Optimal Policies for Security Patch Management

Abstract

E ffective patch management is critical to ensure the security of information systems that modern organizations count on today. Facing numerous patch releases from vendors, an information technology (IT) manager must weigh the costs of frequent patching against the security risks that can arise from delays in patch application. To this end, we develop a rigorous quantitative framework to analyze and compare several patching policies that are of practical interest. Our analyses of pure policies-policies that rely on a single metric such as elapsed time or patch severity level-show that certain policies are never optimal and no single policy may fit all information systems uniformly well. Depending on the context parameters, particularly the setup and business disruption costs for patching, either a time-based approach or an approach based on the cumulative severity level may be effective. To develop a more complete guideline for policy selection, we decipher hybrid policies that combine multiple metrics. Finally, we conduct extensive numerical experiments to verify the robustness of our analytical results. Overall, our paper establishes a comprehensive framework for analyzing various patching policies and furnishes useful insights for IT managers.

Market Segmentation and Software Security: Pricing Patching Rights

“…Beattie et al (2002) characterize the optimal time to apply patches when trading off patch instability and security risk exposure. Dey et al (2015) compare several patch application policies, varying by a measure of interest including the number of patches, time between patching, and cumulative severity of patches. Cavusoglu et al (2008) examine the role of cost sharing and loss liability on time-driven patch management.…”

Economics of Ransomware Attacks

“…The research agenda on the economics of information security has been extensively developed along multiple directions such as patching management and incentives (Cavusoglu et al 2008, Ioannidis et al 2012, Dey et al 2015, August et al 2016, software liability Tunca 2011, Kim et al 2011), network security (August and Tunca 2006, August et al 2014, piracy (August and Tunca 2008, Lahiri 2012, Kannan et al 2016, vulnerability disclosure (Cavusoglu and Raghunathan 2007, Arora et al 2008, Choi et al 2010, Mitra and Ransbotham 2015, and markets for information security and managed security services (Kannan and Telang 2005, Dey et al 2012, Gupta and Zhdanov 2012, Ransbotham et al 2012, Dey et al 2014, Cezar et al 2017. However, study of the economic dynamics of markets affected by ransomware remains relatively scarce.…”

“…Most prior work has aimed at understanding how a software firm and its users react to security risk tend to model both patching costs and security losses, and these models can cover a wide variety of cyber attacks (August and Tunca 2006;Cavusoglu et al 2008;Dey et al 2015). However, ransomware is unique in that it presents users with an opportunity to pay in exchange for a possible reduction in security losses.…”

Normalization of Severity Rating for Automated Context-aware Vulnerability Risk Management

“…Current VRM methods, used in production environments, prioritize vulnerability patching based on the severity score, thus vulnerabilities with critical and high severity are patched first. D. Dey et al [3] compares several practical patch policies and concludes that patch policies relying on a single metric such as severity level are not optimal. Indeed, if the severity level of a vulnerability is high but the risk of exploitation is low, it can be patched in a later time.…”