Blaster from the Past

The rapid spread of the Blaster worm shows that Microsoft customers need to do a better job with patch management. Microsoft warned of the exploitable security vulnerability on July 16. The U.S. Dept of Homeland Security issued a separate warning on July 24. Still, the Blaster worm has managed to wreck havoc, crippling many home and business PCs and slowing down Internet traffic. In Maryland, where I work, the Dept. of Motor Vehicles closed up early yesterday because of a crippling Blaster infection.

The simple application of a patch a month ago could have prevented spread of the worm. But patch management is perhaps Microsoft's biggest security bane. Many businesses legitimately approach patches cautiously, out of concern a security fix might cause unseen compatibility problems with vital software applications. Many consumers simply don't patch at all.

Some advice:

* All home users running Windows XP with broadband connections should enable the Windows Automatic Update feature. Windows Update automatically fetches patches and then prompts the user for installation.

* All businesses should require workers that dial into the corporate network to enable the Windows Automatic Update feature for any computer--even a personal, home PC--that connects remotely. Those same workers should be required to have a firewall installed on the same PCs, which is a good idea, anyway, for those employees using cable broadband at home.

* IT managers and their subordinates should subscribe to Microsoft's Security Update e-mail service, here. Major antivirus vendors offer similiar notification services. Microsoft and some of its antivirus partners have created the Virus Information Alliance, which seeks to offer faster notification about virus outbreaks. More information is available here.

* To its credit, Microsoft is trying to create better mechanisms for improving patch management. In the meantime, IT managers must take more responsibility to stay informed about security vulnerabilities and then to take quick preventative action. Rule of thumb: If the Dept. of Homeland Security issues a warning on a Windows security vulnerabilty, it's time to update all PCs right away.

* Microsoft does provide some useful resources on patch management, which all IT administrators and their subordinates should read: Guide to patch management. Guide to improving patch management.

Posted by Joe Wilcox at August 13, 2003 01:17 PM