Beyond patch management

A few companies are beginning to add capabilities beyond patch management to their software. "They're starting to talk more about vulnerability management, where patch management is [a] piece of what they do," said Mike Jones, vice president for marketing at Citadel. The lack of up-to-date patches accounts for only 30 percent of the security vulnerabilities to which computers are susceptible, he said.

Some vulnerability management systems have useful features, such as a mechanism for limiting the amount of bandwidth that the systems use when they distribute patches, said Ted Ritter, director for cybersecurity at Intelligent Decisions Inc., a systems integration company.

Several of the vulnerability management systems also offer quarantine capabilities, Ritter said. When a system connects to the network, it immediately is prevented from doing anything until it is checked to see that it has all of the latest patches and that it conforms to the configuration and password policies of the organization. "We think that's going to be huge," Ritter said.

Some security experts think that with better compilers and code scanning tools — and even a few hardware tricks — future software releases from Microsoft and other companies will have fewer security holes that require patching. "There are compilers, for example, that will virtually eliminate buffer overflow problems," said Peter Mell, a computer scientist in the Computer Security Division at the National Institute of Standards and Technology. Buffer overflows are one of the most frequent sources of built-in security flaws in software. During a buffer overflow attack, a program or process tries to store excessive amounts of data in a buffer or temporary data storage area.

Featured

  • Social Media
    Editorial credit: pcruciatti / Shutterstock.com

    They took all the tweets and put 'em in a tweet museum

    Twitter cancelled @realdonaldtrump, but the National Archives will bring presidential tweets back via the Trump library website.

  • Workforce
    Avril Haines testifies SSCI Jan. 19, 2021

    Haines looks to restore IC workforce morale

    If confirmed, Avril Haines says that one of her top priorities as the Director of National Intelligence will be "institutional" issues, like renewing public trust in the intelligence community and improving workforce morale.

Stay Connected