BlueLane provides patch management safety net

Last week a client of mine applied the latest OS patches to its main Microsoft Windows Server 2003 server. It rebooted and kaboom! No workstations could connect to the server. After uninstalling all the patches, it began communicating again.

I have many clients afraid to apply Microsoft patches to their servers because of similar experiences. Oracle, and many other major vendors, have had to re-release patches to fix vendor-induced bugs. So should you apply the patches quickly to beat the hackers to the punch, or risk waiting a few weeks to let the vendor work out all the bugs?

Enter Blue Lane Technologies’ PatchPoint appliances. The PatchPoint family is an inline patching proxy. Essentially, administrators can forgo or delay installing OS and common application patches on Windows, Linux, and Solaris servers; instead, patches are “applied” on the network packet stream. Each incoming network packet headed for a protected server is statefully inspected for exploit code. The incoming packet can then be “patched” to make the exploit benign, log it and raise an alert, or drop the involved session.

It’s a unique level of flexibility not found in most IPSes. Although Blue Lane doesn’t recommend putting off a vendor patch forever, it does give the administrator a more flexible deployment schedule. Think of it as Tivo for patches.

Protect and prevent

I reviewed the PatchPoint G/450 (Release 2.7-G256 code) gateway, a 2U box with four Gigabit 10/100/1000 Ethernet ports spread equally over two segments, plus redundant power supplies and fans. A separate, required PatchPoint M/10 management appliance manages anywhere from one to 100 PatchPoint G/450 gateways.

The PatchPoint gateway device sits inline between the untrusted network domains and the servers to be protected. Initial IP configuration is done using an out-of-band serial DB-9 session. Afterward, the PatchPoint gateway can be set to auto-discover all the server computers on a particular subnet. It discovered all the servers on my test network except one, a Microsoft ISA firewall server. This was because the ISA didn’t respond to the auto-discovery ICMP and TCP echo tests. Administrators will have to add non-responding servers manually, as they already have to do with most auto-discovery tools.

After it locates the servers, PatchPoint uses active fingerprinting and passive network traffic listening to find server services that need patching. I was impressed with how many services it found and how well it fingerprinted the services, not to mention that the gateway located and correctly identified all the dynamic RPC ports. In a few cases, I had to manually help the gateway decide between various patch levels, but overall it did a great job by itself.

One other caveat -- the gateway looks at the common default ports and many other lower numbered ports during auto-discovery. Services running on high non-default ports, such as RDP running on 43389, were not located automatically and would have to be added manually.

After the services are discovered and identified, the administrator can apply protection to all of them at once or pick and choose. The default action can be set to Apply Fix (make exploits benign), Log and Alarm, or Drop Sessions. PatchPoint comes with a handful or two of pre-canned, graphic chart-style reports, but more detailed data can be downloaded to Microsoft Excel or CSV file.