Patch management is a critical process used to help alleviate many of the challenges involved with securing computing systems from attack. A component of configuration management, it includes acquiring, testing, applying, and monitoring patches to a computer system. Flaws in software code that could cause a program to malfunction generally result from programming errors that occur during software development. The increasing complexity and size of software programs contribute to the growth in software flaws. For example, Microsoft Windows 2000 reportedly contains about 35 million lines of code, compared with about 15 million lines for Windows 95. As reported by the National Institute of Standards and Technology (NIST), based on various studies of code inspections, most estimates suggest that there are as many as 20 flaws per thousand lines of software code. While most flaws do not create security vulnerabilities, the potential for these errors reflects the difficulty and complexity involved in delivering trustworthy code. From 1995 through 2003, the CERT Coordination Center (CERT/CC) reported just under 13,000 security vulnerabilities that resulted from software flaws. Figure 1 illustrates the dramatic growth in security vulnerabilities during this period. As vulnerabilities are discovered, attackers can cause major damage in attempting to exploit them. This damage can range from defacing Web sites to taking control of entire systems and thereby being able to read, modify, or delete sensitive information; destroy systems; disrupt operations; or launch attacks against other organizations’ systems. Attacks can be launched against specific targets or widely distributed through viruses and worms. The sophistication and effectiveness of cyber attacks have steadily advanced. According to security researchers, reverse-engineering patches has become a leading method for exploiting vulnerabilities. By using the same tools used by programmers to analyze malicious code and perform vulnerability research, hackers can locate the vulnerable code in unpatched software and build to exploit it. Reverse engineering starts by locating the files or code that changed when a patch was installed. Then, by comparing the patched and unpatched versions of those files, a hacker can examine the specific functions that changed, uncover the vulnerability, and exploit it. A spate of new worms has been released since February—most recently last month—and more than half a dozen new viruses were unleashed. The worms were variants of the Bagle and Netsky viruses. The Bagle viruses typically included an infected e-mail attachment containing the actual virus; the most recent versions have protected the infected attachment with a password, preventing anti-virus scanners from examining it. The recent Netsky variants attempted to deactivate two earlier worms and, when executed, reportedly make a loud beeping sound. Another worm known as Sasser, like the Blaster worm discussed later, exploits a vulnerability in the Microsoft Windows operating system, while the Witty worm exploits a flaw in certain Internet security software products. The number of computer security incidents within the past decade has risen in tandem with the dramatic growth in vulnerabilities, as the increased number of vulnerabilities provides more opportunities for exploitation. CERT/CC has reported a significant growth in computer security incidents—from about 9,800 in 1999 to over 82,000 in 2002 and over 137,500 in 2003. And these are only the reported attacks. The director of the CERT Centers has estimated that as much as 80 percent of actual security incidents go unreported, in most cases because there were no indications of penetration or attack, the organization was unable to recognize that its systems had been penetrated, or the organization was reluctant to report the attack. Figure 2 shows the number of incidents reported to CERT/CC from 1995 through 2003. According to CERT/CC, about 95 percent of all network intrusions could be avoided by keeping systems up to date with appropriate patches; however, such patches are often not quickly or correctly applied. Maintaining current patches is becoming more difficult, as the length of time between the awareness of a vulnerability and the introduction of an exploit is shrinking. For example, the recent Witty worm was released only a day after the announcement of the vulnerability it attacked. As figure 3 illustrates, in the last 3 years, the time interval between the announcement of a particular vulnerability and the release of its associated worm has diminished dramatically. Although the economic impact of a cyber attack is difficult to measure, a recent Congressional Research Service study cites members of the computer security industry as estimating that worldwide, major virus attacks in 2003 cost $12.5 billion. They further project that economic damage from all forms of digital attacks in 2004 will exceed $250 billion. Following are examples of significant damage caused by worms that could have been prevented had the available patches been effectively installed: ● On January 25, 2003, Slammer reportedly triggered a global Internet slowdown and caused considerable harm through network outages and other unforeseen consequences. As discussed in our April 2003 testimony on the security of federal systems and critical infrastructures, the worm reportedly shut down a 911 emergency call center, canceled airline flights, and caused automated teller machine failures. According to media reports, First USA Inc., an Internet service provider, experienced network performance problems after an attack by the Slammer worm, due to a failure to patch three of its systems. Additionally, the Nuclear Regulatory Commission reported that Slammer also infected a nuclear power plant’s network, resulting in the inability of its computers to communicate with each other, disrupting two important systems at the facility. In July 2002, Microsoft had released a patch for its software vulnerability that was exploited by Slammer. Nevertheless, according to media reports, Slammer infected some of Microsoft’s own systems. Reported cost estimates of Slammer damage range between $1.05 billion and $1.25 billion. ● On August 11, 2003, the Blaster worm was launched to exploit a vulnerability in a number of Microsoft Windows operating systems. When successfully executed, it caused the operating system to fail. Although the security community had received advisories from CERT/CC and other organizations to patch this critical vulnerability, Blaster reportedly infected more than 120,000 unpatched computers in its first 36 hours. By the following day, reports began to state that many users were experiencing slowness and disruptions to their Internet service, such as the need to reboot frequently. The Maryland Motor Vehicle Administration was forced to shut down, and systems in both national and international arenas were also affected. Experts consider Blaster, which affected a range of systems, to be one of the worst exploits of 2003. Microsoft reported that the Blaster worm has infected at least 8 million Windows computers since last August. ● On May 1 of this year, the Sasser worm was reported, which exploits a vulnerability in the Windows Local Security Authority Subsystem Service component. This worm can compromise systems by allowing a remote attacker to execute arbitrary code with system privileges. According to US-CERT (the United States Computer Emergency Readiness Team), systems infected by this worm may suffer significant performance degradation. Sasser, like last year’s Blaster, exploits a vulnerability in a component of Windows by scanning for vulnerable systems. Estimates by Internet Security Systems, Inc., place the Sasser infections at 500,000 to 1 million machines. Microsoft has reported that 9.5 million patches for the vulnerability were downloaded from its Web site in just 5 days. The federal government has taken several steps to address security vulnerabilities that affect agency systems, including efforts to improve patch management. Specific actions include (1) requiring agencies to annually report on their patch management practices as part of their implementation of FISMA, (2) identifying vulnerability remediation as a critical area of focus in the President’s National Strategy to Secure Cyberspace, and (3) creating US–CERT. FISMA permanently authorized and strengthened the information security program, evaluation, and reporting requirements established for federal agencies in prior legislation. In accordance with OMB’s reporting instructions for FISMA implementation, maintaining up-to-date patches is part of system configuration management requirements. The 2003 FISMA reporting instructions that specifically address patch management practices include agencies’ status on (1) developing an inventory of major IT systems, (2) confirming that patches have been tested and installed in a timely manner, (3) subscribing to a now-discontinued governmentwide patch notification service, and (4) addressing patching of security vulnerabilities in configuration requirements. The President’s National Strategy to Secure Cyberspace was issued on February 14, 2003, to identify priorities, actions, and responsibilities for the federal government—as well as for state and local governments and the private sector—with specific recommendations for action to DHS. This strategy identifies the reduction and remediation of software vulnerabilities as a critical area of focus. Specifically, it identifies the need for (1) a better– defined approach on disclosing vulnerabilities, to reduce their usefulness to hackers in launching an attack; (2) creating common test beds for applications widely used among federal agencies; and (3) establishing best practices for vulnerability remediation in areas such as training, use of automated tools, and patch management implementation processes. US-CERT was created last September by DHS’s National Cyber Security Division (NCSD) in conjunction with CERT/CC and the private sector. Specifically, US-CERT is intended to aggregate and disseminate cyber security information to improve warning and response to incidents, increase coordination of response information, reduce vulnerabilities, and enhance prevention and protection. This free service—which includes notification of software vulnerabilities and sources for applicable patches—is available to the public, including home users and both government and nongovernment entities. Common patch management practices—such as establishing and enforcing standardized policies and procedures and developing and maintaining a current technology inventory—can help agencies establish an effective patch management program and, more generally, assist in improving an agency’s overall security posture. Our survey results showed that the 24 agencies are implementing some practices for effective patch management, but not others.