Unprepared Firms Slammed

Computerworld - The widespread disruptions caused by last week's SQL Slammer worm demonstrated yet again the importance of proactive vulnerability patch management, users and analysts said.

Slammer, a self-propagating worm also dubbed Sapphire and SQL Hell, surfaced Jan. 25. The worm infected computers by means of a known flaw in Microsoft Corp.'s frequently patched SQL Server database software. Slammer works by copying itself onto vulnerable computers and then using those systems to scan for and infect other machines running SQL Server.

As was the case with predecessor worms like Nimda and Code Red, Slammer could have been thwarted if users had applied a patch that Microsoft issued more than six months ago.

The administrators of affected servers "most certainly hold some responsibility for their negligence," said Mike Tindor, vice president of network operations at First USA Inc., an Internet service provider in St. Clairsville, Ohio.

Several of the network performance problems First USA suffered because of Slammer resulted from three unpatched systems that it was co-locating for customers. "Obviously, [the problems] could have been avoided if our customers had performed the proper security updates," Tindor said.

Yet despite the need, few companies have the resources it takes to keep current on all the recommended patches and security advisories that inundate them almost daily, users and analysts said.

"Systems administrators spend a lot of their time addressing day-to-day problems, so routine things such as updates get pushed into the background," said Jesse Fussell, president of Information Security Systems Inc., an Edgewater, Md.-based consultancy.

Patch Problems

Software patches themselves are often unwieldy and difficult to apply and sometimes can break the systems they are intended to fix.

For instance, the patch that Microsoft had made available for the hole Slammer exploited involved in some cases a "brutally slow and manual process," said Chip Andrews, owner of SQLSecurity.com, a site dedicated to securing SQL servers.

As a result, at least "some administrators put off the patch because of the sheer time it would take to patch a production machine," said Ben Koshy, technical manager at W3 International Media Ltd., a hosting company in Vancouver, British Columbia.

Pat Hymes, vice president of corporate information security at Wachovia Corp. in Charlotte, N.C., said maintaining patches can be a challenge for any organization.

"It can take a great deal of time and energy to download, test and implement service packs and hot fixes, especially in large organizations where they can impact hundreds of applications and thousands of servers," Hymes said. "The total cost of ownership for servers running some of these distributed [operating systems], databases and Web software is\ going through the roof due to the manpower being expended to maintain patches and respond to events like the SQL Slammer worm."