To prevent online security breaches, it is necessary to eliminate threats and their root sources

• Direct response to threats (symptoms): Firewall, IDS, IPS, Anti-Virus
• Indirect Prevention of Causes (vulnerabilities): Regular Vulnerability Scan, Patch, OS Hardening, Authorization

Automated solutions for direct response exist, but removing underlying causes still requires manual involvement.
Patch management is the most effective preventative measure against security vulnerabilities in OS and applications.

• Not installing security patches leaves open a path to security incidents
  
• Causes major global security incidents (i.e. SQL Slammer, Code Red)
• Over 95% of system compromises are a result of exploiting known security vulnerabilities (FBI/CSI)
  
• The newest worms take varying forms. Rapid patch deployment is crucial.
  • How a worm is published
    - Discovery of Vulnerability Patch Release
    Attack Method Published Worm Published
  • Even a single worm infection can wreak havoc throughout the network
  • The interval between discovery of vulnerability to worm publishing is becoming shorter, requiring speedier responses
    - Nimda: 331 days
    - SQL Slammer: 180 days
    - Blaster: 25 days
    - Sasser: 15 day

Why is patch management important?

• Patch management is the best defensive against worms, because it removes the fundamental source from which security breaches arise
• Patch management requires central management and management expertise
  • Overall Status: What is the exact status of patch deployment for your organization?
  • Integrity of Patch Files: Are the patch files that are deployed secure and reliable?
  • Timely Deployment: At what point of time can a patch be deployed safely?
  • Patch Level: What is the accepted level of patch status for your organization?
  • Deployment Method: Can a patch be deployed without disturbing availability?
• Most network resources (IP addresses) are occupied by PCs, making central management difficult
  
  • Patch management for servers are performed by server administrators with expertise
    
  • Determining the patch status of user PCs is becoming an increasingly important issue in security consulting
    
  • Patch management practice for user PCs cannot rely on users themselves