	Background

Patch management is a critical process used to help alleviate many  of the challenges involved with securing computing systems from  attack. Flaws in software code that could cause a program to  malfunction generally result from programming errors that occur  during software development. And these are only the  reported attacks. Specifically, not all  agencies have established patch management policies and  procedures. Additionally, most  agencies are not testing all patches before deployment. Further, just  under half of the 24 agencies said they perform a documented risk  assessment of all major systems to determine whether to apply a  patch or an alternative workaround. Without consistent  implementation of patch management practices, agencies are at  increased risk of attacks that exploit software vulnerabilities in their  systems. More refined information on key aspects of agencies’ patch  management practices—such as their documentation of patch  management policies and procedures and the frequency with which  systems are monitored to ensure that patches are installed—could  provide OMB, Congress, and agencies themselves with data that  could better enable an assessment of the effectiveness of an  agency’s patch management processes. Automated Tools and Services Can Assist Agencies in Performing Patch Management Activities

Several automated tools and services are available to assist agencies  with patch management. Tools and services can make  the patch management process more efficient by automating  otherwise time-consuming tasks, such as keeping current on the  continuous flow of new patches. Commercially available tools and services include, among others,  methods to  inventory computers and the software applications and patches  installed;  identify relevant patches and workarounds and gather them in  one location; group systems by departments, machine types, or other logical manage patch deployment;  scan a network to determine the status of patches and other  corrections made to network machines (hosts and/or clients); assess machines against set criteria, including required system  configurations; access a database of patches;  report information to various levels of management about the  status of the network. Significant Obstacles to Effective Patch Management Remain

Security experts and agency officials have identified several  obstacles to implementing effective patch management; these  include the following:  ●  High volume and increasing frequency of patches. ●  Patching heterogeneous systems. ●  Ensuring that mobile systems receive the latest patches. ●  Dedicating sufficient resources to patch management. Additional Steps Can Be Taken to Mitigate Risks

As with the challenges to patch management identified by agencies,  our report also identified a number of steps that can be taken to  address the risks associated with software vulnerabilities. These  include:  ●  Better software engineering. More rigorous engineering  practices, including a formal development process, developer  training on secure coding practice, and code reviews, can be  employed when designing, implementing, and testing software  products to reduce the number of potential vulnerabilities and  thus minimize the need for patching. ●  Implementing “defense-in-depth.” According to security experts,  a best practice for protecting systems against cyber attacks is for  agencies to build successive layers of defense mechanisms at  strategic points in their IT infrastructures. ●  Research and development of new technologies.
Why GAO Did This Study

Flaws in software code can introduce vulnerabilities that may be exploited to cause significant damage to federal information systems. Such risks continue to grow with the increasing speed, sophistication, and volume of reported attacks, as well as the decreasing period of the time from vulnerability announcement to attempted exploits. The process of applying software patches to fix flaws--patch management--is critical to helping secure systems from attacks. At the request of the House Committee on Government Reform and the Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census, GAO reviewed the (1) reported status of 24 selected agencies in performing effective patch management practices, (2) tools and services available to federal agencies, (3) challenges to this endeavor, and (4) additional steps that can be taken to mitigate risks created by software vulnerabilities. This testimony highlights the findings of GAO's report, which is being released at this hearing.

What GAO Found

Agencies are generally implementing certain common patch management-related practices, such as inventorying their systems and providing information security training. However, they are not consistently implementing other common practices. Specifically, not all agencies have established patch management policies and procedures. Moreover, not all agencies are testing all patches before deployment, performing documented risk assessments of major systems to determine whether to apply patches, or monitoring the status of patches once they are deployed to ensure that they are properly installed. Commercial tools and services are available to assist agencies in performing patch management activities. These tools and services can make patch management processes more efficient by automating time-consuming tasks, such as scanning networks and keeping up-to-date on the continuous releases of new patches. Nevertheless, agencies face significant challenges to implementing effective patch management. These include, among others, (1) the high volume and increasing frequency of needed patches, (2) patching heterogeneous systems, (3) ensuring that mobile systems such as laptops receive the latest patches, and (4) dedicating sufficient resources to assessing vulnerabilities and deploying patches. Agency officials and computer security experts have identified several additional measures that vendors, the security community, and the federal government can take to address the risks associated with software vulnerabilities. These include, among others, adopting more rigorous software engineering practices to reduce the number of coding errors that create the need for patches, implementing successive layers of defense mechanisms at strategic points in agency information systems, and researching and developing new technologies to help uncover flaws during software development.