3A03 Security Löcher schnell und effizient schließen mit HP OpenView Radia

Transkript

1 3A03 Security Löcher schnell und effizient schließen mit HP OpenView Radia Alexander Meisel HP OpenView 2004 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice Patch Management Why do I need it? Time in days from issue of Bulletin to acknowledgement of Exploit Cost to Industry ,200,000,000 1,200,000, ,000,000, ,000, Nimda Slammer Blaster ,000, ,000,000 0 Just in 500,000,000 Bulletin 400,000,000 MS issued April 13 th 2004 Sasser 200,000,000 Exploit acknowledged 1 st May days! Nimda Slammer Blaster 1

2 Patch Management Risikominimierung Sicherheitslücken schaden dem Geschäft The SQL Slammer worm caused between $950 million and $1.2 billion in lost productivity in it s first five days worldwide. (cnet news) Anpassung an Veränderungen mit hoher Zuverlässigkeit wird benötigt 95% der Lücken sind durch proaktives Patchmanagement vermeidbar* Kosten Implementation von automatisierten Patchmanagementlösungen reduzieren die Helpdesk-Calls und damit die Kosten Hohe Effektivität IT muß 24/7 Service unterstützen und trotzdem hohe Skalierbarkeit, niedrige Kosten, Flexibilität erreichen * Source : CERT 3 Patch Prozess Verify Targeting Report 6 1 Manually Acquire Patch 2 Age/Test 5 Distribute Patch Using SD or Utility Use Scan Report for Targeting 4 3 Scan for Patch on systems 2

3 Patch Process* 1. Audit machine production environment to determine operational baseline (daily for servers, weekly for workstations) 2. Confirm that the audit has taken place and identify machines that have not been audited. (daily for servers, weekly for workstations) 3. Check security web sites to determine whether new patches are available. (Daily). 4. Scan production environment for required patches. (weekly). 5. Assess patch prerequisites, sequences and conflicts. (per required patch) 6. Pilot patch release in production environment. (per required patch) 7. Deploy patch release to production environment. (per patch) *see Microsoft TechNet Patch Management Prozess Patch Management Prozess Viel Automatisierungspotential Lösungen für Client und Server Bereich notwendig Windows, Linux, UNIX??? 3

4 Radia Patch Manager Continuous, Comprehensive, Adaptive Acquisition Compliance Assurance Impact Analysis and Pilot Testing Patch Deployment & Enforcement Continuous, Assessment Radia Patch Manager Acquisition 3 Decompose patch into components 2 Automatically publish patch to Server 1 Vendor-specific patches Check for updates 4 Register patch in depot for future distribution Server Firewall Radia Patch Management Depot Vendor 4

5 RADIA Patch Manager Reports RADIA Patch Manager Reports 5

6 Erweiterte Konflikt Analyse Radia Patch Manager Automatic Assessment 2 Product information sent to server Radia Configuration Server 3 Determine applicable patches that apply to products 1 Automatic product discovery Radia Patch Management Depot Radia Management Portal 4 Sends down patch probes 5 Sends probe results 6

7 Radia Patch Manager Process Driven Patch Management Automatic Patch Acquisition Deliver watchful, stateful Patch Management Analysis, Test, Pilot Continuous Assessment of Environment Was ist Desired State Management? Cruise Control Auto-Pilot GPS Thermostat Monitor Adjust 7

8 Zusammenfassung Patch Management in heterogener Client und Server Umgebung (Windows, Linux, Solaris*, HP- UX*) schließt schnell Sicherheitslücken (* later 2005) Automatische Akquise und Analyse der Verwundbarkeit Reduzierte Test-Aufwände durch Konflikt Analyse Desired State Management stellt dauerhaft sichere Umgebung sicher Objekt-orientiertes Modell ermöglicht Bandbreitensteuerung und einfachste Zuweisung auf Basis von Organisationsstrukturen (Verzeichnisse) 8