http://www.gcn.com/vol1_no1/daily-updates/37584-1.html By Dawn S. Onley GCN Staff 11/17/05 The Defense Department recently made it mandatory for computer users to deploy automated security tools across the department to better protect networks from viruses. The Communication Tasking Order, a policy directive released Nov. 3 by the commander of the Strategic Command, orders Defense agencies to "immediately initiate" the machine-to-machine patches to automatically repair vulnerabilities as soon as software patches become available. The order sets a phased timeline for compliance and allows for operational necessities, according to Timothy Madden, spokesman for the Joint Task Force for Global Network Operations. JTF-GNO is charged with operating and defending the Global Information Grid - the Defense Department's classified and unclassified network. The new directive requires that all patches be installed immediately using commercial and government tools currently available, with an eye toward standardization in the future. "There are various tools available now, both in the commercial sector and in the government, that are capable of providing such remediation," Madden said. "The JTF-GNO is directing the use of such tools across the GIG, and that such tools must be standardized by a certain time." Air Force Lt. Gen. Charles Croom, director of the Defense Information Systems Agency, said automated patch rollout would boost the network security posture across DOD. Croom called the current process manual-intensive. "When there's a vulnerability identified in a particular piece of software, they [software companies] push those patches to us and we push those patches to the services and require implementation," Croom said. "Obviously, the trick is how fast can you get them and how fast can you implement them? And so, I think you see us focusing on the techniques, tactics and procedures to do that better." Croom, who also serves as commander of JTF-GNO, said the new policy would make the implementation of patches an instant process. "We don't do the patches instantly. But we get viruses instantly, so even days are too long to implement patches, and for us it takes days and weeks," Croom said. "The vision for the future is you get the person out of the loop and you get machine-to-machine ability so you have the patches automatically distributed and loaded on whatever piece of equipment needs to be patched." _________________________________________ Earn your Master's degree in Information Security ONLINE www.msia.norwich.edu/csi Study IA management practices and the latest infosec issues. Norwich University is an NSA Center of Excellence.
This archive was generated by hypermail 2.1.3 : Thu Nov 17 2005 - 23:52:29 PST