Front cover - IBM Redbooks

the “greater good.” We feel it is pointless to be concerned about the reasons
people are constantly looking for new vulnerabilities. Most vendors react swiftly
to provide updates to fix security vulnerabilities once they become aware of
them.
Software vulnerabilities generally fall into three categories:
1. Operating system defects
2. Application software defects
3. Improper configuration
Administrators can greatly mitigate security risks by applying software updates
and recommended configuration changes in a timely manner. There have been
many instances in the past few years of worm attacks or outbreaks that affect
large number of systems. In many cases, the worms take advantage of known
exploits that the vendor may have provided fixes for months before the worm was
unleashed. It is your responsibility to make a review of vendor updates part of
your security routine procedures. In some organizations, the system “owner” has
the responsibility to monitor relevant vendor sites for updates at least monthly.
Perhaps the biggest mistake an organization can make is to not apply updates
because there is uncertainty over whether or not the exploit represents a risk in
their current environment, or because the exploited feature is not being used.
Should some business reason in the future cause the affected service or
component to become enabled, you cannot rely on someone’s memory of
reading a software product advisory that was not applicable at the time. Another
strong possibility is that the affected service is enabled by default, whether you
are using it or not, and the exploit uses the vulnerability as a doorway to other
parts of a system. So our advice is to apply software updates regardless of
whether you have the affected features implemented or not. There is always the
possibility the feature in question will be enabled down the road, or already is
even though you don’t use it.
In some cases, when a vulnerability is reported or announced, it might become
necessary to disable the component or service affected until a fix from the vendor
becomes available. This type of temporary action must be considered by
weighing the potential business impact against the potential risk. In cases where
the vulnerability is due to default configuration settings, these are often the
easiest exploits to eliminate by following the vendor’s recommendations.
Workstations must be considered with equal importance to your servers with
regard to applying updates. Human behavior is rarely predictable, therefore it
becomes difficult to foresee all problems that can arise when a user connects to
systems that are outside of your organization’s control. When you consider that
the users’ workstations can connect to your internal systems, they easily can
Chapter 3. Secure infrastructure requirements 111