And that's only a single flaw. Lack of training can be blamed in many preventable cases, said Chris Klaus, the chief technology officer with security firm Internet Security Systems. When we walk into most companies, they aren't even aware they should be patching anything. If each machine needs to be patched once a month, that's still ten or so machines that need to be maintained by each administrator every day. That's in addition to all the other problems that crop up.
Several initiatives hope to change that.
As part of the National Plan for Critical Infrastructure Defense, the Clinton administration proposed a Scholarship for Service plan that will start next year. Industry associations are also trying to raise awareness. Although those initiatives are aimed at educating system administrators, it's an uphill battle. Newly trained administrators continue to enter the industry, requiring that the software companies repeatedly start from zero. The Remote Data Services flaw in Microsoft's Internet Information Server may be the best example of how repeated education can fail.