Subscribe to our e-mail newsletters
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Finance
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
More E-Mail Newsletters 
Computerworld 2007Subscribe to Computerworld
40 years of the most authoritative source of news and information for IT leaders.

Unprepared Firms Slammed

Worm took advantage of IT shops' failure to use available patches
Jaikumar Vijayan   Today’s Top Stories    or  Other Security Stories  
 

Sign up to receive Security Resource Alerts

February 03, 2003 (Computerworld) -- The widespread disruptions caused by last week's SQL Slammer worm demonstrated yet again the importance of proactive vulnerability patch management, users and analysts said.

Slammer, a self-propagating worm also dubbed Sapphire and SQL Hell, surfaced Jan. 25. The worm infected computers by means of a known flaw in Microsoft Corp.'s frequently patched SQL Server database software. Slammer works by copying itself onto vulnerable computers and then using those systems to scan for and infect other machines running SQL Server.


As was the case with predecessor worms like Nimda and Code Red, Slammer could have been thwarted if users had applied a patch that Microsoft issued more than six months ago.


The administrators of affected servers "most certainly hold some responsibility for their negligence," said Mike Tindor, vice president of network operations at First USA Inc., an Internet service provider in St. Clairsville, Ohio.


Several of the network performance problems First USA suffered because of Slammer resulted from three unpatched systems that it was co-locating for customers. "Obviously, [the problems] could have been avoided if our customers had performed the proper security updates," Tindor said.


Yet despite the need, few companies have the resources it takes to keep current on all the recommended patches and security advisories that inundate them almost daily, users and analysts said.


"Systems administrators spend a lot of their time addressing day-to-day problems, so routine things such as updates get pushed into the background," said Jesse Fussell, president of Information Security Systems Inc., an Edgewater, Md.-based consultancy.


Patch Problems


Software patches themselves are often unwieldy and difficult to apply and sometimes can break the systems they are intended to fix.


For instance, the patch that Microsoft had made available for the hole Slammer exploited involved in some cases a "brutally slow and manual process," said Chip Andrews, owner of SQLSecurity.com, a site dedicated to securing SQL servers.


As a result, at least "some administrators put off the patch because of the sheer time it would take to patch a production machine," said Ben Koshy, technical manager at W3 International Media Ltd., a hosting company in Vancouver, British Columbia.


Pat Hymes, vice president of corporate information security at Wachovia Corp. in Charlotte, N.C., said maintaining patches can be a challenge for any organization.


"It can take a great deal of time and energy to download, test and implement service packs and hot fixes, especially in large organizations where they can impact hundreds of applications and thousands of servers," Hymes said. "The total cost of ownership for servers running some of these distributed [operating systems], databases and Web software is\ going through the roof due to the manpower being expended to maintain patches and respond to events like the SQL Slammer worm."


Claude Bailey, an IT security analyst at one of the nation's largest financial management firms, said the problem lies not in detecting the vulnerability but in deploying the patches and fixes across an organization of 50,000 employees and guaranteeing that the patch won't cause more problems.


"We tested the original patch [for the SQL vulnerability], and it had problems," said Bailey. And now, in the middle of tax season, there's too much to lose in deploying patches that break other parts of the network, he said. As a result, the financial firm has placed a freeze on any such maintenance until tax season is over.


The patching issue becomes even harder when dealing with patches that touch core systems like a database server, said Eric Block, information security officer at Dallas-based Mary Kay Inc.


"Database administrators can get very nervous when you tell them that a security patch could break their server," said Brock. As a result, decisions about patches sometimes can become a "risk-rewards judgement call," he said.


Microsoft's Woes


Even Microsoft itself wasn't above such oversight last week, with several unpatched systems becoming infected by Slammer.


"We struggle with the same issues as the rest of the industry," said Rick Miller, a Microsoft spokesman. "Some don't patch for time management reasons, some out of oversight. At the end of the day, it should have been patched."


Vendors have contributed to the problem by failing to provide enterprise-class patching and updating processes, said Paul Schmehl, adjunct information security officer at the University of Texas in Dallas. The university lost Internet connectivity for about 13 hours because of Slammer, according to Schmehl.


"Most vendors are still writing software for individual boxes instead of thinking about scaling processes to make them usable," he said.


It is in response to such concerns that Microsoft is revamping its processes for developing and distributing patches, Miller said.


For instance, the company has begun to make available easy-to-use installers for automating much of the patching process, Miller said. Microsoft is also working on tools that help companies scan their networks and identify vulnerable systems more efficiently, he added.


"We recognize that we need to do a much better job developing and delivering patches," Miller said. "We are working on it."


Computerworld's Dan Verton contributed to this story.















Key Lessons

Slammer's vast propagation highlighted the need to:



Make certain that any application being exposed to the Internet is maintained at the latest patch level.


Perform periodic vulnerability scans.


Block all ports except those that are absolutely essential.


Institute formal processes for patch management and remediation.




Print this Story Send Us Feedback E-mail this Story Digg! Digg this Story Slashdot this Story
Free Benchmarking Tool Could Have Detected SQL Hole
Unprepared Firms Slammed
"This company's infrastructure group is running a disaster recovery exercise with a reluctant participant: an IT manager who's notorious as..." Read more...
"It's IT Blogwatch: in which Mozilla's Firefox Web browser continues to gain market share, smashing records as it does so...." Read more...
Read more Security posts or See all Blogs
Microsoft promises four patches next week
Google gives away home-cooked Web application security scanner
Expect iPhone, Fourth of July scams, security firm says
More top stories...
Microsoft trumpets security additions in upcoming IE8
Apple cuts price of high-end SSD MacBook Air by $500
Ultrathin showdown: Apple MacBook Air vs. Lenovo ThinkPad X300 vs. Toshiba Portege R500
All it takes is a couple hours and about $125 to breathe new life into an old laptop. Here's how.
Is Microsoft's Golden Age over? What are Gates' most memorable quotes? Find out in Computerworld's complete coverage of the end of the Bill Gates era at Microsoft.
There are some things your CIO definitely doesn't want to hear. Also don't miss the flipside, Five things you should always tell your boss.
With its latest version, Mozilla's browser continues to raise the bar for what Web browsers should be.
Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS.
Four years from now, the IT field will be a vastly different place. Will you be ready?
All Zones
Application Performance Zone
Business Continuity Zone
Data Center Management Zone
Enterprise-Class Security Zone
The File Data Management Zone
Grid Computing on Windows Zone
Security Management Zone
ITIL Best Practices Zone
The SAS Zone
Storage Virtualization Zone
Business Intelligence and Analytics Zone

Ads by TechWords

See your link here
Why SaaS is Vital to Email and Web Security
Why SaaS is Vital to Email and Web Security
Download this webcast, free, compilments of Webroot Software
Go to the webcast 
Computerworld Executive Bulletin: Building a Robust Antivirus Defense
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
(Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more.
Download this executive briefing download
Eliminate SPAM, Gain Productivity
Get this white paper now!
(Source: MessageLabs) Learn all about the dangers and the costs of spam in all its forms - from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses - and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold.
Download this white paper go
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Deploying Virtualized NetWare on Linux Whitepaper
Toward More Flexible, Next-Generation Collaboration Solutions
Driving Business Success Through Workgroup Choice and Flexibility
View more whitepapers