Analytics
4/15/2009
03:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Open Source Metrics On Tap For Security Patch Management

Securosis, Microsoft team up to solicit input for building a metrics model that measures efficiency and costs of security patching

Security consulting firm Securosis is spearheading a new effort to create metrics to quantify the cost and efficiency of an organization's security patching process.

Rich Mogull, founder of Securosis, says to date there's no real way to accurately measure the cost and productivity of an organization's security patch management process. "Those fully quantified [IT] risk models don't apply and the numbers aren't accurate," he says. "It's also bothered me to see those uber-metrics approaches that get an overview of everything in the security program. So why not start with one thing we can accurately measure and use it as a core for building security metrics?"

Securosis, with the financial backing of Microsoft for the initial phase of the project, will gather input in an open submission process for the so-called Project Quant metrics model. Version 1 is planned for release by the end of June.

Many organizations don't have actual processes for out-of-cycle security patches, and end up in "panic mode" trying to apply them, Mogull says. Some don't even have processes for the scheduled patching their Oracle software, for instance, he says.

"We know there are tremendous inefficiencies in how [organizations] approach patching," Mogull says. "We're going to solicit [organizations] out there and find out different ways people are doing this and find a way to quantify this."

Jeff Jones, a director in Microsoft's Trustworthy Computing Group who first approached Securosis about the project, says the goal is to offer metrics that are consumable for business decision-makers. "Vuln counts and data risk [data] is cool for my tech people, but we would really like to see firms doing some analysis and getting results that are more appropriate for the business level," Jones says.

The metrics model will cover everything in the patch management process, from monitoring software for updates to installing the patches. It will analyze things like the amount of time it takes to test patches and roll them out, for instance, and on how many systems, etc., Mogull says. "As compared with other things in security, you can get a reasonably accurate [accounting] of costs" here, he says. "We're going to come out with something that helps IT professionals get their jobs done better and that they can present to the business guys."

The creation of the model will be an open and transparent process, Mogull says. Any input from Microsoft's Jones, for instance, would be posted on the project Website just like any other submission, he says.

And Jones is hoping other vendors will help with the project. "I'm hoping we can drive participation from other people in the industry, like patch management tools companies and other vendors," he says.

Project Quant will be a spreadsheet-type model, where organizations can plug in numbers and rate their efficiencies and costs. Although version 1 won't include benchmarks, the final product will. Among the elements it will include: defining patch management roles and phases; measuring the actual cost of patching in an organization; and providing organizations a way to see how efficient their process is or is not, so they can improve it.

Microsoft's Jones says he hopes to gather information from some key Microsoft customers about their patch management processes and document their experiences as part of the project. "We need to have options of how the [metrics] might apply to different [size businesses] -- from the small business to the biggest enterprise," he says.

The metrics model will be released under a Creative Commons license, and spreadsheets will be available in both Excel and open formats.

"The vision is for this to [also] become an element that rolls into ... bigger models for server or systems management," Microsoft's Jones says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3216
Published: 2015-07-07
Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, allows remote attackers to cause a denial of service (application crash) by establi...

CVE-2014-3653
Published: 2015-07-06
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.

CVE-2014-5406
Published: 2015-07-06
The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, ...

CVE-2014-9737
Published: 2015-07-06
Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block.

CVE-2014-9738
Published: 2015-07-06
Multiple cross-site scripting (XSS) vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) account username, a (2) node title, or a (3) team entity title.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report