Security Patch Management and MSMUG. Bill Cotter 3M

Transcription

1 Security Patch Management and MSMUG Thursday Morning, Feb 7th Bill Cotter 3M MsMUG

2 Today s Structure Consumer and Office Business Display Graphics Business Electro and Communications Business Health Care Business Safety, Security and Protective Services Business 3M 2004 All Rights Reserved Industrial and Transportation Business 2

3 3M Facts Year End 2006 Sales Worldwide... $22.9 billion International (61% of total)..... $14.1 billion Earnings Net income reported. $3.85 billion R&D Expenditures For $1.5 billion Employees Worldwide ,333 United States ,533 Products Sales Offices Locations Plant Loctions Locations Number of Products.. 55,000 + Total last 5 years.... $6.3 billion 3M 2008 All Rights Reserved 3

4 Security Patch Management Bill Cotter, 3M What is it we are talking about? Why 3M is interested t in Patch Management What is MsMUG SP99 or who is running this show? What Vendors are doing Plans and goals What is MsMUG/ISA99 doing How you can participate i t How to contact MsMUG 4

5 What are we talking about? MicroSoft Security Bulletins Mostly Monthly releases Patch Tuesday Key word is - Security How do we expect our vendors to respond? How do we users respond? 5

6 Cost Estimate How much is this costing you? You tell me Security : Good patch management and other best practices can significantly reduce shutdowns due to virus/worms $5M to $20M/year for large Corporations $1M to $5M/year for smaller companies From SANS/Secunia 1/9/2008 5% of 20,000 machines fully patched 40% of machines had 11 or more unsecured applications 6

7 Why does 3M Care? We are one of the large companies so we are talking $$$ We have many different systems in service Reviewing ing each patch with each takes time IT management want Critical patches applied quickly Do we apply or wait for Vendor? 7

8 Quick History of MsMUG Microsoft Manufacturing User Group User group devoted to addressing opportunities when applying Microsoft technology to industrial applications Formed in February members Users Software suppliers Microsoft 8

9 How do you Benefit It is all about YOU Leverage user community, key suppliers & Microsoft to address: Reliable system: Better ROI Security: Supporting & e-productivity efforts Longevity of OS: Deferred capital spending Best Practices: Easy to support systems Training: Better leverage of current staff 9

10 Who is in charge? ISA ISA Instrumentation Systems and Automation S99 -Manufacturing and Control Systems Security S99 Working Group 6 =MsMUG Patch Team report 10

11 Patch Accreditation Starting position 2002 You can t apply security patches to control systems 2004 Please raise a support case and we will test the patch for you The patch should be tested in around 9 months (around the time of Blaster and Nachi worms) Current Situation The Good News Most main vendors now automatically assess and Microsoft patches Some vendors have very good patch turn around times (Some in 1-3 days) 11

12 Vendor Response to Patch Tuesday Siemens Sends newsletter No time limits set looking at 2 day Web site Wonderware Web site with test results RSS feed Has fast response beats 2 day 12

13 Vendor Response to Patch Tuesday GE Web site with test results Setting up two day DOC file Rockwell Web site with test t results Need to get for link Considering i two day 13

14 14

15 15

16 16

17 Need to Discuss Standard response 2 day statement 14 day effort to fix Need agreement How to find on support page or main page How should the data be presented How should users get? RSS Go get XML 17

18 Need to Discuss Common Terms Qualified?=? Supported?=? No Problems How soon for a fix What configurations How many versions back Hold harmless What patches need testing 18

19 What MsMUG Patch is working on Vocabulary Words for Testing Status Words for Test Results How to get vendors to start using Future Work on what vendors should send to users What tools users need to use the data 19

20 What you can do Do I really need to tell you? Figure out if you are spending on patches Carry the message to management Find someone to work on the solution Join MsMUG Patch team WORK on team efforts 20

21 MsMUG How to get involved MS MUG Communication Lists online org 21

22 Thank You for Your Interest For more information, contact Bill Cotter at Go To 22