For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Unprepared Firms Slammed
or
Other Security Stories
|
|
|
|
February 03, 2003 (Computerworld) -- The widespread disruptions caused by last week's SQL Slammer worm demonstrated yet again the importance of proactive vulnerability patch management, users and analysts said.
Slammer, a self-propagating worm also dubbed Sapphire and SQL Hell, surfaced Jan. 25. The worm infected computers by means of a known flaw in Microsoft Corp.'s frequently patched SQL Server database software. Slammer works by copying itself onto vulnerable computers and then using those systems to scan for and infect other machines running SQL Server.
As was the case with predecessor worms like Nimda and Code Red, Slammer could have been thwarted if users had applied a patch that Microsoft issued more than six months ago.
The administrators of affected servers "most certainly hold some responsibility for their negligence," said Mike Tindor, vice president of network operations at First USA Inc., an Internet service provider in St. Clairsville, Ohio.
Several of the network performance problems First USA suffered because of Slammer resulted from three unpatched systems that it was co-locating for customers. "Obviously, [the problems] could have been avoided if our customers had performed the proper security updates," Tindor said.
Yet despite the need, few companies have the resources it takes to keep current on all the recommended patches and security advisories that inundate them almost daily, users and analysts said.
"Systems administrators spend a lot of their time addressing day-to-day problems, so routine things such as updates get pushed into the background," said Jesse Fussell, president of Information Security Systems Inc., an Edgewater, Md.-based consultancy.
Patch Problems
Software patches themselves are often unwieldy and difficult to apply and sometimes can break the systems they are intended to fix.
For instance, the patch that Microsoft had made available for the hole Slammer exploited involved in some cases a "brutally slow and manual process," said Chip Andrews, owner of SQLSecurity.com, a site dedicated to securing SQL servers.
As a result, at least "some administrators put off the patch because of the sheer time it would take to patch a production machine," said Ben Koshy, technical manager at W3 International Media Ltd., a hosting company in Vancouver, British Columbia.
Pat Hymes, vice president of corporate information security at Wachovia Corp. in Charlotte, N.C., said maintaining patches can be a challenge for any organization.
"It can take a great deal of time and energy to download, test and implement service packs and hot fixes, especially in large organizations where they can impact hundreds of applications and thousands of servers," Hymes said. "The total cost of ownership for servers running some of these distributed [operating systems], databases and Web software is\ going through the roof due to the manpower being expended to maintain patches and respond to events like the SQL Slammer worm."
Claude Bailey, an IT security analyst at one of the nation's largest financial management firms, said the problem lies not in detecting the vulnerability but in deploying the patches and fixes across an organization of 50,000 employees and guaranteeing that the patch won't cause more problems.
"We tested the original patch [for the SQL vulnerability], and it had problems," said Bailey. And now, in the middle of tax season, there's too much to lose in deploying patches that break other parts of the network, he said. As a result, the financial firm has placed a freeze on any such maintenance until tax season is over.
The patching issue becomes even harder when dealing with patches that touch core systems like a database server, said Eric Block, information security officer at Dallas-based Mary Kay Inc.
"Database administrators can get very nervous when you tell them that a security patch could break their server," said Brock. As a result, decisions about patches sometimes can become a "risk-rewards judgement call," he said.
Microsoft's Woes
Even Microsoft itself wasn't above such oversight last week, with several unpatched systems becoming infected by Slammer.
"We struggle with the same issues as the rest of the industry," said Rick Miller, a Microsoft spokesman. "Some don't patch for time management reasons, some out of oversight. At the end of the day, it should have been patched."
Vendors have contributed to the problem by failing to provide enterprise-class patching and updating processes, said Paul Schmehl, adjunct information security officer at the University of Texas in Dallas. The university lost Internet connectivity for about 13 hours because of Slammer, according to Schmehl.
"Most vendors are still writing software for individual boxes instead of thinking about scaling processes to make them usable," he said.
It is in response to such concerns that Microsoft is revamping its processes for developing and distributing patches, Miller said.
For instance, the company has begun to make available easy-to-use installers for automating much of the patching process, Miller said. Microsoft is also working on tools that help companies scan their networks and identify vulnerable systems more efficiently, he added.
"We recognize that we need to do a much better job developing and delivering patches," Miller said. "We are working on it."
Computerworld's Dan Verton contributed to this story.
 |
|
|
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Microsoft promises four patches next week
- Google gives away home-cooked Web application security scanner
- Expect iPhone, Fourth of July scams, security firm says
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecuritySecurity's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied |
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
