SOLUTIONS NOT EXCUSES FOR PATCH MANAGEMENT WARNS NTA MONITOR

Published 25th April 2008

24 April 2008: Rigorous patch management is a fundamental security requirement for any organsation today and yet, warns Internet security testing specialist, NTA Monitor, far too many companies’ servers remain unpatched despite the serious threats this poses.

In recent years, the threats and risks to organisations have increased dramatically with viruses and worms becoming more stealthy and more intelligent, enabling systems to be compromised at a hacker’s leisure. Despite the regular reporting of newly discovered defects in software that cyber criminals can use to exploit vulnerable systems, NTA sees the same patch problems occurring.

Roy Hills, Technical Director at NTA Monitor says: “We hear companies time and again telling us that they don’t want to take their server down for it to be patched or updated because it wastes time. Or they believe that the technical skill required to successfully exploit vulnerabilities is such that an attack is unlikely. Yet we know that attacks are now increasingly common and how disastrous they can be both financially and in terms of disruption to business. So, we are urging companies to understand that they must take a systematic and efficient approach to patch management on both Internet facing systems and internal segments, to ensure that the security vulnerabilities in a company’s information system are addressed.”

NTA advises companies on the most appropriate way to improve their patch management and says that those companies that do take it seriously bring a high degree of accountability and discipline to the task of discovering, analysing and correcting security weaknesses, giving them an edge on their competitors. “We believe that companies should have a policy of having a cluster of servers which are all operating in the same way, so if one is taken out to be tested, the other servers can still run. This one server can then be fixed and filtered down to the others. When a server has been patched and if a company has a standard build, they can test if the patch has been successful on one PC and if it has been, it should then work across the network. Patch management seems to be one of those areas of security that many companies prefer to ignore. We are telling them that they do this at their peril,” says Hills.

-ends-

About NTA Monitor

NTA Monitor, www.nta-monitor.com, is a market leading, innovative Internet security testing, auditing and consultancy company that helps to protect its 500+ customers from loss of revenue and reputation.

The company provides a range of security services including vulnerability testing, web application testing, wireless infrastructure testing, BlackBerry and laptop security testing, IT risk assessments, security policy and procedure reviews and network architecture auditing in order to help prevent unauthorised access to organisation’s networks and data. NTA regularly finds new vulnerabilities through its test projects and research and development programmes.

NTA is a founder member of the CESG 'CHECK' scheme and the newly-founded CREST (Council for Registered Ethical Security Testers). NTA is also an Approved Scanning Vendor (ASV) under the Payment Card Industry Data Security Standard (PCI DSS).


For further information, please contact:
Jacqui Delbaere
Delbaere Public Relations
Email: jacqui@delbaere.fsbusiness.co.uk
Tel: 0207 787 6218/ 07981 504468

Elaine Calvert
Email:elaine.calvert1@talktalk.net
Tel: 07764 614113