NIST SP800-40：联邦机构补丁与漏洞管理指南

需积分: 13 174 浏览量更新于2024-07-16 收藏 1.09MB PDF 举报

"NIST SP800-40.pdf" 是一份由美国国家标准与技术研究所（NIST）制定的文档，旨在根据2002年的联邦信息安全管理法案（FISMA）履行其法定职责。该文档主要关注的是联邦机构的信息安全标准和指南，但不适用于国家安全系统。NIST负责为所有机构系统制定包括最低要求在内的信息安全标准，这些标准和指南遵循了白宫管理和预算办公室（OMB） Circular A-130的相关要求。这份指南可供联邦机构使用，并且非政府组织可以自愿采用，不受版权限制，但需要归功于NIST。文档的主要内容是"Special Publication 800-40 Version 2.0"，即创建补丁和漏洞管理程序的建议。这是NIST关于如何有效管理计算机系统安全，特别是针对软件补丁和系统漏洞的管理策略的推荐。作者包括Peter Mell、Tiffany Bergeron和David Henning。这份报告旨在帮助组织建立一套全面的补丁和漏洞管理程序，以提高其网络和系统的安全性。报告详细讨论了以下几个关键知识点： 1. **补丁管理**：解释了定期检测、评估、测试和部署软件更新和安全补丁的重要性，以修复已知的安全漏洞。 2. **漏洞评估**：阐述了识别和分类系统漏洞的过程，以及如何优先处理高风险漏洞。 3. **风险管理**：强调了在实施补丁时考虑业务连续性和潜在影响的必要性，以平衡安全与功能需求。 4. **自动化工具**：介绍了利用自动化工具进行漏洞扫描和补丁应用的好处，以减少人为错误和提高效率。 5. **策略制定**：建议组织应制定明确的补丁管理策略，包括补丁测试环境的设置、补丁应用的时间表和紧急响应计划。 6. **监控与审计**：讨论了监控系统以确保补丁已正确安装，以及定期审计以验证补丁管理流程的有效性。 7. **培训与意识**：提醒组织员工培训的重要性，以增强员工对网络安全的意识，并理解其在补丁和漏洞管理中的角色。 8. **合规性**：确保补丁和漏洞管理程序符合相关法规和标准，如FISMA和OMB Circular A-130的要求。通过遵循NIST SP800-40的建议，组织能够建立一个强大的安全防护体系，降低因未修复漏洞而引发的安全事件风险。这份指南不仅适用于联邦机构，也对任何寻求提高信息安全水平的组织具有指导价值。

CREATING A PATCH AND VULNERABILITY MANAGEMENT PROGRAM

The level of damage caused by an attack can be quite severe. A number of Internet worms (self-

propagating code that exploits vulnerabilities over the Internet) such as Code Red, Nimda, Blaster, and

MyDoom have been released in recent years. There are some common data points for these worm

outbreaks. First, as the authors of worm code have gotten more sophisticated, the worms have been able

to spread faster than their predecessors. Second, they each hit hundreds of thousands of computers

worldwide. Most importantly, each one of them attacked a known vulnerability for which a patch or

other mitigation steps had already been released.

Each major outbreak was preventable.

Benjamin Franklin once said that “an ounce of prevention equals a pound of cure.” Patch and

vulnerability management is the “ounce of prevention” compared to the “pound of cure” that is incident

response. The decision on how and when to mitigate via patching or other remediation methods should

come from a comparison of time, resources, and money to be spent. For example, assume that a new

computer worm is released that can spread rapidly and damage any workstation in the organization unless

it is stopped. The potential cost to not mitigate is described by the following equation:

Cost not to mitigate = W * T * R, where (W) is the number of workstations, (T) is the time spent

fixing systems or lost in productivity, and (R) is the hourly rate of the time spent.

For an organization where there are 1000 computers to be fixed, each taking an average of 8 hours of

downtime (4 hours for one worker to rebuild a system, plus 4 hours the computer owner is without a

computer to do work) at a rate of $70/hour for wages and benefits:

1000 computers * 8 hours * $70/hour = $560,000 to respond after an attack.

Compare this to the cost of manual monitoring and prevention. Assume the vulnerability exploited by the

worm and the corresponding patch are announced in advance of the worm being created. This has been

accurate for exploits historically, as true zero day attacks are not frequent. Manually monitoring for new

patches for a single workstation type takes as little as 10 minutes each day, or 60.8 hours/year. Applying

a workstation patch generally takes no more than 10 minutes. This makes the cost equation:

60.8 hours monitoring * $70/hour = $4,256 monitoring cost per year

0.16 hours patching * 1,000 computers @ $70/hour = $11,200 to manually apply each patch

Total cost to maintain the systems = $4,256 + $11,200/patch.

For any single vulnerability for which a widespread worm will be created, manual monitoring and

patching is much more cost-effective than responding to a worm infection. However, given that patches

are constantly released, manual patching becomes prohibitively expensive unless the operating

environment consists of only a few software packages (thus decreasing the total number of patches

needed) or the organization relies on end users to patch their systems (thus distributing the patching

workload, but also introducing a need for patch installation oversight). Since few organizations use a

small number of software packages or can rely on end users to effectively patch systems, widespread

manual patching is not a cost-effective organizational approach.

Since the late 1990’s, the length of time between the announcement of a new major vulnerability and the release of a new

exploit has dropped from months to weeks or days.

In addition to the costs identified through this formula, a security incident could also cause damage to an organization’s

reputation. This is most significant for organizations that are entrusted with sensitive information or operations. When

determining the potential cost to not mitigate, an organization should consider the possible mpact to its reputation.

Manual patching is still useful and necessary for many legacy and specialized systems.

1-2

CREATING A PATCH AND VULNERABILITY MANAGEMENT PROGRAM

A third option is to invest in an automated patching solution. These solutions automatically check for

required patches and deploy them. Both free and commercial solutions are available. Assume that a

commercial solution costs $15,000 and charges $20 per computer for annual maintenance. This approach

will be much cheaper than the manual solution, even though it will be necessary to dedicate possibly an

entire person to maintaining, updating, and patching using the automated solution.

40 hours/week * 52 weeks/year * $70/hour = $145,600/year for the administrator to run the

patching solution

$145,600 + 1,000 computers * $20/computer = $165,600 annual patching cost for the automated

solution

It is not possible to save money by neglecting patch installation. It is extremely expensive to employ

manual patching efforts and it is difficult to do it effectively. Therefore, NIST strongly recommends that

all organizations make effective use of automated patching solutions.

1.5 Document Structure

The remainder of this document is organized into the following sections:

+ Section 2 explains a recommended management process for implementing a security patch and

vulnerability remediation program.

+ Section 3 discusses security metrics to be used for measuring the success of a security patch and

vulnerability remediation program.

+ Section 4 highlights various issues in managing a patch and vulnerability remediation program.

In particular, this section focuses on enterprise patching solutions.

+ Section 5 provides a short discussion of United States government vulnerability and patching

resources.

+ Section 6 summarizes the major conclusions of this publication.

The document also contains appendices with supporting material, as follows:

+ Appendix A presents common acronyms used throughout the document.

+ Appendix B provides a glossary of terminology used throughout the document.

+ Appendix C discusses common types of popular patching resources.

+ Appendix D lists popular patching resources.

+ Appendix E contains an index for the document.

1-3

剩余74页未读，继续阅读

艾米的爸爸

粉丝: 782
资源: 314

NIST SP800-40：联邦机构补丁与漏洞管理指南

NIST SP800-40r3.pdf

你该知道的NIST SP 800系列指南.pdf

NIST-SP-800-64.docx

nist sp800-161下载

NIST SP800-90A

nist sp800-181

nist sp800-108

NIST SP800-131A

nist sp800-60

2017 nist sp800-181

最新资源