As vulnerabilities are discovered, attackers may attempt to exploit them  and can cause significant damage. Specifically, all report that they have some  level of senior executive involvement in the patch management process,  perform a systems inventory, and provide information security training. Agencies’ centralization of common practices for effective patch  management varies. Typical policies include elements such as assigning roles and  responsibilities, performing risk assessments, and testing patches. More refined information on key aspects of agencies’  patch management practices—such as their documentation of patch  management policies and procedures, their testing of new patches in their  specific computing environments prior to installation, and the frequency  with which systems are monitored to ensure that patches are installed— could provide OMB, Congress, and agencies themselves with data that  could better enable an assessment of the effectiveness of an agency’s patch  management processes. Automated Tools and Services Can Assist Agencies in Performing Patch Management Activities

Several automated tools and services are available to assist agencies with  patch management. A centralized resource that  incorporates lessons learned from PADC’s limitations could provide  standardized services, such as the testing of patches, a patch management  training curriculum, and development of criteria for patch management  tools and services. A  governmentwide service could lower costs to—and resource requirements  of—individual agencies, while facilitating their implementation of selected  patch management practices. Agencies face a number of common patch management obstacles,  including (1) quickly installing patches while implementing effective patch  management practices, (2) patching heterogeneous systems, (3) ensuring  that mobile systems receive the latest patches, (4) avoiding unacceptable  downtime when patching high-availability systems, and (5) dedicating  sufficient resources toward patch management. Vendors that are proactive and adopt known effective software engineering  practices can drastically reduce the number of flaws in their software  products. Research and development in a wide range of other areas could also lead to  more effective technologies to prevent, detect, and recover from attacks, as  well as identify their perpetrators. The federal government has already started to use its purchasing power to  influence software vendors to deliver more secure systems. Additional steps can be taken by vendors, the security community, and the  federal government to address the risk associated with software  vulnerabilities and patch management challenges. At that time, we will send copies of this report to the Ranking  Minority Members of the Committee on Government Reform and the  Subcommittee on Technology, Information Policy, Intergovernmental  Relations and the Census and other interested parties. Objectives, Scope, and Methodology

Our objectives were to determine the (1) reported status of 23 of the  agencies under the CFO Act and DHS in performing effective patch  management practices, (2) tools and services available to federal agencies  to perform patch management, (3) challenges to performing patch  management, and (4) additional steps that can be taken to mitigate the  risks created by software vulnerabilities. Finally, to determine the challenges to performing patch management and  the additional steps that can be taken to mitigate the risks created by  software vulnerabilities, we reviewed professional information technology  security literature, examined available commercial software patch  management tools and services, and solicited agencies’ input on patch  management challenges in our survey. We also interviewed relevant federal  and private-sector officials and computer security experts.
Why GAO Did This Study

Flaws in software code can introduce vulnerabilities that may be exploited to cause significant damage to federal information systems. Such risks continue to grow with the increasing speed, sophistication, and volume of reported attacks, as well as the decreasing period of the time from vulnerability announcement to attempted exploits. The process of applying software patches to fix flaws, referred to as patch management, is a critical process to help secure systems from attacks. The Chairmen of the House Committee on Government Reform and its Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census requested that GAO assess the (1) reported status of 24 selected agencies in performing effective patch management practices, (2) patch management tools and services available to federal agencies, (3) challenges to performing patch management, and (4) additional steps that can be taken to mitigate the risks created by software vulnerabilities.

What GAO Found

Based on agency-reported data, agencies generally are implementing important common practices for effective patch management, such as performing systems inventories and providing information security training. However, they are not consistently performing others, such as risk assessments and testing all patches before deployment. Additional information on key aspects of agencies' patch management practices--such as their documentation of patch management policies and procedures and the frequency with which systems are monitored to ensure that patches are installed--could provide OMB, Congress, and agencies themselves with consistent data that could better enable an assessment of the effectiveness of an agency's patch management processes. Several automated tools and services are available to assist agencies in performing patch management. These tools and services typically include a wide range of functionality, including methods to inventory computers, identify relevant patches and workarounds, test patches, and report network status information to various levels of management. A centralized resource could provide agencies with selected services such as the testing of patches, a patch management training curriculum, and development of criteria for patch management tools and services. A governmentwide service could lower costs to--and resource requirements of--individual agencies, while facilitating their implementation of selected patch management practices. Agencies face several challenges to implement effective patch management practices, including (1) quickly installing patches while implementing effective patch management practices, (2) patching heterogeneous systems, (3) ensuring that mobile systems receive the latest patches, (4) avoiding unacceptable downtime when patching high-availability systems, and (5) dedicating sufficient resources toward patch management. Agency officials and computer security experts identified a number of additional steps that can be taken by vendors, the security community, and the federal government to assist agencies in mitigating the risks created by software vulnerabilities. For example, more rigorous software engineering practices by software vendors could reduce the number of software vulnerabilities and the need for patches. In addition, the research and development of more capable technologies could help secure information systems against cyber attacks. Also, the federal government could use its substantial purchasing power to influence software vendors to deliver more secure systems.