ECONOMICS OF SECURITY PATCH MANAGEMENT

Transcription

1 ECONOMCS OF SECURTY PATCH MANAGEMENT Huseyin Cavusoglu * Hasan Cavusoglu Jun Zhang AB Freeman Shool o Business, Tulane University 7 MAlister Drive, New Orleans, LA 70118, USA Sauder Shool o Business, The University o British Columia 2053 Main Mall, Vanouver, BC V6T1Z2, CANADA huseyin@tulaneedu, avusoglu@sauderua, jzhang4@tulaneedu Astrat Path management is a ruial omponent o T seurity programs An important prolem within this ontext is to determine how oten to update the systems with neessary pathes eeping the systems pathed with more requent path updates inreases operational osts while reduing seurity risks On the other hand, leaving the systems unpathed with less requent path updates dereases operational osts while inreasing seurity risks n this paper we develop a game theoreti model to derive the optimal requeny o path updates to alane the operational osts and damage osts assoiated with seurity vulnerailities We irst analyze a entralized system in a enhmark ase to ind the soially optimal path management poliy and assoiated path release yle o the vendor and path update yle o the irm Then we onsider a nonentralized system in whih the vendor determines its path release poliy and the irm selets its path update poliy in a Stakelerg ramework Given the results in entralized and nonentralized path management, we next address how we an oordinate the path release poliy o the vendor and the path update poliy o the irm using ost sharing and/or liaility to ahieve the soially optimal path management in a nonentralized setting eywords: Path management, path update yle, path release yle, nested poliies, oordination, ost sharing, liaility 1 ntrodution Today most seurity inidents are aused y laws in sotware, alled vulnerailities t is estimated that there are as many as 20 laws per thousand lines o sotware ode (Daey, 2003) Computer Emergeny Response Team/Coordination Center (CERT/CC) statistis reveal that the numer o vulnerailities reported has inreased dramatially over the years, rom only 171 in 1995 to 3784 in 2003 (CERT, 2004) The ultimate solution to sotware vulnerailities is appliation o pathes Sotware vendors generally release pathes to ix vulnerailities in their sotware produts These pathes, i applied orretly, remove vulnerailities rom the systems However, many systems are let unpathed or months, even years (Shostak, 2003) Aording to CERT/CC, around 95 perent o seurity reahes ould e prevented y keeping systems up-to-date with appropriate pathes (Daey, 2003) The Slammer virus, whih swept the nternet in January 2003, aused network outages all around the world, aeting 911 all enters, airlines, ATMs But Mirosot had released the path ixing the vulneraility that Slammer exploited six months eore the inident Similarly, Code Red and Nimda wreaked havo on those ompanies that were not urrent with their sotware path updates (MGhie, 2003) So i pathes are the panaea to sotware vulnerailities, why don t irms apply them as soon as vendors make them availale? To egin with, path management is multiaeted, and there are several operational reasons or not applying pathes immediately First, there are too many vulnerailities to path n an average week, vendors and seurity organizations announe around one hundred and ity vulnerailities * orresponding author

2 along with inormation on how to ix them (MGhie, 2003) Sorting through all these vulnerailities to ind relevant ones is a tedious and laor-intensive jo Seond, pathes annot e trusted without testing (Donner, 2003) Beore eing applied in prodution environments, eah path must e tested to make sure that it is working properly and does not onlit with other existing appliations in the system n some ases, irms need to reonigure the system and/or reode some appliations so that the path an work without ausing any new prolem Third, distriution o pathes is not standard Some pathes are availale on the vendor we site and some pathes are not Even i they are availale, irms are too usy to ontinually hek the vendor site Fourth, every path requires installation ater testing This mostly means taking the system down and restarting (reooting) it the path is applied to a ritial system in a prodution environment, downtime an e very expensive Thereore, updating systems with pathes is ostly On the other hand, the onsequenes o not updating systems promptly with neessary pathes an e severe too The time window etween identiiation o vulnerailities and reation o exploits has shrunk dramatially over the years One an exploit is released, it may e too late to onsider pathing For instane, Slammer exploited 90% o vulnerale systems within 10 minutes o its release (Daey, 2003) Code Red ineted a total o 359,000 omputers within 14 hours o its release (MGhie, 2003), just to name a ew So irms must at ast to avoid alling vitim to maliious ats Sine irms an update their vulnerale systems only with availale pathes, the way sotware vendors release pathes has a proound eet on how irms manage the pathing proess Although the ommon pratie in the past was to release pathes as soon as they were ready, in an eort to ease the urden on system administrators struggling with requeny o updates, and to make the proess more preditale, today many sotware vendors ollow period path release poliies (Pruitt, 2003) For example, Mirosot hanged its shedule and swithed to a monthly path release yle in Otoer 2003 Computer Assoiates and PeopleSot, n issue pathes quarterly (Foley and Hulme, 2004) Given the omplexities surrounding path management, quantitative models are needed to help irms determine the optimal path management strategy (Donner, 2003) n this paper we speiially study this prolem to understand how oten systems should e updated with released pathes We irst study a enhmark senario to determine the optimal path release and path update poliies or a entralized system onsisting o a sotware vendor and a sotware user (irm) Next we analyze a nonentralized system in whih path release and path update deisions are made y the vendor and the irm, individually in a Stakelerg game ramework, where the vendor announes its path release poliy irst, and then the irm reats to it y hoosing its path update poliy Given that path management is ostly and vulnerailities are deets aused y sotware vendors, reently seurity experts started questioning the impliations o ost sharing in path management Sine irms urrently ear the ost o pathing, and irms annot keep up with the sheer numer o pathes released y vendors every day, it may help irms i sotware vendors share this urden (Farer, 2003) The argument is very simple: Sine you do not have to pay to repair your ar when a manuaturer deet, suh as aulty rakes, is ound, why should irms pay or the ost o pathing? What i the vendor s release poliy prevents the path rom eing released? Then the question hanges to a liaility issue in seurity Using the previous analogy, i aulty reaks ause you to e in an aident, the ar manuaturer an e held liale in ourt What i your server is attaked eause o a speii vulneraility or whih a path has not yet een released y the vendor? Thereore we examine ost sharing and liaility as possile oordination shemes to ahieve the soially optimal levels o path release and update yles 2 Model Basis We study a simple system onsisting o one sotware vendor and one irm that uses the sotware We assume that identiiation o vulnerailities ollows a Poisson proess with an arrival rate o The irm updates its system with new pathes one in every T time units (ie, the irm s path update yle is T )

3 The irm inurs two types o ost in path management: damage ost as a result o exploitation o vulnerailities not pathed and path update ost assoiated with identiying, testing, and installing pathes The ojetive o the irm is to minimize the sum o damage ost and path update ost y hoosing an appropriate path update yle Damage ost is inurred eause either (i) the vendor waits to release pathes until its next release yle or identiied vulnerailities or (ii) the irm does not update its system with released pathes until its next update yle We all the period etween the time at whih a vulneraility is identiied and the time at whih a path is released the pre-release period Similarly, we all the period etween the time at whih a path is released and the time at whih the irm applies the path the post-release period We assume that the damage inurred is proportional to the duration o preor post-release periods We deine and a as the damage ost per unit time in the pre- and post-release periods, respetively Every time the irm updates its system with missing pathes, it inurs (i) a ixed ost,, whih aptures the ost assoiated with identiiation o missing pathes and the ost o downtime during installation o tested pathes and (ii) a variale ost, n, due to testing and oniguration hanges and/or reoding, and installation, where n is the numer o missing pathes n our model the vendor releases pathes to ix vulnerailities in its sotware one in every T v time units (ie, the vendor s path release yle is T v ) The vendor inurs two types o ost: path release ost assoiated with developing pathes or its identiied vulnerailities and reputation ost or having vulnerale sotware The vendor minimizes the sum o path release ost and reputation ost y hoosing an appropriate path update yle n order to develop a path or a vulneraility, the vendor must assign some resoures This is the variale omponent o path release ost, n v There is also a ixed ost o inorming the puli aout pathes, making pathes availale, and other PR osts, denoted y v The vendor inurs a ost in term o reputation loss This ost inludes the loss in uture sales eause o redution in pereived quality o sotware and trust in sotware y the irm We deine and a as the reputation ost per unit time o exposure in pre- and post-release periods, respetively n this paper, we onsider a nested poliy A path management poliy is nested i the path update yle o the irm is a multiple o the path release yle o the vendor; that is, one path update yle onsists o k path release yles (T = kt v ) 3 The ntegrated System n the integrated system, a entral planner deides on the path release yle and path update yle to minimize the total system ost We an write the total expeted system ost during one update yle onditional on n pathes released within this update yle as L ( T, T n) n k n nt / 2 n( k 1) T / 2 (1) v v v v a v Beause identiiation proess is Poisson, the total expeted system ost during one update yle is n ( T ) T L ( Tv, T ) L ( Tv, T n) e kv ( v Tv / 2 a ( k1) Tv / 2) T (2) n! n0 t ollows that the expeted average ost per unit time is a v a C ( Tv, T ) L ( Tv, T ) / T T ( ) Tv ( v ) (3) T 2 T 2 Thus, the entral planner s prolem an e stated as min { C ( T, T ) T kt or any k} Tv0, T0 v v v The ollowing result haraterizes the optimal path management poliy when T and T v are determined together y the entral planner

4 Proposition 1 Let respetively Then, * * Tv and T e the optimal path release and update yles or the integrated system, 2( ) * * v Tv T, (4) * * and the minimum expeted average system ost is C ( T, T ) 2 ( ) ( ) v v v Proposition 1 states that at soial optimality path release and update yles must e synhronized, that is, pathes must e applied to the system as soon as they are released y the vendor n pratie, T and T v are determined y the irm and the vendor individually n the next setion, we disuss how path release and update yles hange when these are determined in a nonooperative setting 4 The Deentralized System To solve this game, we work akward and irst ous on the irm s path update prolem, assuming a path release yle T v is given 41 The Firm s Prolem Given that the irm ollows a nested poliy, that is, T = kt v, one path update yle o the irm is divided into k path release yles Beause the release times o n pathes are uniormly distriuted within ktv time units, (n1,, nk) ollows a multinomial distriution Hene, the irm s expeted average ost per unit time is C ( T, k) T / 2 ( k1) T / 2 /( kt ) (5) v v a v v For a given T v, the irm s prolem an e ormulated as min { T / 2 ( k1) T / 2 /( kt ) k is integer} k v a v v Lemma 1 haraterizes the optimal path update poliy or the irm Lemma 1 For a given path release yle T v o the vendor, k satisies 2 * * 2 * * k ( k 1) and k ( k 1) 2 2 T T (6) a v a v Given the irm s est response, we next study how the vendor hooses its path release yle 42 The Vendor s Prolem * Taking irm s response k into onsideration, the vendor hooses its path release yle T v to minimize its average ost The average expeted ost or vendor an e written as * * C ( T, k ) / T ( ) T / 2 k T / 2 (7) v v v v a v a v v * The vendor hooses T v to minimize Cv ( Tv, k ) or a given reation k * Note that y onstraints in (6); thereore, the vendor s prolem an e ormulated as min / T ( ) T / 2 kt / 2 Tv, k v v a v a v v * k is uniquely identiied 2 2 s t k( k 1) and k( k1) 2 2 atv atv Unortunately, there are no lose-orm solutions or the vendor s prolem Beause our ous is on oordination shemes to ahieve the soially optimal path release and update yles, and the path

5 release and update yles are idential at soial optimality, in the next proposition we haraterize the region where the path release and update yles are idential without any oordination mehanism Proposition 2 / 2 /, then the optimal path release yle is a v orresponding path update yle p* p* T is equal to T v T 2 /( ) and the p* v v Note that / an e interpreted as the tolerane level o the irm to wait or update, and / as the a tolerane level o the vendor to wait or release without any oordination When the irm s tolerane level is smaller than twie the vendor s tolerane level, path update will e synhronized with path release when oth deisions are made individually This result is very intuitive Unless the irm is tolerant to wait till every other release, the irm hooses to path its system immediately with every new release However, one should note that even or this ase, the synhronized path release/update yle is not neessarily idential to the synhronized yle that minimizes the soial ost Thereore, path update and path release yles are, in general, not soially optimal when they are determined separately n the next setion, we study possile oordination shemes that an ahieve the soially optimal path management 5 Coordination Shemes Through ost sharing, every time a path update ours, (0 1) portion o the ixed ost or path update is harged to the vendor Through liaility, every time a vulneraility is exploited eore the l path that ixes the vulneraility is released, the vendor has to pay (0 l 1) portion o the damage ost inurred y the irm For oth oordination shemes, we irst haraterize the optimal path release and update yles and then develop suiient onditions under whih the soially optimal path release/update an e ahieved We summarize results elow Proposition 3 (Cost Sharing Only) Cost sharing y itsel an ahieve the soially optimal path update and release i v v va a Then, the required level o ost sharing is ( ) /( ) / v v Proposition 4 (Liaility Only) Liaility y itsel an ahieve the soially optimal path update and release i v v l Then, the required level o liaility is /( ) / v v Proposition 5 (Cost Sharing plus Liaility) Cost sharing together with liaility an ahieve the soially optimal path release and update i v va a l And the levels o ost sharing and liaility satisy ( ) /( ) ( ) / v v Propositions 3, 4, and 5 haraterize the onditions under whih a entral planner an use ost sharing or liaility or oth to ahieve the soially optimal path release and update Our analysis shows that what oordination sheme to use depends on where the tolerane level o the system alls When the system s tolerane level is lower than the vendor s tolerane level with maximum ost sharing, there is a v

6 oordination mehanism(s) that an ahieve the soially optimal path management the system s tolerane level is lower than the vendor s tolerane level without ost sharing or liaility, then liaility y itsel results in the soially optimal path release/update On the other hand, i the system s tolerane level is higher than the vendor s tolerane level without ost sharing or liaility, then ost sharing y itsel may lead to the soially optimal path release/update the system s tolerane level is very high, neither ost sharing nor liaility an oordinate the vendor s path release and the irm s path update deisions nterestingly, or these senarios, the joint use o these two shemes annot ahieve the soially optimal path release/update yle either Thereore, using oth oordination shemes does not enlarge the easile region to ahieve soial optimality ompared to using ost sharing and liaility individually Proposition 5 implies that ost sharing and liaility are not sustitutes or eah other; that is, using liaility in addition to ost sharing does not redue the level o ost sharing required to ahieve optimality, or vie versa Thereore the entral planner should never use oth oordination shemes at the same time to oordinate path management deisions 6 Conlusions n this paper we develop a game theoreti model to derive the optimal requeny o path updates Our analysis reveals that the soially optimal path management requires synhronization o path release and update yles When deisions or path release and update poliies are let to the vendor and the irm, individual deision making may result in asynhronized yles or path management Even i path release and update yles are synhronized, the synhronized yle is not the optimal path release/update yle Further, our analysis demonstrates that ost sharing an always synhronize path release and path update yles whereas liaility an never e used to synhronize them Sine ost sharing is not a sustitute or liaility, and liaility is not a sustitute or ost sharing, using oth ost sharing and liaility together to ahieve oordination does not add value other than ausing the vendor to ear more ost Thereore, depending on the inentive levels o the system and the vendors, vendors should share either the urden (ost sharing) or the damage (liaility), ut not oth to reah the soial optimality with minimum level o additional ost on the vendor side We assumed that there is only one vulnerale sotware program running on one omputer n reality, multiple omputers with diverse risk proiles an e at risk rom a speii vulneraility To manage path updates, irms an arrange these vulnerale mahines into groups and apply dierent path update poliies We also assumed that eah vulneraility auses the same level o threat This is a reasonale assumption given that there is no easy way or an administrator to tell whether a vulneraility is serious or very serious (Donner, 2003) Reently some vendors started attahing a severity rating to their vulnerailities Using this inormation, irms an devise path update poliies or vulnerailities with dierent severity ratings Future researh should address aove-mentioned prolems Reerenes CERT (2004) Cert/ statistis Daey, R F (2003) Eetive path management is ritial to mitigating sotware vulnerailities GAO T Donner, M (2003) Path management - its, ad guys, and uks! Seure Business Quarterly, 3(2), 1-4 Farer, D (2003) Should mirosot pay or your seurity path osts? TehUpdate, January 30 Foley, J and G V Hulme (2004) Get ready to path normationweek, August 30 MGhie, L (2003) Sotware path management - the new rontier Seure Business Quarterly, 3(2), 1-4 Pruitt, S (2003) Sotware users hit a rough path PC World, Novemer 10 Shostak, A (2003) Quantiying path management Seure Business Quarterly, 3(2), 1-4