O'Realleh? For one think, the strategy Granneman is advocating would make patch management and rollout a lot easier and cheaper - simply keep applying those incremental bugfixes to VM images and archive every patched up version onto something cheap like tape or optical discs. If the patch causes something to break, restore a slightly-less-patched-up VM image. This would be helluvva fun, too, for upgrading from one OS to another. Imagine the prospect of being able to tell your boss that you've built up a collection of pre-secured, functionally images ready for use and all the users have to do to complete that Vista rollout is reboot their machines. The big, huge, scary nine legged monster of a security benefit here is the sheer quantity of time it'll save you from having to work on individual machines... freeing you to continually harden the software on those VM images until they're sharp enough to cut through Otto Z. Stern's prostrate. (Time=money=budget=SHINYNEWTOYS)

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/397/33491#33491