We have relaunched: What's new at ZDNet Asia?

ZDNet / News / Security / Story

Be secure: 'Plan, don't patch', says AV pioneer

By Will Sturgeon, Silicon.com on October 4, 2005

Summary

Companies should pay more attention to intelligence gathering and risk assessment instead of patching, says antivirus veteran Peter Tippett.

Events

Microsoft MSDN/Developer Event
25 Mar 2010

One Marina Boulevard, Microsoft Singapore

IT Architect Regional Conference Singapore 2010
20 - 21 Apr 2010

Singapore Management University, Singapore

The Internet Show 2010
21-22 Apr 2010

Suntec Singapore

Companies are putting too much faith in patching software and investing too little time in proper risk assessment, according to a pioneer of antivirus software.

Dr Peter Tippett told silicon.com the current approach to security has become outdated, counterproductive and too costly. He also controversially suggested companies only patch their computers once per year.

Tippett's words echo the growing voice of support for a move towards a risk-based approach to security.

As such Tippett, CTO of security giant CyberTrust, now dedicates much of his time to monitoring "the underground" and working out the likelihood of malicious code being written to exploit emerging and existing technologies and "knowing exactly what the real problems are".

Tippett likened the necessary intelligence-gathering and risk assessment to the very British obsession with checking the weather forecast.

"Predicting the weather is not a perfect science but it can help a lot," said Tippett, who advises companies to spend more time assessing risk and the probability of attack rather than waiting for the window of vulnerability to open and then rushing to baton down the hatches.

"Companies who decide that patching is going to be their primary method of defence are always going to be worse off than average and are going to spend more and more money on security each year. If you can patch 100 percent you will be protected against a lot of threats but nobody does or can patch 100 percent," said Tippett. "The average is around 70 percent."

"Patching works well if you have one computer. It even works well if you have three computers but if you have 10,000 then forget about it.

"There are all kinds of computers which are not known about by the management. There are mobile workers and protected computers which are never touched except during a service window."

"It would therefore be a mistake to put any faith in patching," said Tippett. "I'd say patch your computers once per year. Plan it three or six months in advance and you'll at least be able to get hold of all laptops and computers."

"Get it done properly and get all your computers to a situation where software is within a year old."

Companies who have already distanced themselves from the reactive, fire-fighting approach to security are claiming significant savings - such as a halving of the IT budget at insurance giant Zurich, as covered recently by silicon.com.

According to Tippett: "These companies spend less money on scanning and less money on paying people to run around patching like crazy."

Tippett agreed with the recent assertion of Gartner analyst and advocate of a risk-based perspective, Jay Heiser, who said such an approach will come from the business and not from the techies.

"Technical people see things in a binary way. They adopt a 'world is flat' approach. The higher up the organization you go, the more this starts making sense."

Silicon.com's Will Sturgeon reported from London.

Related stories

Security 'no longer a tech issue', argues Gartner

Talkback

Add your opinion

In order to post a comment, you need to be registered. (Sign In or register below)

Post your comment
Transform your business interactions with real-time voice, video and telepresence solutions.
Tech Vendor: Cisco

ZDNet Asia Live

When I create an event, I click on an approximate time during the day when I want the event to occur, then I click "edit event detail...

7 hours 4 minutes ago by bessellbrowne on Google Calendar gets 'smart' rescheduling

ipads break alott i had one it broke three times in the month i had it so i got rid of the damn thing id just go for the laptop Top Grade...

7 hours 6 minutes ago by bessellbrowne on Report: 'Hundreds of thousands' of iPad preorders

There are a number of websites that still require Internet Explorer to view and IE for Mac Stinks (it is really ies4osx which is the Wind...

7 hours 8 minutes ago by bessellbrowne on Microsoft: Only minor tweaks in Windows 7 SP1

The receivers don't transmit back to the satellite. Unless there is a phone line attached to the receiver, they don't have any wa...

7 hours 11 minutes ago by bessellbrowne on Apple to join the geolocation craze?

What to expect from open source Symbian http://is.gd/aPIGL

7 hours 26 minutes ago by rebelk0de on topsy

"Lead Cognos BI Developer Insurance in New South Wales , Australian ..." http://bit.ly/ayy19L

8 hours 5 minutes ago by rhrcognos on topsy

whatever little understanding I have we 'll only progress toward end of the world if we use HPCs to lenthen life of human being. Huma...

17 hours 17 minutes ago by abhi32002@gmail.com on High computing promises elixir of life

Thanks for the knowledgeable article on SDDs. Allas...when all this reasearch will happen in Indian Universities. Hope the new bill on Fo...

17 hours 30 minutes ago by abhi32002@gmail.com on APAC HPC users eye solid-state drives

It was a good article. This brings a good opportunity for Indian IT firms to come up with new solutions in this field. HPC can become a b...

17 hours 49 minutes ago by abhi32002@gmail.com on High computing most-wanted job in Asia

COL KR DHARMADHIKARY(RETD) its very late to reply the link, but if it is still alive and looking for opportunity, i would like to know th...

21 hours 46 minutes ago by deb021280 on Education takes off in rural India, helped by PCs

It was just a matter of time until google was marginalised anyway. I'm afraid this will be forgotten in China very quickly. Still, it...

23 hours 51 minutes ago by robinsmith on Report: Google to leave China on April 10

High performance computing (HPC) most-wanted job in Asia http://bit.ly/9vFC3i (via @zdnetasia) #singapore

He doesn't care if her shoes are of glass, All he wants to see is a huge rack and nice a*s. Sleeping beauty's not awoken by true ...

1 day 20 minutes ago by warlowdavies on One pair of 3D glasses to rule them all

RT @zdnetasia: EMC COO, Pat Gelsinger, on bridging gaps in the organization and its cloud ambitions in Asia. (cont) http://tl.gd/i5jjd

EMC COO, Pat Gelsinger, on bridging gaps in the organization and its cloud ambitions in Asia. http://bit.ly/9etOZW

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08 via @zdnetasia

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08

[TECH] URL Shorteners slow Web redirection. - http://bit.ly/bySnWK @zdnetasia

URL shorteners are great but they can slow web redirection & you pray it would never go down http://bit.ly/bySnWK via @zdnetasia

Temasek Holdings eyeing tech stocks, indicating optimistic outlook on IT sector. http://bit.ly/aM7VwU

URL shorteners slow Web redirection. http://bit.ly/bySnWK

Chinese agencies cry foul over Google. http://bit.ly/by6rwV

Philippine antipiracy drive focuses on enterprises. http://bit.ly/aWryDC

Gartner: China to become world's fastest-growing enterprise software market. http://bit.ly/bqJTtb

all of sg's isps have been practising compulsory invisible proxy for all home subscribers at their backend since many years back alre...

2 days 30 minutes ago by melvinchia on Web filters mean bad news for business

it is not to good for china.
Proactol

2 days 15 minutes ago by nathonastle on Chinese ad partners beg Google for information

RT @zdnetasia: HP touts new products and management and productivity tools to address business computing pain points. http://bit.ly/dudgA6

For those with a computer science background, or interested in the high performance computing scene: http://bit.ly/9vFC3i

HP touts new products and management and productivity tools to address business computing pain points. http://bit.ly/dudgA6

IT security insiders rob casinos of $50K http://is.gd/aPIKR

2 days 46 minutes ago by rebelk0de on topsy

Very good explanation of JMX

3 days 20 minutes ago by Babith B on Managing applications with JMX

The reaction to a report issued Tuesday by Flurry Analytics managed to completely overlook some interesting news--the Android-based Motorola Droid outsold the original iPhone over the same period of time following their respective launches--to focus instead on the sales numbers for the Nexus One.

3 days 23 minutes ago by lonemavericks on diggs

Another ZTE story....

3 days 25 minutes ago by Moderate Your Greed on Philippines opens bid for final 3G license

We at www.fifosys.com have also seen a growth in IT outsourcing and anticipate it as a growing field.

3 days 58 minutes ago by sarah Jane on Companies' outsourcing spend to increase

Keep up with ZDNet Asia

Linkedin Join our network

RSS Feeds Subscribe now

Newsletters Subscribe today

Twitter Follow us

Inside ZDNet Asia

Special Report: Tech Focus in 2010

Latest Videos on Tech Industry

Insight: Interviews with Newsmakers

Search for over 15,000 Tech Jobs in Asia

Find your Tech answers in TechGuides

IT Library: Over 60,000 IT papers at your fingertips

Download IT Priorities 2010 Report