Managing software patch installations

A computer hardware-implemented method, system, and/or computer program product manages software patches. A computer monitoring hardware system receives a notification of a new release of a software patch. The computer monitoring hardware system scores a security posture of a monitored computer system to generate a security posture value based on a set of computer system parameters for the monitored computer system. In response to patch control logic within the computer monitoring hardware system determining that the monitored computer system is authorized to install the software patch and that the security posture value exceeds the predetermined value, the computer monitoring hardware system retrieves and installs the software patch in the monitored computer system.

BACKGROUND

The present disclosure relates to the field of computers, and specifically to the use software patches for software running in computers. Still more particularly, the present disclosure relates to managing which software patches are installed in particular computers.

Once software is released, a determination is often made that a “fix” is needed to correct a fault in the software. This fault may have been inherent at the time of the release, or it may be in response to a new threat, such as a virus attack. Such “fixes” are referred to as “software patches,” and are typically made available by the enterprise that released the software.

SUMMARY

A computer hardware-implemented method, system, and/or computer program product manages software patches. A computer monitoring hardware system receives a notification of a new release of a software patch. The computer monitoring hardware system scores a security posture of a monitored computer system to generate a security posture value based on a set of computer system parameters for the monitored computer system. In response to patch control logic within the computer monitoring hardware system determining that the monitored computer system is authorized to install the software patch and that the security posture value exceeds the predetermined value, the computer monitoring hardware system retrieves and installs the software patch in the monitored computer system.

DETAILED DESCRIPTION

As noted herein, a complex stream computer utilizes software and hardware components that interact with one another, such that a downstream component is reliant on an output from an upstream component in the complex stream computer. Thus, such systems are notoriously difficult to debug. That is, if the output of the entire stream computer fails, (i.e., if the output is an error code, is nonsense, is outside of an acceptable range, etc.), the upstream cause within the complex stream computer is difficult to identify by simply backtracking. The present invention presents a novel approach to identifying root causes in such cascade processes.

With reference now to the figures, and in particular toFIG. 1, there is depicted a block diagram of an exemplary system and network that may be utilized by and/or in the implementation of the present invention. Note that some or all of the exemplary architecture, including both depicted hardware and software, shown for and within computer102may be utilized by software deploying server150, patch server152, and/or monitored computer system(s)154.

Exemplary computer102includes a processor104that is coupled to a system bus106. Processor104may utilize one or more processors, each of which has one or more processor cores. A video adapter108, which drives/supports a display110, is also coupled to system bus106. System bus106is coupled via a bus bridge112to an input/output (I/O) bus114. An I/O interface116is coupled to I/O bus114. I/O interface116affords communication with various I/O devices, including a keyboard118, a mouse120, a media tray122(which may include storage devices such as CD-ROM drives, multi-media interfaces, etc.), a printer124, and external USB port(s)126. While the format of the ports connected to I/O interface116may be any known to those skilled in the art of computer architecture, in one embodiment some or all of these ports are universal serial bus (USB) ports.

As depicted, computer102is able to communicate with a software deploying server150, as well as patch server152and/or monitored computer system(s)154, using a network interface130. Network interface130is a hardware network interface, such as a network interface card (NIC), etc. Network128may be an external network such as the Internet, or an internal network such as an Ethernet or a virtual private network (VPN).

Application programs144include a renderer, shown in exemplary manner as a browser146. Browser146includes program modules and instructions enabling a world wide web (WWW) client (i.e., computer102) to send and receive network messages to the Internet using hypertext transfer protocol (HTTP) messaging, thus enabling communication with software deploying server150, patch server152, monitored computer system(s)154, and other computer systems.

Application programs144in computer102's system memory (as well as software deploying server150's system memory) also include a patch control logic (PCL)148. PCL148includes code for implementing the processes described below, including those described inFIG. 2. In one embodiment, computer102is able to download PCL148from software deploying server150, including in an on-demand basis, wherein the code in PCL148is not downloaded until needed for execution. Note further that, in one embodiment of the present invention, software deploying server150performs all of the functions associated with the present invention (including execution of PCL148), thus freeing computer102from having to use its own internal computing resources to execute PCL148.

Patch server152provides notice of and/or delivery of software patches, which are delivered to monitored computer system(s)154(e.g., servers) under the supervision and management of a computer monitoring hardware system such as computer102.

With reference now toFIG. 2, a high level flow chart of one or more exemplary steps performed by a processor or other computer hardware to manage the installation of new software patches in computer systems is presented. After initiator block202, a computer monitoring hardware system (e.g., computer102shown inFIG. 1) receives a notification (e.g., from patch server152shown inFIG. 1) of a new release of a software patch, as described in block204. As described in block206, the computer monitoring hardware system scores a security posture of a monitored computer system. This scoring generates a security posture value based on a set of computer system parameters for the monitored computer system (e.g., one or more servers from monitored computer system(s)154shown inFIG. 1). In order to be processed by the computer monitoring hardware system, in one embodiment the set of computer system parameters is described by a set of binary data. Thus, the scoring is performed by the computer monitoring hardware system utilizing the set of binary data as inputs to a patch control logic (e.g., PCL148inFIG. 1) within the computer monitoring hardware system. In one embodiment, the set of computer system parameters comprises a past history of attacks on the monitored computer system. That is, determining the vulnerability of a particular system/server is based on when, how often, by what party, etc. the particular system/server was attacked by malicious software (e.g., viruses, Distributed Denial of Service (DDoS) attacks, etc.) in the past.

In one embodiment, the set of computer system parameters further comprises a predetermined level of exposure of the monitored computer system to other computer systems. For example, a computer that is behind a firewall is less exposed to other computer systems than a computer that is not behind a firewall. In this example, the computer system that is not behind the firewall would be given preference over the computer that is behind the firewall when scheduling the installation of the new software patch.

In one embodiment, the set of computer system parameters further comprises a predetermined level of integrity and trustworthiness of data stored on the monitored computer system. For example, a computer that holds data that has been verified as being accurate and/or truthful (e.g., facts, data, etc. have been verified/audited as being accurate) is deemed to have a higher level of integrity and trustworthiness than a computer that holds data that has not been formally audited/verified/certified (e.g., information in informal e-mails, local “scratch pads”, etc.). In this example, the computer holding the verified/audited data would be given preference over the computer holding the unverified data when scheduling the installation of the new software patch.

In one embodiment, the set of computer system parameters further comprises an amount of time that the monitored computer system will be unavailable for use while the software patch is installed on the monitored computer system. For example, one computer may be down for 5 minutes while installing a new software patch, while another may be down for 5 days. That is, the first computer may be readily accessible, either by remote control or by being physically local, and thus installing the patch will take only a short amount of time. However, another computer may be physically located at a remote location that is not accessible by remote control (e.g., via the Internet). In order to prevent damage to this remote system, it may need to be taken off line (e.g., by telling someone to simply unplug it) until a technician is able to come out and install the new software patch. In this example, the computer requiring only 5 minutes to install the new software patch would be given preference over the computer that required 5 days to install the new software patch when scheduling the installation of the new software patch.

In one embodiment, the set of computer system parameters further comprises a quantity of steps required to access the monitored computer system. For example, a first computer may require just 1 step to access a particular server (e.g., log into a webpage that is dedicated to accessing that particular server). However, a second computer may require 5 steps in order to be accessed (e.g., 1) access a portal webpage; 2) enter CAPTCHA-type words to ensure that the user is not a malicious bot; 3) identify a particular server; 4) enter a first password; and 5) enter a second password). In this example, the first computer is likely to need the new software patch more than the second computer (particularly if the software patch is to prevent a viral attack), and thus the first computer is given preference over the second computer when scheduling the installation of the new software patch.

In one embodiment, the set of computer system parameters further comprises a quantity of remote databases that are accessible by the monitored computer system. For example, a first server may have access to only 1-2 local databases (due to internal configuration and/or security settings), while a second computer may have access to thousands of databases, either local or remote. In this example, the second computer would be given preference over the first computer when scheduling the installation of the new software patch.

Note that in one embodiment, if there are multiple parameters in the set of computer system parameters, then one or more of the parameters within the set of computer system parameters is individually weighted to generate a weighted security posture value. That is, each parameter is weighted according to a predetermined importance of said each parameter. For example, assume that the set of computer system parameters includes a parameter related to the history of past attacks on a particular computer system, while another parameter is related to how many steps are required to access that computer system. In this example, it may have been predetermined that the history of past attacks is more important than how many steps are required to access this computer system. Thus, the first parameter (number of attacks) is given a weighting of 3, while the second parameter (number of steps required to access the system) is given a lower weighting of 1. That is, assume that there have been 5 attacks on a first computer system, and there are 3 steps that must be taken to access this first computer system. A second computer system, however, has only had 4 past attacks, but requires 4 steps to be accessed.

Thus, the weighted security posture value for the first computer system would be:
(3*5)(weighing of 3 times the 5 attacks)+(1*3)(weighting of 1 times the 3 steps)=18.
The weighted security posture value for the second computer system would be:
(3*4)(weighing of 3 times the 4 attacks)+(1*4)weighting of 1 times the 4 steps)=16.

Thus, the first computer system would have a higher weighted security posture value, and would be given preference over the second computer system when scheduling the installation of the new software patch, particularly if the new software patch is designed to reduce viral attacks. That is, the first computer is given priority over the second computer, even though the first computer initially might appear to be easier to hack, since it requires only 3 steps to access rather than the 4 steps required by the second computer.

Returning now toFIG. 2, the patch control logic within the computer monitoring hardware system determines whether the monitored computer system is authorized to install the software patch, as described in block208. This authorization may be based on whether the particular computer system being monitored has the appropriate license to receive the software patch, whether that computer system is active and/or on-line, whether that computer system is geographically located within a country or other location that has been deemed to pose a national security risk (e.g., is that computer located in a country that is hostile to a local country), etc. If the monitored computer system is not authorized to install the software patch (query block210), then the process ends (terminator block218). However, if that computer system is authorized to install the software patch (query block210), then a determination is made, by the patch control logic within the computer monitoring hardware system, as to whether the security posture value described above exceeds a predetermined value (block212). For example, a predetermination may be made that only computer systems that have a weighted security posture value over 17 are to receive new software patches, in order to save money, reduce downtime of systems, etc. In the example above, the second computer system with the weighted security posture value of 16 would not get the new software patch, while the first computer system with the weighted security posture value of 18 would. Note that the decision to install the software patch can be based on the described-herein security posture value, weighted or not.

If the particular monitored computer system is authorized to install the new software patch and has a security posture value that exceeds the predetermined value (query block214), then the new software patch is retrieved (e.g., by the computer102shown inFIG. 1from the patch server152) and is installed in the monitored computer system (e.g., monitored computer system(s)154shown inFIG. 1), as indicated in block216.

Note that in one embodiment, the monitored computer system is assigned to a group of computer systems, in which each computer system in the group of computer systems has a same (or at least within a same range) scored security posture (based on the security posture value) as the monitored computer system. Thus, a predetermination can be made that, assuming that they are all authorized to receive the new software patch, each and every one of the computer systems in this group of computer systems will receive the same software patch for installation, thus avoiding the need to evaluate each of the computer systems in the group before software patch installation. That is, authorization to install the software patch for one of the computer systems in the group results in authorization to install the same software patch in all of the computer systems in the group. The computer systems may be grouped according to each of them using a same type of processor, a same or same type of operating system, etc. In another example, assume that the software patch is for a specific operating system, and that each computer system in a group of computer systems uses a same application program that runs under that specific operating system. In this example, all computers running this application program under this operating system will be granted authorization to install the software patch when one of the group is cleared (according to its scored security posture) to receive the software patch for installation.

In one embodiment, the software patch is classified as being part of a particular class of software patches. For example, assume that the notice of the new software patch received from the patch server states that this patch is for handling DDoS attacks. Assume further that an enterprise has a group of engineers who are assigned to work on DDoS attack prevention. In this example, the notification of new release of the software patch is transmitted only to this group of engineers. In one embodiment, the routing of the notification is controlled by the patch server. In another embodiment, however, the routing of the notification is controlled by the enterprise that owns/manages the monitored computer system. For example, all such software patch notifications may be received by an enterprise computer system that reads metadata describing the notification and the type of software patch involved. Using this metadata, the notification and/or the software patch itself is sent only to that group that is devoted to handling the type of problem addressed by this class of software patch.

In one embodiment, the particular class of software patches may be defined as patches designated for use in a specific hardware system that is running a particular application under a predetermined operating system. That is, rather than having a group that is devoted to handling a particular type of problem (e.g., DDoS attacks), the group can be made up of persons devoted to caretaking/managing a particularly type of system.

In one embodiment, notification of additional software patches for the computer system may be received (e.g., by computer102shown inFIG. 1). In this embodiment, a criticality level of the software patch is compared to a criticality level of the additional software patches. That is, each of these criticality levels has been predetermined according to how critical the software patch and the additional software patches are to enabling a target software to continue to function within predefined parameters. That is, the first software patch may have been predetermined to be highly critical (e.g., based on the security posture value described above), while the other software patches are deemed less important (based on these same security posture values). Thus, installation of the software patch and the additional software patches is prioritized based on the criticality level of the first software patch as compared to the criticality level of the additional software patches. In this embodiment, the criticality level may be further based on a predetermined level of exploitability of the computer system (e.g., a predetermined level of exploitability that is based on an amount of time (independent of the number of steps) required to access the computer system without authorization.

Note further that in one embodiment, information related to the software patch is stored in a configuration management database (CMDB), which holds information related to all of the monitored computer system(s) depicted inFIG. 1. This CMDB holds information from the patch server152as well as information from an owner/manager of the monitored computer system(s)154, including requirements of the owner/manager as well as information related to the software patch. For example, the owner/manager of the monitored computer system may have a rule-based policy that no more than one software patch may be installed on any given monitored computer system every seven days.

Thus, when a software patch arrives at the computer102from the patch server152, metadata describing that software patch is installed within the CMDB (depicted as CMDB156inFIG. 1), which may be within the computer102(e.g., as a component of PCL148or as independently stored as a database in hard drive134) or it may be external to but accessible to computer102. The metadata may describe the type of software patch (e.g., directed to combatting viruses); what software (operating system and/or application software) is upgraded by the software patch; the supplier of the software patch; and/or the recommended time frame (e.g., immediately upon receipt, at the next scheduled maintenance, within the next 24 hours, etc.) during which the software patch should be installed. The owner/manager of the monitored computer system, however, may have a policy/rule that states 1) no software patches are to be installed until the regularly scheduled maintenance of a system, unless 2) the “urgency level” of the software patch exceeds a predetermined level. For example, assume that the supplier of the software patch states, in the metadata accompanying the software patch, that the software patch has an urgency level of 3 (out of a scale of 1-5). Assume further that the owner/manager of the monitored computer system has established a rule that the owner/manager's policy of waiting to install software patches can only be overridden if the urgency level of the software patch is 4 or higher. In this example, the software patch would not be installed until normal maintenance. However, if the software patch had had an urgency level of 5, then it would be installed immediately. By containing information in the CMDB for both the software patch supplier (regarding the urgency of the software patch) and the owner/manager of the monitored computer system (regarding when/if rules related to installing software patches can be overruled), the monitoring entity (e.g., computer102) is able to reconcile the requirements of both the software patch supplier and the owner/manager of the monitored computer system.

In one embodiment, the software patch is designed to repair a first software component in the monitored computer system. In this embodiment, a determination is made as to if and how the software patch would (inadvertently) affect the operation of a second software component in the monitored computer system. In response to determining that installing the software patch on the monitored computer system would cause the second software component to malfunction, then the software patch is uninstalled. Thus, in one embodiment, the first software component is an operating system and the second software component is an application program that may or may not be running under that operating system. In another example, the first software component is a first type of application program (e.g., a word processing program) and the second software component is a second type of application program (e.g., a graphics program). Nonetheless, the patch that was designed for the word processing system may have a detrimental effect on the graphics program.