The list of all-too-familiar names - Nachi, Klez, Lovsan, SoBig, BugBear, Swen, Blaster and Yaha - represents only a sampling of the most prevalent worms and viruses that slithered into corporate networks this fall. But they all have one thing in common: Patches were readily available before most damage had been done.

So why do these intruders continue to wreak such havoc? Because patch management is tough.

It's tough because there are too many patches and not enough time, and because exploits to announced vulnerabilities are materializing faster. (Blaster appeared only 26 days after Microsoft reported the vulnerability.)

It's tough because clients are becoming the attack targets as much as servers, fueling faster propagation and the threat of re-infection from mobile workers reconnecting to the network.

And it's not just Microsoft vulnerabilities. Although Windows seems to get the bulk of the exploits and end-user animosity, the list of targets includes routers, switches, firewalls; Unix and Linux, too.

[ Read more ]