Toulouse acknowledges each of these issues and says he would report them to the team to be addressed.
Apple, Novell and Red Hat all pointed to what they called centralized security pages on their sites.
An Apple spokesman pointed to www.apple.com/security as its go-to security page. However, there is no link to this central security page from Apple's home page. To get information on vulnerabilities and patches, you have to click over to multiple support pages.
Novell has yet to merge the security information about its newly acquired SuSe Linux operating system, so a spokesman pointed us to two separate sites: support.novell.com/security-alerts and www.suse.com/security/. That means searching for vulnerabilities across Novell's product line is a multi-step process, but we think Novell will remedy that once it has fully integrated the SuSe assets.
Red Hat offers a central security resource center link, but a spokesman pointed us to www.redhat.com/apps/support/errata/ as the place to get the most-complete security patch information. While the page name is certainly not intuitive, we found this site to be well organized by product, but would like to see a vulnerability search tool added.
Tom Golway, CTO of IT-Defense, a firm specializing in risk-mitigation consulting, says vendors could do more to customize their security interfaces. He points to Amazon.com's ability to present customized information based on a customer's profile as a prototype for pushing the right patch information to the right customers.
"All of these companies have deep knowledge bases of security vulnerabilities, common configuration errors that leave you open to attack and bugs that break applications," Golway says. "They are just a small script away from correlating that information to specific users' environments."
All vendors were quick to tout their existing and future automatic update processes as a development that could reduce the importance of disseminating detailed information about security updates and patches.
While auto update might be a good tool for consumers, no company of size is going to permit auto updating without testing it in the lab and then rolling it out slowly.
Additionally, even if the automatic update mechanism works flawlessly, enterprise IT security staffers will be required to manually audit the updates and maintain change control. If for example a CERT advisory comes out, you would want to be able to go to the vendor site for details about how a security update addresses the advisory.
While all four vendors defended how they are currently serving up security information, all also added the caveat that they are open to feedback on how to improve the process. Speak up and help convince them to face this challenge head on.
RELATED LINKS
