Update management, is it secure?
Every security consultant worth his salt has recommended to clients that security patch management should be performed regularly and automated wherever possible. Anti-virus programs, web content protection software and spam filters should also be regularly updated; automatically where possible.
Updating of services such as anti-virus signatures, security patches, and website blacklists to mention just a few, are commendable initiatives that are helping to improve the security posture of organisations, as well as freeing up security resources and system administrators from undertaking laborious manual update procedures.
With the gap between the release of zero-day flaws and the follow-up virus or worm constantly shrinking down to a few hours in some cases, there is a real need for these solutions to work effectively. Web content filtering and spam filters fall into a similar category, with new phishing attack variants and undesirable websites springing up hourly, system administrators and ISPs must protect their clients as effectively as possible.
This raises some interesting points - how do the vendors ensure that these updates are delivered to servers and workstations in a secure way? And how easily could this process be circumvented to gain unauthorised access?A lot of updates are digitally signed, but in some cases flawed mechanisms such Active-X controls (which have a history of security weaknesses) are used for propagation. Using attack vectors such as DNS cache poisoning, XSS (Cross-Site Scripting) and session hijacking, it seems feasible to use these services to gain access to the servers themselves, or depending on the attackers' motives, to create botnets.
So what should organisations be doing to manage this threat? Firstly, ensure that the update services are used in as secure manner as possible, so that only encrypted sessions (SSL) should be enabled for updates wherever possible. Firewalls should limit the access that servers on the internal networks or DMZs have to the Internet for updates, so strict IP addresses or domain names should be specified for the Internet-based update servers.
The software vendors must ensure that automatic updates have strong protection against malicious misuse and offer the ability to check the integrity of files downloaded, to ensure that updates do not become the next delivery method for malware or other unwanted content.