Beating Hackers To The Patch

The frequency and severity of cyber attacks are growing rapidly. The number of IT security incidents jumped from 52,658 in 2001 to 82,094 in 2002, according to the Computer Emergency Response Team (CERT) Coordination Center at Carnegie Mellon University.



Network administrators facing a flood of patches from Microsoft must act fast to safeguard corporate information. They need plans for quickly determining which patches apply to their systems and how to roll out them out quickly. They should also learn how the software they purchased for rolling out patches will perform under tight deadlines.

Unfortunately, administrators donít have much time to make an informed decision. If it takes them a couple of days to have a software engineer write the custom code to package and test a new patch Ė a typical timeframe for many patch management solutions Ė they might as well invite hackers to ravage their files.

When Microsoft discovers a security hole, it announces the problem on its security and privacy Web pages and offers a hot fix. But that announcement acts like a starting gun to would-be hackers trying to figure out how to get in. Some industry gurus estimate that as much as 80 percent of Microsoftís customer base wonít download the patch because administrators either donít think it will affect them, or they donít have the resources. So the sooner hackers launch the virus, the more damage they can inflict. Administrators need to act fast to safeguard their networks.

Rapid, successful first-time patch deployment is key to staying ahead of hackers. Rapid deployment depends upon several factors, including the ability to prevent users from downloading bad files, an accurate, near-real-time understanding of system hardware and software configurations, a quick evaluation of which patches are necessary, and patch management tools that automate packaging and delivery while providing high deployment success rates.

Here are a few tips that will help administrators deploy the right patches quickly and efficiently:

  1. Lock down desktops and devices to prevent bad file downloads. Limit damage at the outset by preventing users from downloading files that could launch worms, viruses and other attacks.
  2. Formulate a plan. Map out a series of steps for quickly evaluating the patch and its impact, and delegating responsibility for rolling out the patch quickly and efficiently.
  3. Know your system. This includes servers, PCs, laptops, portable devices, operating systems, applications, etc. If Microsoft issues a hot fix for a scanner driver and a company only has one barely-used scanner, the administrator may determine that patch is unnecessary.
  4. Carefully read the patch alerts. The majority of the thousands of patches Microsoft issues every year wonít apply to most environments.
  5. Automate patch packaging. Patch management software should enable network administrators to cut and paste the new hot fixes into the standard Microsoft package format. Doing so cuts packaging time from days to minutes, giving administrators a much better chance of plugging holes before an attack.
  6. Pull vs. push the patches. Package patches and put them on the corporate LAN where clients that need them can get them. Administrators can give the patch deployment software auto-install permissions to target only the clients that donít have a specific registry key that indicates the need for the patch. Setting up the clients to automatically and seamlessly determine whether or not they need the patch and then pull it to them is much more efficient than pushing the patch out, and it provides a much higher deployment success rate.
  7. Put out fires quickly. Sometimes simply having the patch on hand isnít enough. If a virus or worm gets in before a patch is fully deployed, time becomes even more critical in minimizing damage. Administrators can help themselves with software that quickly identifies if a virus has already broken through, hunts down the source and destroys it.

Microsoft is playing a high-stakes game of cat and mouse with hackers, and the giant software makerís customers are the ones with the most to lose. Network administrators are in a race with hackers, and only by anticipating attacks and reacting quickly will they win. By planning ahead, carefully scanning patch alerts for relevance, knowing existing software and hardware configurations and automating patch roll out, they can fill security holes before worms, viruses and other attacks can do any damage.

About the Author

Holger Weeres is the Manager of Technical Services for NetSupport Solutions, Inc.(NSSI), the makers of NetInstall, a leader in the Desktop Management industry. He has over 11 years of experience designing and implementing desktop management solutions for global enterprise networks. Holger worked as a network administrator for the German revenue offices managing their networks and later implementing NetInstall to deploy applications and manage user desktops, servers and laptops. Recognized by NetSupport for his outstanding work, he was hired as a consultant and worked on a variety of projects implementing enterprise desktop management solutions and terminal server farms for global enterprises. When NetSupport founded it's US Headquarters, NSSI, Mr. Weeres was chosen to lead their technical team. Today, Mr. Weeres manages a team of NetInstall engineers to provide technical support and consulting to Fortune 500 companies, is an author of technical whitepapers and is a noted expert in the field of desktop management.

More by Holger Weeres

About NetSupport Solutions

NetSupport GmbH, A privately held corporation, was founded in 1995 and has grown to become a leading provider of Electronic Software Distribution technology. In the spring of 1999, NetInstall entered the US and other world markets. Today, NetSupport Solutions, Inc. builds on the success of NetSupport GmbH, in North America.

Today over 1,500 companies use NetSupport Solutions NetInstall to manage over 1,600,000 client desktop computers worldwide. With customers ranging in size from 50 desktops, on a single server to heterogeneous environments with over 55,000 desktops and several hundred servers. NetInstall is a full function, software management solution designed for administrators to reduce the effort and cost of managing enterprise desktop computers.