous patching.PCs are not the only devices with vulnerabilities. Servers, mainframes, routers, switches, printers, wireless access points, databases, firewalls and many other items can also have vulnerabilities that require patches.Some vendors specialize in certain devices. OpsWare's products, for example, are solely for servers. You should seek products that fit your installation. If you run multiple OSes, the product should handle everything you use.Some free tools are available, notably from Microsoft Corp. HFNetChk, based on a tool from Shavlik Technologies LLC, can assess a computer or group of computers for the absence of security patches in Microsoft Windows, Internet Information Server, SQL Server, Internet Explorer and other Windows applications. This is purely a diagnostic tool and doesn't distribute or install patches.Unfortunately, patches can have bugs, too. Many administrators are reluctant to apply new patches without learning'either by testing or by reports on the grapevine'how they will affect systems. If you can't test adequately, make sure the vendor does.A risk analysis comparing the delay in applying a patch to the vulnerability from not applying a patch could be in order. If a patch fails, you might even have to restore systems to the unpatched version, so be sure your product can handle this, and that your system backup can help do the job.Another tip: Try to avoid proprietary systems of patch information. There are industry standards for patch management, including the Information Technology Infrastructure Library (ITIL) change management specification and the Microsoft Operations Framework (MOF).Products offer a wide variety of predefined reports, as well as the possibility of creating custom reports. If your organization needs a certain type of report for accreditation or certification, make sure the product supplies it, or makes it easy for you to create.A patch management tool also should work well with your other management software, including network, help desk, antivirus, firewall, backup and system management. At the same time, take advantage of a product's other abilities, such as inventorying or rolling out new applications. That can save you the trouble and expense of using other software for the same purpose.Because patch management interacts so intimately with your computers, and requires such attention from IT staff, it's a good idea to use a trial version first, if one is available. This can reveal unsuspected problems.Patch management vendors strive to make their products faster, easier to use and simpler to deploy. Good thing. The threat from attacks on known vulnerabilities will continue to grow worse.A recent General Accounting Office report warned: 'The length of time between the awareness of a vulnerability and the introduction of an exploit is shrinking.'Administrators need to find solutions to defend their systems. As a recent report from Gartner Inc. of Stamford, Conn., put it: 'Near-continuous scanning will rapidly become a standard enterprise requirement as security administrators struggle to stay ahead of vulnerabilities.'The Yankee Group's Waterfield sees patching and configuration converging in the future.'Long-term, systems will have two parts: one for software versioning, including remote management; and one for handling threats, including firewall and antivirus,' Waterfield said. 'Patch management will straddle both parts.'