Patch management: increasingly a facet of effective risk management Marcus alldrick Securelondon conference, 28 jUly 2009

© Lloyd’spatch management SecureLondon 0709 v012 IF the attacker has a greater understanding of its target then it has the advantage

© Lloyd’spatch management SecureLondon 0709 v013 Criminal attackers are now driven by monetization cost and profitability

© Lloyd’spatch management SecureLondon 0709 v014 Patching and other protective measures increases attackers’ monetization cost and reduces their profitability

© Lloyd’spatch management SecureLondon 0709 v015 Trends Continued rapid evolution of attack strategies / sophistication Web applications increasingly vulnerable and targeted Decrease in mass mailing viruses and worms Trojans increasing, notably in data stealing malware 2007: 52%, 2008: 87%, Q109 93% Source: TrendLabs, 2009 Multiple threat vectors employed, e.g. PDFs, Flash multimedia, Java Motivation predominantly illicit economic gain More financial investment in vulnerability exploitation due to ROI Intellectual property emerging as the target Zero day vulnerabilities increasing Difficult education messages to business and customers, persist

© Lloyd’spatch management SecureLondon 0709 v016 Trends cont. 5,491 vulnerabilities in 2008, 19% increase on 2007 High severity vulnerabilities decreased from 4% to 2% in 2008 Medium vulnerabilities increased from 61% to 67% in % of vulnerabilities classified as easily exploitable (74% in 2007) 63% of vulnerabilities affected Web applications (59% in 2007) Mozilla browsers:99 vulnerabilities Internet Explorer:47 Apple Safari:40 Opera:35 Google Chrome:11 XSS, SQL injection and file include vulnerabilities predominate 95% of attacked vulnerabilities were client-side, 5% server-side Source: Symantec Global Internet Security Threat Report, 2009

© Lloyd’spatch management SecureLondon 0709 v017 SC Magazine The Guardian DarkReading.com "The days of people doing this because they're bored are mostly over. We would expect that the person who controls this thing will try to auction off parts of the network that they have created." Thomas Cross IBM ISS Microsoft offers $250,000 bounty for authors of the Conficker worm SC Magazine Top exploitation: Conficker

© Lloyd’spatch management SecureLondon 0709 v018 Top 10 Vendors with the most vulnerability disclosures RankingVendorDisclosures 1Microsoft3.16% 2Apple3.04% 3Sun2.19% 4Joomla!2.07% 5IBM2.00% 6Oracle1.65% 7Mozilla1.43% 8Drupal1.42% 9Cisco1.23% 10TYPO31.23% Source: X-Force 2008 Trend & Risk Report, IBM, 2009

© Lloyd’spatch management SecureLondon 0709 v019 Top 10 operating systems with the most vulnerabilities reported RankingVendorDisclosures 1Apple Mac OS X Server14.3% 1Apple Mac OS X14.3% 3Linux Kernel10.9% 4Sun Solaris7.3% 5Microsoft Windows XP5.5% 6Microsoft Windows 2003 Server5.2% 7Microsoft Windows Vista5.1% 8Microsoft Windows % 9Microsoft Windows % 10IBM AIX3.7% Source: X-Force 2008 Trend & Risk Report, IBM, 2009

© Lloyd’spatch management SecureLondon 0709 v0110 Recent surveys Technology is one of the highest priorities for companies yet many companies do not know what risks they now face 47% of surveyed European companies use vulnerability scanning tools Source: The Global State of Information Security Survey, % of respondents conduct vulnerability scanning at least annually Both emerging technology and increasing sophistication of threats seen as less of a barrier last year compared to 2007 ~70% saw inadequate Patch Management as a medium/high issue Virus & worm attacks, attacks and phishing/pharming dominate Source: Protecting what matters, The 6 th Annual Global Security Survey, Deloitte, 2009 Economic distress will exacerbate the situation Security seen as a cost and therefore at risk of reduction Increased opportunity and incentive for attackers

© Lloyd’spatch management SecureLondon 0709 v0111 Main consequences of exploitation ConsequenceDescription Bypass security Circumvention of security measures, e.g. firewall, proxy, IDS/IPS, anti-malware defences Data manipulation Manipulation of data used/stored by host and used by service or application Denial of Service Crash/disrupt a service or system to take down a network File manipulation Create, delete, modify, overwrite or read files Gain access Obtain local/remote access including execution of code/commands Gain privileges Obtain local privileges Obtain information Obtain file and path names, source code, passwords, configuration details, etc.

© Lloyd’spatch management SecureLondon 0709 v0112 Reactive remediation Malware infection and system failure remain the incident types that require most staff time to fix 7% of infections took man days to recover 1% of infections took >100 man days Source: Information Security Breaches Survey 2008, BERR

© Lloyd’spatch management SecureLondon 0709 v0113 Constraints Patch overload Different builds Complexity of patches Device connectivity Resource constraints Testing timescales Testing infrastructure Application dependency Lack of / inadequate asset inventories Lack of / inadequate configuration management Scheduling / downtime / business impact

© Lloyd’spatch management SecureLondon 0709 v0114 Patch Management process Identify Patch & Vuln. Assess risk of Vuln. Perform Impact analysis Test Patch Pilot Patch Roll-out Patch Patch rest of devices Review and Report

© Lloyd’spatch management SecureLondon 0709 v0115 Vulnerability Management Security alerts – proactive Patch management - preventative Security incidents – reactive / curative Vulnerability assessment – indicative monitoring Security Alert Management Patch Management Incident Management Vulnerability Assessment Vulnerability Management

© Lloyd’spatch management SecureLondon 0709 v0116 ITIL V3 Process Summary Service Operation Event Management Incident Management Problem Management Service Strategy Business Requirements IT Policies & Strategies Service Transition Change Management Asset & Config Mgmt Service Design Service Level Mgmt Availability Mgmt Info Security Mgmt Patch Management

© Lloyd’spatch management SecureLondon 0709 v0117 Key considerations Mandate through agreed Patch Management strategy and policy Senior Management buy-in and support essential Conflicts between patching and business operations must be resolved Schedule patch activity as BAU but allow for emergencies Prioritise patches based on risk to organisation Implement standard builds Reduce local admin privileges Maintain asset inventories / configuration management Consider application whitelisting Formulate integrated process and automate wherever possible Allocate adequate resource, both management and line

© Lloyd’spatch management SecureLondon 0709 v0118 To summarise….. Patch management is increasingly business critical given reliance on technology infrastructure Should be proactive and preventative, not reactive and curative Business impact reduction from a risk perspective should be key driver Key is understanding the motivation, opportunity and risk to the attacker Should be viewed as part of a bigger picture, an integrated process Supported by defence in depth strategies Automated tools are essential but so are the right people Knowledge is power: know your vulnerabilities and where they are End user estates increasingly as important as server estates Flexibility and agility is crucial

© Lloyd’spatch management SecureLondon 0709 v0119