Does patch management need patching?

According to a recent estimate from Verizon, 90 percent of successful exploits these days involve vulnerabilities for which a patch has been available for six months or longer.

"For the overwhelming majority of attacks exploiting known vulnerabilities, the patch had been available for months prior to the breach," Verizon says on page 15 of its 2008 Data Breach Investigations Report. "Also worthy of mention is that no breaches were caused by exploits of vulnerabilities patched within a month or less of the attack."

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

This strongly suggests that a patch-deployment strategy focusing on coverage and consistency is far more effective at preventing data breaches than "fire drills" attempting to patch particular systems as soon as patches are released, the report says.

The bad guys know a lot of companies are slow to patch, and so they continue to cook up exploits for the older vulnerabilities, experts say. In fact, security experts say, worms like Blaster and Sasser -- launched four to five years ago against vulnerabilities for which patches were made available around the same period -- are still in wide circulation today.

"You might have 99 out of 100 machines fully patched, but all it takes is one machine missing one patch," says Eric Schultze, chief technology officer for Shavlik Technologies, a Roseville, Minn., maker of patch management software. "The administrator has to patch 100 percent of things, whereas the hacker only has to hope that only 99 percent got patched."

The problem isn't necessarily one of laziness. One of the problems, Schultze says, is hidden machines.

"There are some percentage of machines the company simply doesn't know it has," Schultze says. "It could be a rogue server sitting under someone's desk, it could be a virtual machine up and running no one knows exists. If you don't know a machine exists, it's probably not going to get patched."

That means, according to Ben Rothke, senior security consultant for BT Professional Services, that "you've got zero day threats and you're working behind the clock."

However there's a big difference between taking, say, two weeks to patch a system because you're testing the patch and the six months in the Verizon report.

The first step in patch management, then, is inventory management. You need a complete inventory of all the systems on your network. In all but the smallest companies, that usually requires an inventory program that can examine what's actually on the network and give you a comprehensive report.

Beyond inventory, the next step is having a process to install and manage patches, backed by the appropriate software.

"There's no shortage of software tools that can do the job," says Rothke. "It comes down to having processes in place to deal with all that."

CSO Online is an InfoWorld affiliate.