Vulnerability vigilence

It's a typical series of events for a major worm outbreak. First, the early reports from Symantec, followed by more detailed reports, changes in the security level, and the like. Close behind is a flood of e-mail from security companies bragging about beating the worm du jour. Finally, a flurry of e-mails from experts reminding you that they were right and knew this was going to happen all along.

When I thought about the millions of people being infected by Sasser, a worm that is easily stopped by an updated version of Windows, the most I could wonder is what the administrators of these machines were thinking. After all, the patch had been out for weeks. It’s no secret that once a vulnerability is found, someone creates software to exploit it. So why haven’t these machines been patched?

I was originally thinking about ranting on about this topic in this week's column. After all, how could an IT professional continue to accept a paycheck if problems like this continued to appear? But a calming chat with my editor made me realize that while there are managers who never seem to get the word, there are also some who simply don’t have the means to solve the problem, and some who are overwhelmed by the task’s complexity.

There’s not much to be done for a company that refuses to spend the money or allocate the resources to keep its networks safe. Perhaps at some point the directors of these companies will find out their equity has been wasted by poor management, and if they still have a company, they can make replacements. Likewise, those companies that simply do not put enough people on the job to do the work will get the pain they deserve, although sadly the managers who are really responsible will probably escape repercussions.

But then there are those who are simply overwhelmed. After all, a big company’s network is astonishingly complex; it’s extremely difficult to keep up with the pace of new patches and updates needed for every device on the network by yourself.

One of the best sources of help is a good vulnerability assessment tool. Fortunately, there are plenty available. Last week, for example, I visited the offices of eEye Digital Securityand got a look at its new software, due out soon. I’ve also talked to people involved with e-Security’ssuite of products for managing vulnerability assessment. (I’ll be reviewing both of these products in the near future).

One of the great things about these packages is that they can query every device on your network, determine the current patch level for each, and report what needs to be done to update each device. Even better, eEye’s products can also help fix the problem, and e-Security’s can tell you when an exploit is under way.

Both of these products are designed to make an IT manager’s life easier. If you’re not able to keep up with your patches by yourself, you should be looking at one of these products very thoughtfully.