The Rise of Virtual Patching
Sometimes known as “external patching” or “vulnerability shielding,” virtual patching establishes a protective policy enforcement gateway that is outside the resource being protected and works to identify and intercept attempted exploits of vulnerabilities before they reach their target. With virtual patching, direct modifications to the resource being protected are not required, and updates can be automatic and adapt to continuously evolving threats. When a security attack vector is blocked using virtual patching solutions, traditional vendor software patching can become redundant or irrelevant.
Virtual patching is often more comprehensive, more effective, faster, safer and easier to apply than traditional vendor patching, and provides organizations a faster time-to-protection against vulnerabilities with a more cost-effective solution, without any need to impact production systems. With traditional vendor security patching models, there is an inherent risk that code patches will cause new, unforeseen issues with core business systems. Virtual patching does not require the extensive, time-consuming and costly regression testing that must be performed across every instance and release level, and with each code patch being introduced into mission-critical production systems.
The Fall of Traditional Vendor Security Patching
Security professionals have found that traditional vendor security patching models are outdated and provide ineffective security protection due to late delivery of patches, complexity to apply patches and the expense of regression testing – leaving enterprise systems vulnerable for months, sometimes even years. In fact, many companies only apply security patches once per year – if at all – due to the significant downtime, labor and cost. With a half-life of vulnerabilities being less than 30 days, the majority of cyber-attacks happen before a patch is released by the database software vendor.1
According to the Aberdeen Group:2
- There is often a significant lag time between the public disclosure of a vulnerability and the availability of a patch from the vendor, which can leave many enterprise systems vulnerable for months.
- 42% of known database vulnerabilities are not addressed by vendor patching within a year.
- In addition to the delayed release of patches, the time required and business disruption created in applying vendor delivered security patches leads many organizations to delay or forgo altogether applying these patches.
- The cost involved to apply the patches to their database environment is also an inhibitor.
- Research data highlights that for a mid-size company with 100 database instances, the traditional vendor security patching model has a median business cost of around $4 million.
“The new Rimini Street Advanced Database Security – powered by McAfee product provides a holistic and highly effective level of security protection for database customers of any size in comparison to traditional vendor patching methodologies,” said Brian Day, president, Mercury Technology Group. “We are deploying this virtual patching capability on behalf of joint customers with Rimini Street, and we are impressed with the speed of protection and comprehensive coverage of this integrated database security solution.”
Rimini Street Global Security Services
As part of its robust support services, Rimini Street helps its clients identify, mitigate and protect against security risks and vulnerabilities, and achieve a more secure application and technical environment through strategic consultation, recommendations and partner solutions – such as the Rimini Street Advanced Database Security – powered by McAfee. Launched in 2015, Rimini Street Global Security Services (GSS) is a team of expert security engineers and architects led by Josh Sosnin. Mr. Sosnin has more than 15 years of global experience in information security and IT compliance, and holds various security and audit certifications, including CISSP, CISM, and CISA. Prior to joining Rimini Street, he served as Chief Information Security Officer (CISO) for Aramark (NYSE: ARMK), a $15 billion, Fortune 500 company with nearly 300,000 employees.
“Today, together with McAfee, we have delivered a comprehensive, cost-effective and advanced database security solution that moves past the weaknesses, challenges and pitfalls of traditional vendor security patching,” said Mr. Sosnin. “Rimini Street supports some of the largest companies in the world who are operating some of the most expansive and complex IT infrastructures globally – including thousands of database instances. In a world of evolving threats, we are committed to being at the forefront of innovative security strategies and solutions, such as holistic security and virtual patching, both of which are leveraged in our new Rimini Street Advanced Database Security – powered by McAfee.”
About Rimini Street, Inc.
Rimini Street is the global leader in providing independent enterprise software support services. The company has redefined enterprise support services since 2005 with an innovative, award-winning program that enables licensees of Oracle, SAP, IBM, Microsoft and other enterprise software vendors to save up to 90 percent on total support costs. Clients can remain on their current software release without any required upgrades for a minimum of 15 years. Nearly 1,300 global Fortune 500, midmarket, public sector and other organizations from a broad range of industries currently rely on Rimini Street as their trusted, independent support provider. To learn more, please visit http://www.riministreet.com, follow @riministreet on Twitter and find Rimini Street on Facebook and LinkedIn.
Forward-Looking Statements
This press release may contain forward-looking statements, including statements related to Rimini Street Advance Database Security – powered by McAfee and Rimini Street Global Security Services. The words “believe,” “may,” “will,” “plan,” “estimate,” “continue,” “anticipate,” “intend,” “expect,” and similar expressions are intended to identify forward-looking statements. These forward-looking statements are subject to risks and uncertainties, and are based on various assumptions. If the risks materialize or our assumptions prove incorrect, actual results could differ materially from the results implied by these forward-looking statements. Rimini Street assumes no obligation to update any forward-looking statements or information, which speak only as of the date of this press release.
© 2017 Rimini Street, Inc. All rights reserved. “Rimini Street” is a registered trademark of Rimini Street, Inc. in the United States and other countries, and Rimini Street, the Rimini Street logo, and combinations thereof, and other marks marked by TM are trademarks of Rimini Street, Inc. All other trademarks remain the property of their respective owners, and unless otherwise specified, Rimini Street claims no affiliation, endorsement, or association with any such trademark holder or other companies referenced herein.
McAfee and the McAfee logo are trademarks or registered trademarks of McAfee LLC or its subsidiaries in the United States and other countries.
1 Qualys Research, “The Laws of Vulnerabilities 2.0,” 2009
2 Aberdeen Group, “Beyond the Patch: Reducing the Risk of Database and Application Vulnerabilities,” October 2016 and Aberdeen Group, Virtual Patching and Database Security: An Effective Compensating Control, April 2013
