Computer security: software patches more vulnerable to hackers.

Software "patches" to update source code or alter it to subvert hackers or other invaders represent an ever-growing cost item, especially for major organizations with locations around the country or around the world. And it seems that hackers are getting better at finding the vulnerabilities faster.

Gartner Inc. predicts that by 2006, 30 percent of all cyber attacks will target vulnerabilities where a patch has been available for fewer than 30 days--double the 15 percent in 2003. The "window of invulnerability" in which systems are protected from a new virus or worm has shrunk from a month to a week in the past year, says John Watters, CEO of iDEFENSE, a Reston, Va.-based provider of intelligence about cyber threats. Meanwhile, the average patch takes 56 days to deploy from the time programmers start developing it, he says.

As Watters describes it, computer security is a core business issue that has transcended the IT area--"it's creeping up in budgets where people are struggling to decide if throwing more money at it is the right way to go ... You need technology products to manage your security, and in the past few years that has meant having a centralized command and control console. Most larger organizations have deployed spot [security] products, and have spent the last year catching up with compliance."

Watters says his company--which caters to major financial and government institutions--concentrates "on helping customers pick vulnerabilities to defend first. We provide decision-support information to focus their resources and decide how to put them to best use."

Drawing from a network of 150 "researchers" in 30 countries around the world, iDEFENSE attempts to spot any and all "exploit" opportunities and alert vendors to the threat. While Microsoft, and particularly its Internet Explorer, is still the top target, Watters says the company has worked with more than 100 software vendors.

"An interesting trend is that an increasing percentage of vulnerabilities are in the information security products themselves," he says. "The bad guys are figuring how to use AV [anti-virus] products to attack the systems they're supposed to protect."

Microsoft is the biggest target in part because it's the most widely deployed operating system in the world, but also because the hacker community resents "closed source" applications like Windows.

But Watters believes the hacker threat is subsiding, and can be dealt with largely through traditional anti-virus products. "The real threat is electronic crime and espionage," he says, apparently abetted in some cases by "state-sponsored" affiliations with hacker groups.