Slammer worm brings patch mgmt. issues to the fore

The recent Slammer worm that slowed down the Internet and rendered some ATMs inoperable could have been prevented or the damage minimized by better management. The security hole in SQL Server 2000 that the worm exploited was already known, and a patch was available.

Patch management is a nightmare for many IT organizations. The sheer volume of patches that must be applied to operating systems, server software, database software, application software, e-mail software, security software and more is simply overwhelming. Consider the unlimited permutations of these different kinds of software installed on a multitude of systems. Do you know what’s installed on your systems and where?

Plus, most administrators may want to test a patch before deploying it enterprisewide, to make sure it’s compatible with other software. Meanwhile, malicious programs, such as worms, may take advantage of the security vulnerability – and you’re caught having to do reactive remediation.

There’s no foolproof system to preventing viruses from wreaking havoc on your infrastructure. But you must make sure security patches are installed as quickly as possible.

Patch management tools can help shorten the time needed to deploy patches across an enterprise. Examples include products from Ecora, LANDesk Software, Marimba, Wise Solutions, IBM Tivoli, Computer Associates, LSVi and Configuresoft. (Note: This is not an exhaustive list.)

For example, take Configuresoft’s ECM Security Update Manager, which conducts a security assessment of your infrastructure. It looks at the patches available from a vendor such as Microsoft and compares it to what you have installed. With a few clicks, the patch can be deployed across multiple systems at one time. Doing that manually would be much more difficult and time-consuming.

While keeping your patch updates current won’t totally eliminate your security vulnerabilities, they are certainly one way of helping to reduce your risk. Being able to manage patch application by policy, by groups and by exception will help today’s overworked staffs do more with less. Patch management isn’t an area to cut back or take shortcuts on, given limited resources.