A record for Microsoft

Your PC will likely reboot on Tuesday night. October 12, 2010 is Patch Tuesday for Microsoft software, when the Redmond-based company releases security fixes and updates to address security vulnerabilities across its product line. This month, the update is addressing a record number of holes in all of its major PC applications. The old record of 34 vulnerabilities - which was only set last month - is shattered by a near 50% increase. Tomorrow's release addresses an astounding 49 vulnerabilities in Windows (just about every PC and server version still in use), Internet Explorer (v6, v7 & v8) and SharePoint.

None of the fixes specifically address the threat posed by Stuxnet, an insidious worm that every IT professional should be paying attention to. However, Microsoft does acknowledge that more holes need to plugged in order to effectively guard against that threat.

Read the Microsoft Security Bulletin for yourself:
Microsoft Security Bulletin Advance Notification for October 2010

Software Vulnerabilities Exposed

A recent study lists Firefox, EMC VMWare, Citrix, iTunes and 8 other popular software titles as the most vulnerable applications currently in use. In order to merit this dubious distinction, the softare must various criteria, including:

• Must run on Windows
• Well-known to the general computing public
• Generally regarded as non-malicious by most computer departments
• Had at least one reported security flaw during 2008
• Requires the end user to maintain the security - as opposed to central application administration.

This necessarily narrows the list -- somewhat unnaturally -- since most of the Microsoft products in popular use can be regulated via a centralized application management tool, such as SMS or WSUS. The study is focused on a corporate audience, as the publishing enterprise - Bit9 - sells a software management tool that addresses the problems that enabled these titles to make the list. So the results need to be taken with generous skepticism.

Nevertheless, the list makes for interesting reading, as it includes some of the recognizable names in consumer and corporate technology.

2008's Popular Applications with Critical Vulnerabilities

• Mozilla Firefox
• Adobe Flash & Acrobat
• EMC VMware Player,Workstation and other products
• Sun Java Runtime Environment (JRE)
• Apple QuickTime, Safari & iTunes
• Symantec
• Trend Micro
• Citrix Products
• Aurigma, Lycos
• Skype
• Yahoo! Assistant
• Microsoft Windows Live (MSN) Messenger

From a corporate perspective, there are fairly easy ways to protect agains the reported vulnerabilities, even without a tool like Bit9 is peddling. A sensible corporate policy regarding these applications, coupled with a thoughtful desktop image will take of the bulk of the risk.

Download the study from Bit9: The Most Vulnerable Applications—2008 Report

Business Process Improvement tops 2009 CIO Priorities

A recent survey of 220 IT executives (by CIO Insight) showed that 42% of CIOs believe that Improving Business Processes is a top priority for 2009. Surprisingly, Cost Cutting was considered a top priority by only 38% of respondents, while only 25% named Generating more Business as a priority for this year.

The survey results do not provide any details as to when the survey was conducted. Since the survey was published in early December, it's quite probable that the full impact of the economy's 3rd and 4th quarter performance was not accounted for in their responses. At the same time, however, by October, I was already starting to see a pull-back on IT initiatives. Nearly everyone I communicated with was focused on cost reductions and hard savings. And virtually no one was looking at the soft savings promised by many IT initiatives. In fact, even projects with clear and hard-dollar ROI were being scrutinized and frequently delayed.

What explains the difference?
The only thing I can think of is that the respondents expect the economy to begin righting itself sometime during the course of 2009. I haven't seen any evidence to substantiate this belief, but I cannot come up with any other reasonable explanation for these responses.

Another fascinating detail in the responses is in the Cost-cutting results, which I've highlighted below. Notice the disparity between smaller (< $500 million) and larger (> $500 million). Apparently, the larger organizations were ahead of the curve on belt-tightening. The opposite disparity also shows up, to a lesser degree, in the customer service response. Taken together, this tells me that larger organizations are going to be in better position to take advantage of the eventual recovery than their smaller competitors. And we should adjust our strategy accordingly.

Summary of Responses - Top CIO Priorities for 2009:

• Improve Business Processes - 42% ... (Less then $500M - 43%, More than $500M - 40%)
• Deliver Better Customer Service - 41% ... (Less then $500M - 44%, More than $500M - 37%)
• Cutting Costs - 38% ... (Less then $500M - 34%, More than $500M - 45%)
• Generate More Business - 25% ... (Less then $500M - 28%, More than $500M - 21%)
• Innovate New Products and Services - 22% ... (Less then $500M - 23%, More than $500M - 19%)

Link to full survey results at CIO Insight: Top CIO Priorities for 2009

Keeping data secure from internal users

When conducting your annual security assessment, be sure to pay close attention to internal users with access to privileged information. A study conducted over the summer by a California-based security company identified several key findings regarding security breaches from the inside:

• Security breaches not only manifest as mishandled data. In some cases, perpetrators targeted specific employees' personal information.
• Data stolen by insiders is highly likely to be used in a geographically concentrated area, near (within 20 miles) the scene of the crime.
• A majority - 69% - of stolen ID's were used to fraudulently obtain cell phone services.
• Almost all of the resulting illicit activity occurred very quickly ... within 2 weeks of the theft.
• The vast majority -- 80% -- of fraudulent activity was perpetrated online

What does this mean for you?
It means that, while perimeter defenses are important, enforcing sound security policies with staff and associates is absolutely critical. Secure passwords for internal applications (not just for network access) should be a requirement for all users, including executives. Creating local copies of sensitive information should be restricted. And all applications should be reviewed for hidden developer access.

Link to ID Analytics Press Release: Study Reveals Employees' Criminal Misuse of Stolen Identities