to the Bottom of Patch Management
Over the years, patch management has become exponentially
important to the continued security and success of the world's
corporate networks. With 959 new viruses and worms released
last May alone, and operating systems and application patches
being released daily, an effective patch management strategy
has become a critical business practice to corporations of
all sizes. Unfortunately for smaller businesses and strained
IT departments, patch management can be quite burdensome.
Vulnerabilities are being exploited faster then patches are
being implemented, and as a result, entire networks are being
shut down, costing businesses millions of dollars every year
in lost productivity and revenue.
Emergency Response Team (CERT), the leading security incidents
and vulnerability coordination organization, reports that
over 95% of network intrusions can be prevented by keeping
networked systems up to date with the appropriate patches.
However, insufficient communication about security issues
with customers often times leads to patches not being applied
correctly or quickly enough to thwart attacks - the servers
are being compromised more quickly than any time in the past.
With new vulnerabilities being announced daily, and exploits
being carried out at virtually the same time as the vulnerability
is announced, it seems nearly impossible for IT administrators
to be able to know exactly which programs need patches, where
to find them, and how to test and deploy them in such a condensed
period of time. For example, the Microsoft Blaster worm, which
affected 120,000 vulnerable computers in its first 36 hours
of inception, was released only 26 days after the vulnerability
was found, giving Microsoft little time to release a patch
and administrators insufficient time to secure the fix.
difficult, it is possible to employ an efficient and effective
patch management strategy to any organization regardless of
available resources, and a great level of assurance that compatibility
with previous versions will be maintained. Following simple
guidelines like knowing your IT inventory, prioritizing the
patching of systems and programs, defining policies, executing
security patches as they become available, and most importantly,
correctly implementing each patch, can make patch management
simpler to manage, efficient and cost-effective. Additionally,
there are many software solutions and vendor-based services
an organization can use to further ease this task.
maintenance with special regard to patch management can be
arduous, Guardian Digital offers, through the Guardian Digital
Secure Network, advisories and automatic system updates intended
to keep administrative costs down without sacrificing security.
Patch management is a business issue that no company, large
or small, can afford to disregard. Vendor services such as
the Guardian Digital Secure Network provide solutions to all
the patch management issues described above and should be
considered when looking to implement a more effective patch
Wreski, CEO Guardian Digital, Inc.
EnGarde WorkGroup Suite
Secure Workgroup Suite is a comprehensive connectivity
solution designed to increase productivity and security
of any network. The perfect compliment to EnGarde Secure
Linux Professional, EnGarde WorkGroup Suite includes
browser-based administration, file and print sharing
functions, network management, VPN support, as well
as local and remote e-mail capabilities. Engineered
to be secure, EnGarde WorkGroup Suite is an ideal solution
for Internet and intranet connectivity needs.
WorkGroup Suite allows organizations to build a low-cost
alternative to proprietary file & print solutions,
access corporate network remotely and securely, and
manage system access. A complete package that extends
security and productivity features to the corporate
network, this workgroup productivity suite is robust,
easy to set up and requires no previous Linux experience
to configure or maintain.
more about Guardian Digital EnGarde
Digital In the News
Processor.com: Guard Your Networks with Wireless Protection
Guardian Digital's small business security and productivity
management system, Internet Productivity Suite, is featured
in Processor magazine for its comprehensive design and
special attention to wireless security.
Guardian Digital Upgrades Open Source Secure Mail Server
Digital CEO, Dave Wreski sits down with LinuxPipeline
and SecurityPipeline editor Mitch Wagoner to talk about
the launch of next-generation Guardian Digital Secure
There has been a lot of government intervention
regarding corporations and IT security in recent years.
Can you explain why these laws are needed?
A. As we have established many
times over, Internet and network security is essential
to the success of any business. But certain businesses
not only house their own confidential information, but
also that of their customers. Organizations such as
banks and insurance companies keep very personal, highly
confidential consumer information on their network.
If their network is compromised, not only is the livelihood
of the business at risk, but that of their customers
can be threatened as well. As a result, the United States
government has passed several mandates requiring certain
businesses to take measures to comply with federal regulations.
in question include HIPAA (Health Insurance Portability
and Accountability Act) and Sarbanes-Oxley Act. HIPAA
requires those in the medical or insurance industries
to ensure the privacy of confidential patient information.
Sarbanes Oxley, on the other hand, was passed in response
to the Enron issue and other major accounting scandals,
requiring the CEO and CFO of publicly traded companies
to validate financial statements and other accounting
on the surface these laws have very little to do with
IT security and more to do with privacy and accountability,
network security applications have become compliance
solutions for the organizations effected. The reason
for this is the simple fact that a majority of organizations
(especially large corporations) conduct almost all their
business electronically and on the Internet. The days
of paper files and "snail mail" are seemingly
over. Business-critical communications, financial records,
customer information and other corporate data is stored
on corporate networks. If a corporate network lacks
sufficient security to keep intruders out, that information
becomes vulnerable to interception and exploitation.
By aptly securing corporate networks, the integrity
of private information remains in tact allowing organizations
to comply with appropriate federal regulations.
Behind the Shield editors encourage their readers to
submit questions. The most frequently asked questions
will appear in future issues. We look forward to answering
all your inquiries! Email us at firstname.lastname@example.org
& Tips from Experts
recent years, outsourcing for IT security assistance has become
a very popular trend among small to medium sized organizations.
Not having the man power in-house to handle everything necessary,
outsourcing certain tasks seems like a viable option, however
there are security factors to keep in mind when looking to
frequent IT services outsourced are usually services such
as vulnerability scanning, monitoring, consulting, and forensic
analysis. These are vastly important services when referring
to network security. As with anything else, trusting an outside
source with the security of a network can be risky. Is the
outsourcing firm legitimate, honest, and willing to provide
the most optimum services? To answer these questions, thoroughly
check on the company in question. Visit the location, ask
for references, and examine their financial background and
the way the do business. Make sure they are professional,
capable and stable. Finally, if an organization decides to
go forward, they should insist on a strong service agreement
and some insight and involvement into the services the outsourcer
will be providing.
Digital is pleased to provide Behind the Shield readers with
informative expert advice on what network security really
means. Each month a new topic of interest will be chosen to
supply you with useful tips and information not offered elsewhere.
This month, we'll have a brief discussion on steps to take
when considering outsourcing IT security services.
Through national and multi-national partners like SpeedTech,
Inc. in Italy, Guardian Digital is able to provide their productivity
and security solutions to customers worldwide.
is Italy's premier information technology company. Offering
a wide array of high quality products and services, SpeedTech
provides everything from system & database administration
to networking & security solutions. Software development,
technology consulting, and project management services are
also available. Encompassing competencies in a multitude of
different sectors, SpeedTech adeptly provides complete and
customized solutions for each of their many clients.
was selected as a partner due to exceptional security and
simplified management of its products. Utilizing Guardian
Digital's products, SpeedTech is able to provide secure server
solutions to its customers in less time and at a fraction
of the cost.
For further information
on SpeedTech, please visit their website at: www.speedtech.it