Solutions not excuses for patch management warns NTA Monitor
Rigorous patch management is a fundamental security requirement for any organsation today and yet, warns Internet security testing specialist, NTA Monitor, far too many companies' servers remain unpatched despite the serious threats this poses.
In recent years, the threats and risks to organisations have increased dramatically with viruses and worms becoming more stealthy and more intelligent, enabling systems to be compromised at a hacker's leisure. Despite the regular reporting of newly discovered defects in software that cyber criminals can use to exploit vulnerable systems, NTA sees the same patch problems occurring.
Roy Hills, Technical Director at NTA Monitor says: "We hear companies time and again telling us that they don't want to take their server down for it to be patched or updated because it wastes time. Or they believe that the technical skill required to successfully exploit vulnerabilities is such that an attack is unlikely. Yet we know that attacks are now increasingly common and how disastrous they can be both financially and in terms of disruption to business. So, we are urging companies to understand that they must take a systematic and efficient approach to patch management on both Internet facing systems and internal segments, to ensure that the security vulnerabilities in a company's information system are addressed."
NTA advises companies on the most appropriate way to improve their patch management and says that those companies that do take it seriously bring a high degree of accountability and discipline to the task of discovering, analysing and correcting security weaknesses, giving them an edge on their competitors. "We believe that companies should have a policy of having a cluster of servers which are all operating in the same way, so if one is taken out to be tested, the other servers can still run. This one server can then be fixed and filtered down to the others. When a server has been patched and if a company has a standard build, they can test if the patch has been successful on one PC and if it has been, it should then work across the network. Patch management seems to be one of those areas of security that many companies prefer to ignore. We are telling them that they do this at their peril," says Hills.
This article was first released on: 23rd April 2008