Proponents of host-level security to patch machines ahead of worm outbreaks just miss the point completely. It sounds great from an academic point of view, but anyone who's administrated a real network knows this will never be the answer, as universal patching just isn't operationally feasible. Large F100 companies reamed by the latest Zotob worm were running Windows 2000, for cryin' out loud!

The reason Arbor, Cisco, and other network security companies are promoting network-based defenses to the worm problem is that host security has failed to protect corporate networks against even the dumbest Internet worms. The problem isn't the technology - sure, we can patch machines automatically, with daily updates and such - it's the impracticality of doing so in a production environment.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/347/32259#32259