Vulnerability Analysis Tools, Fix PC Bugs: Timely patching of every organization’s information technology systems is critical to maintaining the operational availability, confidentiality, and integrity of information assets. Failure to keep operating system and application software patched increases the potential risk of serious financial, legal and reputation losses due to information compromise.

---

Click here to download pdf version of paper.


By Tony Thomas , Senior Network Engineer and Product Manager, NumaraTM Software Inc.

INTRODUCTION
Policies and procedures provide the framework to successfully implement and maintain organizational actions – specific to information system vulnerabilities and security patching. Effective policies and procedures provide this framework to support initiatives and actions to secure and keep secure affected systems. The process under which these actions occur is called patch management.

Timely patching of every organization’s information technology systems is critical to maintaining the operational availability, confidentiality, and integrity of information assets. Failure to keep operating system and application software patched increases the potential risk of serious financial, legal and reputation losses due to information compromise. Losses may result if such assets are compromised as a result of an Internet worm, virus outbreak, or a hacker gaining access through exploitation of unpatched (or otherwise poorly-protected) system vulnerabilities.

For an organization to succeed at effectively managing its system patching, executive management, working with security managers who operate the program, must initiate and support an organization-wide Security Vulnerability and Patch Management Program. This document presents the essential elements for an effective Security Vulnerability and Patch Management Program.


Purpose
This document will assist individuals who have been assigned the task or have identified the need to establish a patch management strategy. This document details methods and approaches to effectively implement a sound patch management process. As stated on page 3, executive support for these programs is absolutely critical to insure their operational success.


ACHIEVING MANAGEMENT SUPPORT
Prior to implementing any organizational security initiative, executive support must be gained for the project. Without such support, efforts carry none of the weight of other organizational requirements. If such support does not exist in the organization, executive support must be sought.

Prior to obtaining support, the project driver must build a strong case to present to executive management. Building a strong business case permits the best method to addressing the needs of executives – proving that patch management directly impacts the bottom line. Obtaining executive support increases the chances for success of an effective patch management program.

Available executive support provides the necessary backbone for ongoing patch management efforts.


Building the Business Case
Building a business case for patch management is the most crucial step to obtaining executive support. Executives require the cost versus benefit of any initiative and how the initiative impacts the business’s bottom line. The following flow-chart illustrates a recommended approach to building a strong case for patch management and vulnerability mitigation:



To download remainder of paper, click link below.