Software Patches: Anger Management

The steady stream of patches from leading software vendors is trying the patience of IT administrators and corporate executives, according to a panel of CSOs from leading U.S. corporations.

During a February RSA Conference in San Francisco, IT security executives agreed that better tools are needed to reduce the number of product vulnerabilities, including technology to spot holes in raw computer code and security certifications for software products.

The panel on software vulnerabilities and so-called zero day exploits brought together CSOs from Oracle, Thomson, Google and Safeway.

Executives expressed frustration with the frequency of patches from leading software vendors, including Microsoft, Oracle and others. “When new vulnerabilities come out, I feel like I’m being managed by a problem that’s not my problembut Oracle’s problem,” said Phillip Harris, vice president of information security at supermarket giant Safeway. Harris lamented the reactive nature of patch management software and called for earlier notice from software vendors and better communication about vulnerabilities.

Echoing Harris’s opinion, Thomson Vice President and CSO Dennis Devlin said that no single security technology is a panacea, but that collectively, vendors could give organizations time to react to new threats.

In defense of the software vendor community, Oracle CSO Mary Ann Davidson pointed out that technology buyers also need to be more demanding customers, requiring security evaluations of finished software products and holding developers to higher standards. She argued that the federal government has a role to play in reducing the number of vulnerabilities: Government research of scanning tools for computer code could compensate for a lack of private-sector investment into that technology.