Some pundits say the simple answer for patching lies in proactivity. Get the patch applied before an incident occurs, and keep the problem from occurring rather than fixing it after the fact. That's a simple truth, but in practice, it's a lot harder to pull off than it sounds. It also contradicts the way security is usually addressed.

Unfortunately, despite all the hype around being proactive and prepared, especially after Sept. 11, 2001, the reality remains that a majority of security fixes are done retroactively, after an incident has occurred.

One problem is that being proactive often gets confused with being fully automated. This is risky, because they're two very different concepts.

[ Read more ]

Related items

• News: Patching rhythm: start a monthly patch process (13 November 2003)
• News: Experts question Windows patch policy (11 November 2003)