Unprepared Firms Slammed
Worm took advantage of IT shops' failure to use available patches
February 3, 2003 12:00 PM ETComputerworld - The widespread disruptions caused by last week's SQL Slammer worm demonstrated yet again the importance of proactive vulnerability patch management, users and analysts said.
Slammer, a self-propagating worm also dubbed Sapphire and SQL Hell, surfaced Jan. 25. The worm infected computers by means of a known flaw in Microsoft Corp.'s frequently patched SQL Server database software. Slammer works by copying itself onto vulnerable computers and then using those systems to scan for and infect other machines running SQL Server.
As was the case with predecessor worms like Nimda and Code Red, Slammer could have been thwarted if users had applied a patch that Microsoft issued more than six months ago.
The administrators of affected servers "most certainly hold some responsibility for their negligence," said Mike Tindor, vice president of network operations at First USA Inc., an Internet service provider in St. Clairsville, Ohio.
Several of the network performance problems First USA suffered because of Slammer resulted from three unpatched systems that it was co-locating for customers. "Obviously, [the problems] could have been avoided if our customers had performed the proper security updates," Tindor said.
Yet despite the need, few companies have the resources it takes to keep current on all the recommended patches and security advisories that inundate them almost daily, users and analysts said.
"Systems administrators spend a lot of their time addressing day-to-day problems, so routine things such as updates get pushed into the background," said Jesse Fussell, president of Information Security Systems Inc., an Edgewater, Md.-based consultancy.
Patch Problems
Software patches themselves are often unwieldy and difficult to apply and sometimes can break the systems they are intended to fix.
For instance, the patch that Microsoft had made available for the hole Slammer exploited involved in some cases a "brutally slow and manual process," said Chip Andrews, owner of SQLSecurity.com, a site dedicated to securing SQL servers.
As a result, at least "some administrators put off the patch because of the sheer time it would take to patch a production machine," said Ben Koshy, technical manager at W3 International Media Ltd., a hosting company in Vancouver, British Columbia.
Pat Hymes, vice president of corporate information security at Wachovia Corp. in Charlotte, N.C., said maintaining patches can be a challenge for any organization.
"It can take a great deal of time and energy to download, test and implement service packs and hot fixes, especially in large organizations where they can impact hundreds of applications and thousands of servers," Hymes said. "The total cost of ownership for servers running some of these distributed [operating systems], databases and Web software is\ going through the roof due to the manpower being expended to maintain patches and respond to events like the SQL Slammer worm."
Security
Additional Resources



White Papers & Webcasts
Death to PST Files
Download Now
The Tangled Web: Silent Threats & Invisible Enemies
Download Now
Tape Killed the IT Guy
Watch Now
Forrester Consulting Mobility Study: Taking Control of Enterprise Mobile Device Diversity
Download Now
BRM: What You Can Do To Reduce Risk In Challenging Times
Watch this webcast now!
What IT Must Do to Support Employee-Owned BlackBerry, iPhone and Android Mobile Devices
Download Now
Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".
eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...

