Beyond patch management

A few companies are beginning to add capabilities beyond patch management to their software. "They're starting to talk more about vulnerability management, where patch management is [a] piece of what they do," said Mike Jones, vice president for marketing at Citadel. The lack of up-to-date patches accounts for only 30 percent of the security vulnerabilities to which computers are susceptible, he said.

Some vulnerability management systems have useful features, such as a mechanism for limiting the amount of bandwidth that the systems use when they distribute patches, said Ted Ritter, director for cybersecurity at Intelligent Decisions Inc., a systems integration company.

Several of the vulnerability management systems also offer quarantine capabilities, Ritter said. When a system connects to the network, it immediately is prevented from doing anything until it is checked to see that it has all of the latest patches and that it conforms to the configuration and password policies of the organization. "We think that's going to be huge," Ritter said.

Some security experts think that with better compilers and code scanning tools — and even a few hardware tricks — future software releases from Microsoft and other companies will have fewer security holes that require patching. "There are compilers, for example, that will virtually eliminate buffer overflow problems," said Peter Mell, a computer scientist in the Computer Security Division at the National Institute of Standards and Technology. Buffer overflows are one of the most frequent sources of built-in security flaws in software. During a buffer overflow attack, a program or process tries to store excessive amounts of data in a buffer or temporary data storage area.

Featured

  • Workforce
    Shutterstock image 1658927440 By Deliris masks in office coronavirus covid19

    White House orders federal contractors vaccinated by Dec. 8

    New COVID-19 guidance directs federal contractors and subcontractors to make sure their employees are vaccinated — the latest in a series of new vaccine requirements the White House has been rolling out in recent weeks.

  • FCW Perspectives
    remote workers (elenabsl/Shutterstock.com)

    Post-pandemic IT leadership

    The rush to maximum telework did more than showcase the importance of IT -- it also forced them to rethink their own operations.

Stay Connected