Vulnerability and Patch Management
Dr. Thomas Moore, Ph.D.
EMBA, BCSA, BCSP, CISSP, CISM, LCNAD
Vulnerability Management:
What, why, how
What is
Vulnerability Management?
The ability to assess and secure multi-platform environments.
– Protection from internal vulnerabilities such as:
• Machines that do not have the latest hot fixes or service packs loaded
• People who have inappropriate rights to files and directories
• Users who have no passwords or easily guessed passwords
• Accounts that have not been disabled once an employee is no longer with
the company
• Employees who are going against corporate policies and who are sending
emails with inappropriate content
Protection from external vulnerabilities such as:
• Unknown/unsecured IP devices
• Open ports
• Easily guessed passwords
What is
Vulnerability Management?
Combination of management and security tools into one product.
Examples of Management tools:
–
–
–
–
–
Automated documentation for disaster recovery
Disk space analysis
Content scanning (MS Exchange)
Mailbox moves (MS Exchange)
Change impact analysis (MS SQL)
The ability to audit and document your improved security.
– Requisite in banking/healthcare/government or any highly regulated
industry
– Staff augmentation (cost savings)
Why Vulnerability Management
According to Gartner:
Security continues to be one of the top
three issues for CIOs.
Windows, IIS and SQL Server are the three
key areas prone to attack.
2004 was the first time that the security
budget for the average enterprise
constituted more than 5% of the overall IT
budget – showing up on the CIO’s pie chart
Why Vulnerability Management
Also according to Gartner, some ways to quantify what
you do are:
• What percentage of known attacks is the
organization vulnerable to?
• When was that percentage calculated?
• What percentage of company software, people
and supplies have been reviewed for security
issues?
• What percentage of downtime is the result of
security problems?
• What percentage of nodes in the network are
managed by IT?
CIO Magazine/PWC survey,15OCT04:
The top three security-related organizational
priorities for 2004 were:
•
•
•
Raise end user awareness of policy & procedures – 55%
Train staff – 41%
Develop security policies and standards – 35%
This same survey stated that 80% of North American
companies used liability as a justification for
security investments.
Also in the study, security investments are justified
due to:
•
•
•
Liability/exposure – 69%
Regulatory requirements – 53%
Revenue impact – 40%
Vulnerability Management: More
Insight
According to a Summer 2003 InfoPro Study, the top operational
problems or pain points that are driving spending are:
* Audit/compliance related – 41%
* Technology related – 40%
* Standards related – 16%
“The numbers are staggering: 82,094 new vulnerabilities
discovered in software and hardware last year. That's
up 64 percent from 2001. And in the first quarter of this
year alone, the number was 76,404. The volume of flaws
found has been rising at an alarming rate for as long as
people have kept statistics.” --eWeek, Aug. 11, 2003
VM Trends
Windows and .NET Magazine (May) 2002 vs. 2003 Study Results
Managing Infrastructure
20%
15%
15%
Operating System Upgrades
14%
16%
Shoring up Security
Hardware Upgrades
8%
* Software Upgrades
Application
8%
Better Support for Remote
Workers
5%
8%
Implementing Wireless
Technologies
5%
8%
• Manage infrastructure still #1!
• OS upgrades and security (equal)
12%
14%
Increasing Disaster Recovery Cap
Expanding Storage Capacity
25%
12%
2003 Study
2002 Study
4%
5%
“Which of the following would you say is your company's highest
priority technology initiative for IT in the next year?”
* Hardware upgrades not asked in 2002.
Why implement a VM solution?
•Multiple threats across a complex IT infrastructure
•Multiple IT Managers are accountable for specific pieces
of the infrastructure, but not all
•Native tools do not provide enterprise-level,
consolidated assessment and audit
•A breach in any one area can affect the entire
infrastructure
•Organizations must comply with some mandated
standards and practices across the enterprise
•Time and efficiencies gained
Quick Quiz:
1. How many machines does it take to make a network
completely vulnerable?
2. Name three ways a network may be vulnerable?
Risk Management Lifecycle
Repeat
Certify/
Verify
Remediate
Define Rules
Policy Compliance
Vulnerability Management
Directory Administration & Migration
Publish
Audit/
Analyze
Assign
Notify
Benefits of Lifecycle
• Increase audit coverage and frequency
• Look at ALL your servers and workstations,
ALL the time
• Provide policies to measure against
• Achieve constant state of audit
More Coverage + Complete Policies = Less Risk
Automating the Lifecycle
• What percentage of your machines do you audit
regularly today?
• For best security, how many should you audit?
• How often do you complete your audit cycle?
• Only an automated solution can:
– Audit 100% of machines
– Increase your audit frequency
– Decrease the time to remediate
– Reduce risks AND reduce costs at the same time
Sustainability
• Is this more work than you are doing today?
– YES!! And it will continue to grow…
– Start Now!
• With all the other things that are going on, how can I
not only create – but maintain a secure
environment.
– Create Policies
– Automate Assessment with software tools (VM)
– Remediate (VM)
– Evaluate (VM)
– Start Over! (VM – using scheduling)
Any pitfalls?
Technical:
• Depth of reporting (granularity, ad-hoc VS predefined)
• Closed loop problem identification and Remediation
• Scalability
– Agents and their associated maintenance
– parallel processing
• Lack of centralized management (combination of
security, auditing and management tools bundled into product)
Other benefits
Business reasons:
• 30-70% reduction in business losses due to downtime
• 20-70% reduction in lost opportunity costs
• 20-50% reduction in mediation, recovery time and
associated costs
• 10-30% reduction in lost productivity of non-IT
personnel
• 1-2% legal exposure and costs
• 10-30% deployment and maintenance
Testimonials
“(VM) solutions reduced our business loss and
downtime when NIMDA hit.” “…put out the 1.1
million hits that we took. That was huge.” – Large
mid-west financial organization
“…vulnerability management solution, we realized
more than $1,000,000 in ROI.” – Florida Hospital
New trends
Non-credentialed scans
• Benefits
– Cross-platform
– Doesn’t require administrative rights to scan device
– Keep up with the latest vulnerabilities
– O/S Fingerprinting with version identification
– Identify every IP device on the network
Total Devices – Managed – Unmanaged
Rogue Machines
Patch Management
What is a patch?
• A patch, or Hot Fix, is an updated file or set of files
(exe, dll, sys, etc) that fixes a software flaw
• Two types of patches:
– Security patches:
Patches that address known security vulnerabilities
– Non-security patches:
Patches that improve performance or fix functional problems
• Service Packs
– Contains all previously released security and non-security
patches (rollups)
– Contains new patches also
Race Against Time
Companies have less time to patch software flaws before Internet worms hit their computer systems.
Name of Worm
Number of Days
Worm Released
496
May 8, '01
July 18, '00
104
Oct. 30 '00
March 29, '01
550
Sept. 30, '02
June 18, '01
31
July 19 '01
Aug. 15 '01
34
Sept. 18 '01
April 17, '02
34
May 21, '02
185
Jan. 25 '03
46
Sept. 14, '02
July 16, '03
26
Aug. 11, '03
Witty
March 18, '04
2
March 20, '04
Sasser
April 13, '04
17
April 30, '04
Slapper
Blaster/Welchia/Nachi
Code Red
SQL Slammer
Sonic
Melissa
Sonic
600
500
Bugbear
400
Code Red
300
200
Nimda
100
0
Spida
July 24, '02
July 30, '02
Witty
March 27, '99
Slapper
65
Sadmind
Dec.is
1, released
'99
Number of days a worm
after a
vulnerability Dec.
is announced
29, '99
Spida
Melissa
Vulnerability Alert
What is patch management?
The process, through which companies…
• determine which patches are missing from their
environment
• deploy those patches to end user machines
• verify patches were successfully deployed
Automation is a key element of the patch management process.
– Computerworld July 2003
“The number of patches released makes it almost imperative to employ
automated solutions” –Gartner
Two Key Components
Assessment
• An analysis to determine whether or not a target machine is patched
Packaging & Deployment
• The distribution of a patch to a target machine
Deployment Options
Patch Assessment
Option #1:
Packaging
Deploy to end-user
w/ software deployment
Option #2:
Deploy to end-user
Patches for OS Platforms
Companies have to manually create and keep up to
date a spreadsheet illustrating which patch goes for
which operating system!
Check in with the experts
• The manual process of patching thousands of
workstations and servers in an environment is
“nearly impossible”. (Computerworld/July 14, 2003)
• “Gartner estimates that IT managers now spend up
to two hours every day managing patches.”
(Computerworld/July 14, 2003)
Patch Assessment-Considerations
• Audit the patch process
– Why is patch needed?
• Reboot required?
• Unsigned driver?
• Conduct an in-depth assessment
– CVE number
– Affected product
– Reason patch is missing
– Bulletin ID & name
Patch Assessment, how
A comprehensive meta document, called MSSECURE.XML,
provides the intelligence used to analyze whether or not a
patch is installed. It contains security bulletin name and title,
detailed product specific security hotfixes, including:
– Files in each hotfix package with their file versions and
checksums
– Registry keys that were applied by the hotfix installation
package
– Information about which patches supersede other patches
– Related Microsoft Knowledge Base article numbers
– Third party analysis of threats posed by a patch’s
vulnerability
– Links to additional information from BugTraq, cross
references to CVEs, and more
Patch Deployment
Patch packaging
Wizard-based package creation
Decentralized, scalable patch distribution method
Packaged using standard technology
Patch Deployment Packaged UI
Centralized patch depolyment
Ad-hoc patch distribution
Test deploy
Patch Package – Bat File Creation
Example bat file created to install patches.
Without BindView you would have to create this
manually for every workstation and patch.
Solution considerations
Agentless
Scalability
Scheduling
Baselining
Executive reporting/view
Detailed patch analysis
Comprehensive pre-patch auditing
Post patch verification auditing
Flexible/comprehensive patch selection (critical patches)
Flexible patch deployment (critical servers)
Office CD central source
Rollback capabilities
Common Patch Management Tools in
Enterprise Environments
 Microsoft Baseline Security Advisor (MBSA 1.0, 1.2)
 Microsoft Software Update Service (SUS)
 Microsoft Systems Management Server (SMS 2.0,
2003)
 Active Directory Group Policies
Microsoft Baseline Security Advisor (MBSA
1.0, 1.2)
 Designed for small to medium businesses (less than
500 machines or 1500 users
 No centralized management server or reporting
services
 No distributed agents for data collection
 Does not distribute patches
 When used with SMS, developers still have to
manually create patch packages
Microsoft Software Update Service (SUS)
 Corporate windowsupdate.com
 Does not evaluate “back office” applications such as
Exchange or IIS
 No reporting, only basic log analysis
 No distributed agents or distribution points
Microsoft Systems Management Server
(SMS 3.0)
 Does not specifically target security
 Software deployments (including patches) must be
created manually
 No easy way to report on only security patch
deployments
Active Directory Group Policies
 Not designed for patch deployment
 Cannot report on software deployments
 Targeted distribution points is cumbersome. You
must use multiple GPOs which is not recommended
 Cannot monitor software pushes
Q&A