Captain's Blog

Busy Day on the patch management news wires

This article is a replay of recent blog but it has a great quote, its part of a pretty busy day on the Google News for "patch management"

“Waves of targeted e-mail attacks, often called 'spear phishing,' are exploiting client-side vulnerabilities in commonly used programs such as Adobe PDF Reader, QuickTime, Adobe Flash and Microsoft Office,” the report states. “This is currently the primary initial infection vector used to compromise computers that have Internet access.”

What floors me is that I wrote software to detect the first Microsoft patch about 12 years ago and people are still not getting patches out.  Proper patch management software is very difficult to do correctly so I know why most vendors such as Microsoft and Symantec do not bother to get it right, but there are other vendors who do it well. Not only us be clear.  Just go out and buy one that works for you, roll it out and use it.  It will take a few hours a month, the cost is reasonable and the problem solved.  Even if these articles are a bit of vendor hype, the risk is real and the solutions are there. 

End-point management

As noted by SANS end-point patch management lags: "New attack data shows organizations are missing the mark in their security priorities as client-side application flaws, Web flaws dominate as attack vectors"

It’s safe to assume that most organizations that want run AV on their end-points do, but why not patch management?  Both are needed, so why not just deploy a solution and solve the problem?  Both patching and AV products have been around for years, right?

So why does the SANS study show end-points are not well patched?

A few thoughts -- WSUS is too hard to manage and if you get it right you only find out that is supports just some of Micorsoft products and no other products.  Strike one, it simply does not work.  And WSUS is also the engine for SCCM so that does not work either.  Strike two.

How about Altiris?  Great product, right?  Just not for patch management.  Foul Ball, but its still 0-2.

How about a security product like FoundScan or Qualsys?  no patch management, another foul ball and end-points are still not patched.

How about rolling out an integrated patching AV end-point product like ours at the same time as you rollout AV, all done in one shot? it solves both problems at one time.  its a base hit, or better maybe its a home-run.  Why are other major vendors not doing this?  Doing patching right is hard work to get right and keep right, and most vendors are not invested enough in it so they are not providing solutions their customers need, and machines are not kept patched.

The answer is there but Microsoft does not want you to know it, they have a big bet on you not knowing.  The same holds true for Symantec and other security vendors including McAfee.

 

 

Virtualization Updates

I was in San Francisco at the VMworld conference this week.  Lots of activity, good sessions, and many vendor announcements being made.    SF has a great downtown, and we had great weather there making it very enjoyable.

VMworld reminded me of the energy people using VMware products have, it was a great show this year as it was last year.  When I compare it to the 2009 RSA show, held at the same location, VMworld just felt much more active with people there to learn and create new solutions.  The VMworld show floor was always busy, even the last hour of the last day which is rare for a trade show.  

Check out the new video showcasing VMware Go, the new web-based service from VMware. VMware Go enables first-time virtualization users to fly through the ESXi setup process with just a few mouse clicks.  VMware Go was developed in partnership with VMware and Shavlik Technologies. http://www.youtube.com/watch?v=HQd6PM5TMDA  this is a new area for us as we extend our simplification models to new areas.  Go of course contains our patching technologies, for both ESXi itself and VMs running on it. Thank you to the VMware and Shavlik teams for working so hard on this release. It was a busy summer. This our 2nd partnership with VMware, the other one is with the UpdateManager with also uses our patching technology.

(infomercial)

The team at Shavlik has announced this week that we have added asset management capabilities in the Shavlik Security Suite, making it the only solution available that manages IT operations for both physical and virtual worlds, including offline virtual patches.   The Shavlik Security Suite allows organizations to apply a single process to ensure machines – physical or virtual -- are identified, secured, and managed across their lifecycle from a single viewpoint.  From patching, to AV, to VMware asset inventory to agent-less inventory scanning for physical computers.

The significant benefit of the new asset management capabilities in the Shavlik Security Suite is to leverage our agent less approach to thoroughly and dynamically discover and catalog IT assets including software assets, hardware assets, and virtual machine assets. Now organizations will be able to discover physical and virtual machines they didn’t know they had and uncover software applications they didn’t know were installed.  By consolidating this information in one Shavlik console, the organization has all the relevant information about its IT assets at its finger tips so they can make informed decisions with confidence and accuracy.  They can then take the information and filter their view in machine centric view and filter their reports using any of the collected inventory data, AV state, patch state, Compliance state and configuration state. the Suite also provide end-point security protection. All at great integrated prices. 

 The Shavlik Security Suite is in public beta today.   We encourage you to sign up for our beta program, give the products a test drive, and let us know what you think.  To join the beta program, sign up on our web site at www.shavlik.com/netchk-beta.aspx.    We look forward to your feedback. 

 The Security Suite will be generally available for public download and customer upgrades on September 29th.