Ask the Expert

Creating a third-party security policy to prevent a software exploit

According to Secunia, third-party software vulnerabilities now account for the vast majority of flaws on most users' computers. How much importance should enterprises place on preventing third-party software flaws? And, to an extent, aren't enterprises largely at the mercy of the third-party vendors in patching these flaws?

    Requires Free Membership to View

Secunia ApS, the Copenhagen-based organization known for its online vulnerability clearinghouse, has been tracking and scanning Windows systems for vulnerable software with its Personal Software Inspector (PSI) and Corporate Software Inspector (CSI). Secunia will identify out-of-date or vulnerable software where typically a patch or upgrade is able to block attacks or fix vulnerabilities. Secunia reported in its Half Year Report for 2010 (.pdf) that third-party program (programs not directly supplied by Microsoft) vulnerabilities are increasing and account for more vulnerabilities than the Microsoft software installed on the systems scanned.

Enterprises should increase their focus on patching third-party software by, if possible, investing in patch or system management products that will allow them to push updates for all of the software used in the organization. Criminals have been moving up the network stack -- and away from operating systems -- for their attacks as network and operating system security has improved over time. Enterprises also have devoted significant efforts to patching Windows and have developed processes and procedures to manage Microsoft patches. Enterprises typically haven't spent as much effort in patching third-party software, and criminals, thus, have been increasing their efforts to exploit vulnerabilities in third-party software. Enterprises need to create a third-party security policy to take these growing threats into account, and potentially even add additional management systems to incorporate patching third-party products into their existing processes and procedures.

Enterprises are at the mercy of third-party vendors for patching these flaws and preventing a software exploit, but they are also at the mercy of Microsoft to patch their software. Enterprises should hold their vendors or software to the same high standards that they hold Microsoft for security by letting their vendors know they expect secure software and switching to more secure software when their current vendor doesn't meet this expectation.

This was first published in August 2010

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: