Computer security: software patches more vulnerable to hackers.

• Author: Marshall, Jeffrey
• Position: BusinessBRIEFS

Software "patches" to update source code or alter it to subvert hackers or other invaders represent an ever-growing cost item, especially for major organizations with locations around the country or around the world. And it seems that hackers are getting better at finding the vulnerabilities faster.

Gartner Inc. predicts that by 2006, 30 percent of all cyber attacks will target vulnerabilities where a patch has been available for fewer than 30 days--double the 15 percent in 2003. The "window of invulnerability" in which systems are protected from a new virus or worm has shrunk from a month to a week in the past year, says John Watters, CEO of iDEFENSE, a Reston, Va.-based provider of intelligence about cyber threats. Meanwhile, the average patch takes 56 days to deploy from the time programmers start developing it, he says.

As Watters describes it, computer security is a core business issue that has transcended the IT area--"it's creeping up in budgets where people are struggling to decide if throwing more money at it is the right way to go ... You need technology products to manage your security, and in the past few years that has meant having a centralized command and control console. Most larger organizations have deployed spot [security] products, and have spent the last year catching up with compliance."

Watters says his company--which caters to major financial and government institutions--concentrates "on helping customers pick vulnerabilities to...