Frequently, skilled hackers develop exploitation tools and post them on  Internet hacking sites. Successful attacks on unpatched software vulnerabilities have caused  billions of dollars in damage. Collaborative Response to Two Recent Software Vulnerabilities

Recently, two critical vulnerabilities were discovered in widely used  commercial software products. The federal government and the private- sector security community took steps, described below in chronological  order, to collaboratively respond to the threat of potential attacks against  these vulnerabilities. Common Practices for Effective Patch Management

Effective patch management practices have been identified in security- related literature from several groups, including NIST, Microsoft, patch  management software vendors, and other computer-security experts. Dedicated resources and clearly assigned responsibilities. Risk assessment. When a vulnerability is discovered and a related patch  and/or alternative workaround is released, the entity should consider the  importance of the system to operations, the criticality of the vulnerability,  and the risk of applying the patch. Federal Efforts to Address Software Vulnerabilities

The federal government has taken several steps to address security  vulnerabilities that affect federal agency systems, including efforts to  improve patch management. The federal  government offers PADC to federal civilian agencies at no cost. At  present, the government is considering broadening the scope of these  services and capabilities, along with the number of users. Services and Tools Also Provide Means for Improving Patch Management

Several services and automated tools are available to assist entities in  performing the patch management function, including tools designed to be  stand-alone patch management systems. Additional Steps That Can Be Taken

In addition to implementing effective patch management practices, several  additional steps can be considered when addressing software  vulnerabilities, including:    deploying other technologies, such as antivirus software, firewalls, and  other network security tools to provide additional defenses against  attacks;    employing more rigorous engineering practices in designing,  implementing, and testing software products to reduce the number of  potential vulnerabilities; improving tools to more effectively and efficiently manage patching; researching and developing technologies to prevent, detect, and recover  from attacks as well as identify their perpetrators, such as more  sophisticated firewalls to keep serious attackers out, better intrusion- detection systems that can distinguish serious attacks from nuisance  probes and scans, systems that can isolate compromised areas and  reconfigure while continuing to operate, and techniques to identify  individuals responsible for specific incidents; and   ensuring effective, tested contingency planning processes and procedures. In summary, it is clear from the increasing number of reported attacks on  information systems that both federal and private-sector operations and  assets are at considerable—and growing—risk.
Why GAO Did This Study

Attacks on computer systems--in government and the private sector--are increasing at an alarming rate, placing both federal and private-sector operations and assets at considerable risk. By exploiting software vulnerabilities, hackers can cause significant damage. While patches, or software fixes, for these vulnerabilities are often well publicized and available, they are frequently not quickly or correctly applied. The federal government recently awarded a contract for a government-wide patch notification service designed to provide agencies with information to support effective patching. Forty-one agencies now subscribe to this service. At the request of the Chairman of the Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census, GAO reviewed (1) two recent software vulnerabilities and related responses; (2) effective patch management practices, related federal efforts, and other available tools; and (3) additional steps that can be taken to better protect sensitive information systems from software vulnerabilities.

What GAO Found

The increase in reported information systems vulnerabilities has been staggering, especially in the past 3 years. Automated attacks are successfully exploiting such software vulnerabilities, as increasingly sophisticated hacking tools become more readily available and easier to use. The response to two recent critical vulnerabilities in Microsoft Corporation and Cisco Systems, Inc., products illustrates the collaborative efforts between federal entities and the information security community to combat potential attacks. Patch management is one means of dealing with these increasing vulnerabilities to cybersecurity. Critical elements to the patch management process include management support, standardized policies, dedicated resources, risk assessment, and testing. In addition to working with software vendors and security research groups to develop patches or temporary solutions, the federal government has taken a number of other steps to address software vulnerabilities. For example, offered without charge to federal agencies, the federal patch notification service provides subscribers with information on trusted, authenticated patches available for their technologies. At present, the government is considering broadening the scope of these services and capabilities, along with the number of users. Other specific tools also exist that can assist in performing patch management. In addition to implementing effective patch management practices, several additional steps can be taken when addressing software vulnerabilities. Such steps include stronger software engineering practices and continuing research and development into new approaches toward computer security.