SANS ISC: ToD - Configuration Management - maintaining security awareness - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

There have been multiple Anti Virus vendor security issues reported over the past month.  Myself being a user of a wide assortment of Anti Virus packages in an ongoing malware categorization and analysis project, thought it would be a 'good idea'(tm) to offer a new 'Tip of the Day' in recommending that you ensure sufficient attention is being paid to security related notices and upgrades for any applications that you may be dependant upon.  The concept really falls back to generic host configuration management best practices and is applicable to any application you may use aside from specific security applications.  Of specific concern should be any application that may use content obtained from the public internet at large.  Anti Virus, Personal Firewalls, Streaming media applications, Office productivity tools, Instant Messaging applications, and the list goes on.  To avoid the perception of vendor bashing *which I am not*, I choose to leave it to the reader to determine your security product patch/release status.

Target Audience:

• Maintaining security awareness for your installed application base is likely more important for the average SOHO/home user running Anti Virus and other security solutions that may not benefit from an enterprise configuration management team watching out for their interests 24x7.

Recommendations:

• Visit all application vendor websites for your installed application base and subscribe to any available RSS feeds, or announcement mailing lists they may offer to licensed application holders. 
  
• Determine if your chosen product(s) have an embedded update notification mechanism and enable that feature for notification or auto-update as appropriate.

William Salusky 
"Malware Hunter/Gatherer (among other things)"
Handler on Duty   Geotagged: nearby