HP OSMS white paper: Security of Open Source Middleware Stacks

Figure 4 Incidents Per Year
Also, there are other exploits that are not yet widespread or well known, but are equally potent. For
example, vigilant patching does not prevent a zero day attack. These exploits are too new, and a patch
does not exist to fix the flawed software they exploit. Similarly, other security techniques that rely on the
prior knowledge of vulnerabilities and exploit signatures cannot protect a system from zero day attacks.
Signature-based intrusion detectors, firewalls, and virus detection tools cannot detect attacks that have
yet to be defined.
Keeping Systems Updated
All software components undergo a cyclic return to an insecure state due to the discovery of new software
vulnerabilities. Surprisingly, the majority of systems that have succumbed to intruders do so because of
a known vulnerability for which a patch is readily available.
2
Therefore, keeping a system up to date with
the most-recent security patches is paramount for reducing exposure to known vulnerabilities. Patch
management is a means for reducing the largest factor of intrusion exposure. The vigilant and timely
application of security patches is the most important item on a security checklist.
The battle between software developers and software crackers is ongoing. An exploit represents a moment
of opportunity for attackers to penetrate a system before patches are applied that return the system to a
secure state. Software crackers attempt to gain advantage by finding and exploiting security holes, while
software developers endeavor to close the holes. This pattern repeats in the exploit life cycle, so applying
timely security updates is always critical.
The Vulnerability Life Cycle
After a vulnerability announcement, a flaw is likely to become a cracking target. Often, in an attempt to
defuse this inevitability, a vulnerability announcement is delayed in order to coincide with the release of
a patch to reduce the time for an exploit to be developed. This practice produces a false sense of security,
because the actual start of the vulnerability life cycle can begin long before the announcement.
The discovery of security issues occurs in many ways. In the worst case, crackers discover the vulnerability
rather than security experts, so systems become compromised even before work to fix the vulnerability
begins. In the best case, knowledge of the vulnerability is known only to the security researcher and the
developer. The developer does not divulge the existence of the vulnerability to prevent crackers from
exploiting it until a fix is available. Meanwhile, the developer quickly develops and thoroughly tests a
patch. Unfortunately, when the announcement of a vulnerability coincides with the release of the patch,
a new threat arises. Crackers are adept at reverse-engineering patches and producing exploits in a short
2. J. Howard, An Analysis Of Security Incidents On The Internet: 1989–1995. PhD thesis, Carnegie-Mellon University, April 1997.
Essential Security 13