MULTI-ENVIRONMENT SOFTWARE PATCHING TOOL

ByZak Wilson – zhw05u

Supervisor: Dr Jonathan M Garibaldi

- Abstract- Abstract

Administering and monitoring all of the changes or modifications made to a system can be very hard work Administering and monitoring all of the changes or modifications made to a system can be very hard work and is incredibly time intensive. and is incredibly time intensive.

All levels of management need to administer, monitor and raise new changes or fixes to their own All levels of management need to administer, monitor and raise new changes or fixes to their own individual subsystems ensuring overall system integrity.individual subsystems ensuring overall system integrity.

Effective, efficient and easy-to-use ways to administer and monitor patching on growing, large scale Effective, efficient and easy-to-use ways to administer and monitor patching on growing, large scale software packages. Not only for the experts who initiate and implement the system, but right down software packages. Not only for the experts who initiate and implement the system, but right down through the organization, top level managers checking latest statuses of their systems, support analysts through the organization, top level managers checking latest statuses of their systems, support analysts monitoring and administering the patching compatibility between environments, right through to the monitoring and administering the patching compatibility between environments, right through to the developers making modifications and raising patches onto their development environments, testing and developers making modifications and raising patches onto their development environments, testing and progressing these as well as an effective way of being able to keep track of all of their changes across all progressing these as well as an effective way of being able to keep track of all of their changes across all respective environments.respective environments.

I aim to design and develop a simple multi-environment software patching tool to cater for all of the I aim to design and develop a simple multi-environment software patching tool to cater for all of the above needs, focussing on the above needs, focussing on the effectivenesseffectiveness, , efficiencyefficiency and and easy-of-useeasy-of-use of the tool. of the tool.

- Motivation- Motivation

The initial motivation to design and develop said patching tool stemmed from identifying a serious need The initial motivation to design and develop said patching tool stemmed from identifying a serious need within Oracle for a simple, clear and intuitive way of administering patching across multiple environments. within Oracle for a simple, clear and intuitive way of administering patching across multiple environments.

I therefore felt the need to develop a patching tool to enable the effective and intuitive management of I therefore felt the need to develop a patching tool to enable the effective and intuitive management of patching on companies own systems, ensuring patch integrity and compatibility between development, patching on companies own systems, ensuring patch integrity and compatibility between development, testing, staging and production environments as well as providing intuitive administration tools used to testing, staging and production environments as well as providing intuitive administration tools used to manipulate these patches.manipulate these patches.

The functionality of this patching tool shall enable the:The functionality of this patching tool shall enable the: Top-level Managers Top-level Managers to check, monitor, approve or reject patches.to check, monitor, approve or reject patches. Support AnalystsSupport Analysts to monitor & report on latest patch statuses and how they associate with the issue reported.to monitor & report on latest patch statuses and how they associate with the issue reported. Developers Developers to raise, test and progress patches.to raise, test and progress patches.

Existing products on the market seemed hard to come by and were usually developed for individual Existing products on the market seemed hard to come by and were usually developed for individual companies, didn’t cater for such a broad range of users and were certainly not intuitive, and were companies, didn’t cater for such a broad range of users and were certainly not intuitive, and were notoriously buggy. notoriously buggy.

- Description of the work- Description of the work The patching tool shall enable the:The patching tool shall enable the:

Top-level Managers: Top-level Managers: To check, monitor, approve or reject patches. Review progress of specific To check, monitor, approve or reject patches. Review progress of specific patches, or more generally the patching level between environments.patches, or more generally the patching level between environments.

Support Analysts:Support Analysts: When an issue is called in and looked into, the support team will need a way in When an issue is called in and looked into, the support team will need a way in which to check whether a patch fixing that issue has been worked on and whether it is in the progression which to check whether a patch fixing that issue has been worked on and whether it is in the progression queue soon to be applied to the live system. queue soon to be applied to the live system.

Developers:Developers: Any changes to the system will be made and raised as a patch, this is then tested Any changes to the system will be made and raised as a patch, this is then tested thoroughly on whatever environment it was applied, progressed onto the next environment where the thoroughly on whatever environment it was applied, progressed onto the next environment where the same tests are carried out again. Developers will therefore need an efficient way of raising, monitoring, same tests are carried out again. Developers will therefore need an efficient way of raising, monitoring, updating and progressing their patches.updating and progressing their patches.

- - Functionality Proposed (i)Functionality Proposed (i)

The extent of the functionality of this service depends on your role within the company implementing the system. There are a number of common operations available to everyone, and also there are also a number of role specific operations available, aimed to streamline many of the role specific responsibilities and processes.

Categorising operations by role allows for: More intuitive user interface with fewer menu items and operation shortcuts cluttering up the menu bars. limits the ‘damage’ rogue users can inflict should they gain access.

The common functionalities available to everyone:

View Patch Details Show Unprogressed Patches Search Patches

- - Functionality Proposed (ii)Functionality Proposed (ii)

Depending how you split the operations between the roles, and also the number of different roles in Depending how you split the operations between the roles, and also the number of different roles in operation is entirely dependant on the individual company or organisation that is using the patching tool. operation is entirely dependant on the individual company or organisation that is using the patching tool.

Role Based Functionality TableRole Based Functionality Table

DevelopersDevelopers Support AnalystsSupport Analysts ManagersManagers

- Raise a patch- Raise a patch No role specific functionalityNo role specific functionality - Approve / Reject Patch- Approve / Reject Patch- Progress a patch- Progress a patch - Test a patch- Test a patch - Add / Remove User- Add / Remove User- Test a patch- Test a patch - Progress a patch- Progress a patch - Add / Remove - Add / Remove EnvironmentEnvironment- Edit a patch- Edit a patch - Environment Summary- Environment Summary - View User Details- View User Details

- Environment Summary- Environment Summary- Set user privileges- Set user privileges

- Related Work- Related Work

The vast majority deals with the growing problem of guaranteeing patch integrity for common software The vast majority deals with the growing problem of guaranteeing patch integrity for common software products. Designed to protect the company or individual against the most recent security threats.products. Designed to protect the company or individual against the most recent security threats.

Intended for use alongside these, and is individually configured for patch management on any one of the Intended for use alongside these, and is individually configured for patch management on any one of the companies systems or specific business software not scanned by existing patch management software companies systems or specific business software not scanned by existing patch management software available. available.

Quite often the company develop in-house a patch management tool for internal use.Quite often the company develop in-house a patch management tool for internal use.

Whilst working at Oracle I gained first hand experience of the problems with developing software Whilst working at Oracle I gained first hand experience of the problems with developing software internally for internal use only.internally for internal use only.

- - ShavlikShavlik HfnetchkPro HfnetchkPro - - GFI GFI LANguardLANguard N.S.S N.S.S - - eEyeeEye Retina Retina - - Microsoft SUSMicrosoft SUS - -

- Design Architecture- Design Architecture

- Database Operations- Database OperationsThere are a number of key operations that the interface will need to support and relay to the database in order There are a number of key operations that the interface will need to support and relay to the database in order

to extract the desired information, these can be broken down into categories as follows:to extract the desired information, these can be broken down into categories as follows:

Patches:Patches: Raise a patchRaise a patch – Creates a new row in the patches table, representing a new patch. – Creates a new row in the patches table, representing a new patch. Edit a patchEdit a patch – Modify details relating to the patch, stored in the patches table. – Modify details relating to the patch, stored in the patches table. Test a patchTest a patch – Sets a flag signifying any changes the patch made were successful. – Sets a flag signifying any changes the patch made were successful. Progress a patchProgress a patch – Updates the raiseTo field to point to the next environment to be progressed to. – Updates the raiseTo field to point to the next environment to be progressed to. Approve / Reject patchApprove / Reject patch – Flag set by management to signify whether that patch has approval or not. – Flag set by management to signify whether that patch has approval or not. Search for a patchSearch for a patch – comprehensive search functionality allowing search by various attributes. – comprehensive search functionality allowing search by various attributes. View patch detailsView patch details – Displays all information relating to any patch in question. – Displays all information relating to any patch in question. Show Unprogressed PatchesShow Unprogressed Patches – Displays all patches that have not yet made it all the way through its progression path. – Displays all patches that have not yet made it all the way through its progression path.

Users:Users: Add a userAdd a user – Creates a new row in the users table, representing a new user. – Creates a new row in the users table, representing a new user. Remove a UserRemove a User – Modify users details, stored in the users table. – Modify users details, stored in the users table. Show User DetailsShow User Details – Displays a page showing all user details & activity. – Displays a page showing all user details & activity. Set User PrivilegesSet User Privileges – Allows management to have application access control over its team. – Allows management to have application access control over its team.

Environments:Environments: Add an EnvironmentAdd an Environment – Creates a new environment and associates it with an account. – Creates a new environment and associates it with an account. Edit an EnvironmentEdit an Environment – Modify details of a specific environment. – Modify details of a specific environment. Remove an EnvironmentRemove an Environment – Removes the desired entry from the ENVS table. – Removes the desired entry from the ENVS table. Environment SummaryEnvironment Summary – Displays patches associated with that environment & other useful info. – Displays patches associated with that environment & other useful info.

- User Interface Design- User Interface Design This is an initial design of the skeleton of the application, paying careful attention to keeping the interface as clear and This is an initial design of the skeleton of the application, paying careful attention to keeping the interface as clear and

intuitive as possible.intuitive as possible.

- System Design- System Design

What platform chosen?What platform chosen?

This patching tool is being developed and designed for use on Windows platforms, however support for This patching tool is being developed and designed for use on Windows platforms, however support for various Unix and Linux distributions shall be forthcoming, as the application and architecture of the various Unix and Linux distributions shall be forthcoming, as the application and architecture of the system are both portable.system are both portable.

What languages chosen?What languages chosen?

The database is going to be Oracle Database 10g, its scalable for large systems without significant The database is going to be Oracle Database 10g, its scalable for large systems without significant performance loss, also allowing various audit and security functionalities.performance loss, also allowing various audit and security functionalities.

The application will be developed using Java and Java Swing.The application will be developed using Java and Java Swing.

Possibility of applet development for online use.Possibility of applet development for online use.

- References- References

Patching tools reviewed:Patching tools reviewed:

Shavlik HfnetchkPro - Shavlik HfnetchkPro - http://www.shavlik.com/pHFNetChkPro.aspxhttp://www.shavlik.com/pHFNetChkPro.aspx GFI LANguard N.S.S - GFI LANguard N.S.S - http://www.gfi.com/adentry.asp?adv=142&loc=28http://www.gfi.com/adentry.asp?adv=142&loc=28 eEye Retina - eEye Retina - http://www.eeye.com/html/Products/Retina/index.htmlhttp://www.eeye.com/html/Products/Retina/index.html Microsoft SUS - Microsoft SUS - http://www.microsoft.com/windows2000/windowsupdate/sus/default.asphttp://www.microsoft.com/windows2000/windowsupdate/sus/default.asp

Further Reading (Research):Further Reading (Research):

http://www.windowsecurity.com/articles/Security_Scanner_Patch_Management.htmlhttp://www.windowsecurity.com/articles/Security_Scanner_Patch_Management.html

Questions ?