효율적인 조직 소프트웨어 패치 관리 방법에 관한 연구
A Study on Methods for Efficient Enterprise Software Patch Management
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
본 논문에서는 효율적이고 절차적인 소프트웨어 패치 절차를 제안하였다. 매년 조직에서는 수만 개의 알려진 취약점이 존재하고 패치 작업에 수만 시간과 수백만 달러 이상을 소비한다. 이러한 노력에도 불구하고 주어진 패치된 취약점에 대한 익스플로잇이 나타나는 데 걸리는 시간이 단축되고 있는 것으로 조사되었다. 기업, 대학 등 다양한 형태의 조직에서 일관되지 않는 방법으로패치를 관리함에 따라 보안 문제 발생, 시스템 불안정, 패치로 인한 정보 유출 및 작업지연 등의문제가 발생하고 있다. 본 연구에서는 소프트웨어 패치 관리를 위해 필요한 기본적인 사항들을살펴보고 패치 관리를 위해 고려되어야 하는 사항과 패치 관리를 위한 효율적인 단계를 정의한다. 따라서 본 연구는 소프트웨어 기능의 수정, 보안 취약점에 대한 해결 방법으로 조직 내의 소프트웨어를 새로운 버전으로 갱신하고 패치하는 과정에서 조직의 패치 관리 정책을 효율적이고절차적으로 실행하는 방안으로 활용될 것이다.
Abstract
In this paper, we propose an efficient and procedural software patch management phases. Every year, organizations have tens of thousands of known vulnerabilities and spend tens of thousands of hours and millions of dollars or more patching them. Despite these efforts, research has shown that the time it takes for an exploit to appear for a given patched vulnerability is shortening. As various types of organizations such as companies and universities manage patches in inconsistent ways, problems such as security problems, system instability, information leakage and work delay due to patches occur. In this paper, we look at the basics required for software patch management and define the factors to be considered for patch management and the effective steps for patch management. Therefore, this study will be used as a method to efficiently and procedurally execute the organization's patch management policy in the process of updating and patching the software in the organization to a new version as a solution to software function modification and security vulnerability.
참고문헌 (27)
- Nesara Dissanayake, "Software Security Patch Management - A Systematic Literature Review of Challenges, Approaches, Tools and Practices", Journal of LATEX (2021)
- "2020 cyber threatscape report"[URL]
- "New windows vulnerabilities highlight patch management challenges"[URL]
- "O.C.D.S. Scott Coleman, Cyber security review"[URL]
- "Former equifax ceo blames breach on a single person who failed to deploy patch"[URL]
- "Equifax data breach impacts 143 million americans"[URL]
- "Equifax ocially has no excuse"[URL]
- "Cyber attack suspected in german womans death"[URL]
- M. Souppaya, "Guide to enterprise patch management technologies", NIST Special Publication, 40~ (2013)
- F. Li, "Keepers of the machines: Examining how system administrators manage software updates for multiple machines", Fifteenth Symposium on Usable Privacy and Security (fSOUPSg 2019) (2019)
- C. Tiefenau, "Security, availability, and multiple information sources:Exploring update behavior of system administrators", Sixteenth Symposium on Usable Privacy and Security (fSOUPSg 2020), pp.239~258 (2020)
- U. Gentile, "Survey on international standards and best practices for patch management of complex industrial control systems: the critical infrastructure of particle accelerators case study", International Journal of Critical Computer-Based Systems, 9(1-2), pp.115~132 (2019)
- "Goverment of Canada"[URL]
- NIST Special Publication, "Guide to Enterprise Patch Management Technologies", ~
- Jason Chan, "Essentials of Patch Management Policy and Practice", LLC, ~
- "US-CERT homepage"[URL]
- "MEND homepage"[URL]
- "G DATA tech report"[URL]
- "GTI Software homepage"[URL]
- "Northwestern Information Technology Tech paper"[URL]
- "NIST Computer Security Resocure Center"[URL]
- "NIST Infomation Technology Laboratory National Vulnerability Database"[URL]
- "Goverment of Canada"[URL]
- "Recommended Practice for Patch Management of Control Systems"[URL]
- "The Top 7 Operarional Technical Patch Management Best Practices"[URL]
- "Patching Guidelines"[URL]
- "Oklahoma Office of Management&Enterprise Services"[URL]