The Need for Effective Patch Management

---

Today's computer systems and networks are under an unprecedented level of threat, ranging from viruses and worms to malicious insiders. Patch management, when properly implemented as part of a defensive strategy, can help organizations adopt a security posture and mitigate vulnerability in their systems. Consequently, patch management is becoming an increasingly important topic for both management who are anxious to demonstrate corporate responsibility to shareholders and for the IT manager, whose job it is to maintain and keep running secure systems.

Trojan Horses, Viruses, and Worms

According to the joint 2003 Computer Security Institute/Federal Bureau of Investigation Computer Crime and Security Survey, 82 percent of respondents detected an attack related to a virus, which was defined as a virus, a Trojan horse, or a worm. The average reported loss due to virus activity was $199,871 per organization. The past 12 months have seen two fast-spreading and debilitating worms: SQL Slammer and MS Blaster. Before that there were Code Red and Nimda. Many organizations had to expend considerable resources defending against and cleaning up after these attacks against their infrastructure.

As alarming as this state of affairs is, what is perhaps more alarming is that in each case updates were available to remove the vulnerability exploited by each worm. Figure 13.1 shows the time from release of an update to discovery of an exploit in the wild for some of the more damaging of the recently discovered Trojan horses, viruses, and worms.

Figure 13.1: Time from release of update to discovery of exploit in the wild.

As the chart shows, the trend is moving towards zero-day exploits, where an exploit is discovered on the same day that Microsoft releases an update to remove the vulnerability. The diminishing window between update and exploit is perhaps one of the more compelling arguments for an organization to implement a patch management process, one that's capable of deploying updates quickly, reliably, and efficiently.

---