NIST describes the challenges as well as the technology available for meeting them in the updated release of its Guide to Enterprise Patch Management Technologies, Special Publication 800-40, Revision 3.
Patch management is a basic part of federal security controls required under the Federal Information Security Management Act. Researchers and hackers aggressively search for software flaws that can be exploited in commercial products, and vendors have worked with the security community to develop processes for responding with patches in a timely manner. With the complexity and frequent upgrading of operating systems and applications, this process has resulted in a nearly continuous stream of patches, straining the resources of agencies’ IT staffs.
Among the challenges in managing the process are the variety of mechanisms for applying patches, the different schemes for managing hosts and the maintenance of an accurate inventory of software. But the biggest problems are prioritizing, testing and scheduling deployment of patches. Because of the volume of patches being issued and the need to test them to ensure that they don’t do more harm than good, getting the patches deployed in a timely manner can be difficult, if not impossible. Because of the mission-critical nature of some systems, administrators sometimes put system availability above security and are reluctant to update the software.
Tools are available to help automate at least part of the patch management process, particularly the discovery of unpatched vulnerabilities and outdated software that needs attention. The NIST guidelines describe three basic techniques for identifying missing patches, each with its own advantages and disadvantages: Scanning by a host-based agent, agentless scanning and passive network monitoring. Choosing a technology depends on an enterprise’s needs, and some might want to use more than one type of tool.
- Agent-based tools work best for hosts that are not always on the local network, such as mobile devices, because they enable more regular scanning while unconnected. But some devices do not allow agents to run on them and agents might not be available for all platforms.
- Agentless scanning, which is done from a server, does not require installation or execution of an agent on each host. But hosts will not be scanned when they are not on the local network, and scanning can be blocked by firewalls or other technologies such as Network Address Translation.
- Passive network monitoring examines network traffic to identify applications and operating systems that need attention. Passive monitoring does not require privileges on the hosts being monitored and these tools can monitor devices that the enterprise does not control, such as those of visitors and contractors that log onto the network. But this technique depends on the ability to identify applications and software versions based only on network traffic and only work for those hosts that are on the network.
Metrics are necessary for determining the effectiveness of any security program. The NIST guidelines also provide suggestions for measuring the implementation of the patch management program, its effectiveness and its impact.
Less mature programs should start by measuring implementation and by looking at the percentages of devices and services being addressed in the program. More mature programs can measure effectiveness of implementation by assessing the frequency of updates, the time required to patch assets and the percentage of hosts that are fully patched at any given time. Metrics for the impact of the program can include costs of and savings from the patch management process.
Retrieved from GCN