It's been one of the dirty little secrets of the security industry for years: Software patches don't work.

It's not that they don't fix the problems that they're designed to solve; they do. Despite technical problems with some patches, most notably regression errors and incompatibility issues in patches from Microsoft Corp. and others, hot fixes hit their targets.

The real problem, as most administrators or competent crackers can attest, is that so few network administrators regularly apply patches that the fixes are all but irrelevant. The reasons are many, but the two most serious issues are the lack of time to download, test and apply the patches and the sheer number of vulnerabilities affecting popular software packages. Combined, these problems leave a playing field rife with unprotected servers and desktops just waiting to be attacked.

[ Read more ]