Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

4/15/2009
03:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Open Source Metrics On Tap For Security Patch Management

Securosis, Microsoft team up to solicit input for building a metrics model that measures efficiency and costs of security patching

Security consulting firm Securosis is spearheading a new effort to create metrics to quantify the cost and efficiency of an organization's security patching process.

Rich Mogull, founder of Securosis, says to date there's no real way to accurately measure the cost and productivity of an organization's security patch management process. "Those fully quantified [IT] risk models don't apply and the numbers aren't accurate," he says. "It's also bothered me to see those uber-metrics approaches that get an overview of everything in the security program. So why not start with one thing we can accurately measure and use it as a core for building security metrics?"

Securosis, with the financial backing of Microsoft for the initial phase of the project, will gather input in an open submission process for the so-called Project Quant metrics model. Version 1 is planned for release by the end of June.

Many organizations don't have actual processes for out-of-cycle security patches, and end up in "panic mode" trying to apply them, Mogull says. Some don't even have processes for the scheduled patching their Oracle software, for instance, he says.

"We know there are tremendous inefficiencies in how [organizations] approach patching," Mogull says. "We're going to solicit [organizations] out there and find out different ways people are doing this and find a way to quantify this."

Jeff Jones, a director in Microsoft's Trustworthy Computing Group who first approached Securosis about the project, says the goal is to offer metrics that are consumable for business decision-makers. "Vuln counts and data risk [data] is cool for my tech people, but we would really like to see firms doing some analysis and getting results that are more appropriate for the business level," Jones says.

The metrics model will cover everything in the patch management process, from monitoring software for updates to installing the patches. It will analyze things like the amount of time it takes to test patches and roll them out, for instance, and on how many systems, etc., Mogull says. "As compared with other things in security, you can get a reasonably accurate [accounting] of costs" here, he says. "We're going to come out with something that helps IT professionals get their jobs done better and that they can present to the business guys."

The creation of the model will be an open and transparent process, Mogull says. Any input from Microsoft's Jones, for instance, would be posted on the project Website just like any other submission, he says.

And Jones is hoping other vendors will help with the project. "I'm hoping we can drive participation from other people in the industry, like patch management tools companies and other vendors," he says.

Project Quant will be a spreadsheet-type model, where organizations can plug in numbers and rate their efficiencies and costs. Although version 1 won't include benchmarks, the final product will. Among the elements it will include: defining patch management roles and phases; measuring the actual cost of patching in an organization; and providing organizations a way to see how efficient their process is or is not, so they can improve it.

Microsoft's Jones says he hopes to gather information from some key Microsoft customers about their patch management processes and document their experiences as part of the project. "We need to have options of how the [metrics] might apply to different [size businesses] -- from the small business to the biggest enterprise," he says.

The metrics model will be released under a Creative Commons license, and spreadsheets will be available in both Excel and open formats.

"The vision is for this to [also] become an element that rolls into ... bigger models for server or systems management," Microsoft's Jones says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1575
PUBLISHED: 2019-07-16
Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API (in PAN-OS) and p...
CVE-2019-1576
PUBLISHED: 2019-07-16
Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the escalated user?s permissions.
CVE-2018-19629
PUBLISHED: 2019-07-16
A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allows an attacker to crash the service via a TCP connection.
CVE-2019-10100
PUBLISHED: 2019-07-16
Quake3e < 5ed740d is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Argument string creation.
CVE-2019-10100
PUBLISHED: 2019-07-16
UPX 3.95 is affected by: Integer Overflow. The impact is: attacker can cause a denial of service. The component is: src/p_lx_elf.cpp PackLinuxElf32::PackLinuxElf32help1() Line 262. The attack vector is: the victim must open a specially crafted ELF file.