By Morten R. Stengaard, CTO
Secunia was founded in 2002 as a vulnerability research house and over time we built a reputation as a reliable vulnerability intelligence provider. Our vulnerability intelligence also provides the foundation for all of our products. In the early years, we did our in-house vulnerability research and we scanned systems to determine how many and which vulnerable programs were on them. We then presented our customers with an overview of the vulnerabilities we discovered in their environments.
We acquired a loyal customer base among large enterprise customers, but we continued to see that they were facing challenges to implement the remediation of those vulnerabilities. Outside of our customer base - and across multiple industries and organization sizes - the challenges were the same: What should be done with the large amounts of information derived from vulnerability assessment?
That was a strong point: It's one thing to know your system is at risk. But it is an entirely different thing to understand what to do about it and how to get the job done.
Rather than building our own patch deployment tool from scratch, we believed that it would make greater sense to develop a patch management solution that enabled customers, who needed our vulnerability intelligence and scanning technology, to integrate these with their preferred client management solution. Consequently, we developed the integration with Microsoft WSUS and later on, we built an SDK (Software Developer Kit) to enable IT teams to build their own patch management integration to match their existing solution, from vendors like Microsoft, with their environment.
We were pioneering the concept (and practice) of closing the gap between vulnerability assessment and remediation beyond the ineffective ticketing systems!
For a growing number of organizations, the patch deployment solution of choice is a Microsoft solution. And early on, we decided to work to make Secunia part of the Microsoft ecosystem, focusing our efforts on developing a solution that worked well with Microsoft products. In 2010, we introduced the first deployment integration between the Secunia Corporate Software Inspector (CSI) and Microsoft WSUS, allowing users to silently and easily deploy third-party (non-Microsoft) security updates with Microsoft WSUS/System Center Configuration Manager.
Since this first generation integration, we have continuously been in dialogue with our loyal users, customers and partners about how to provide further integration and how to get even more value out of the two solutions when used in combination with each other.
When Microsoft started rolling out the System Center 2012 Configuration Manager, it became a key driver for our development team to enhance the user experience for organizations using the Microsoft System Center Configuration Manager for patch deployment, and making those infrastructures more secure.
Today, the Secunia CSI integrates seamlessly with Microsoft WSUS, System Center 2012 Configuration Manager and System Center Configuration Manager 2007. The latest iteration of the Secunia and Microsoft technology match is the Secunia SC2012 plugin, which allows users of System Center 2012 Configuration Manager to do all of their third-party patching directly from the System Center 2012 console.
The result of our focus on developing solutions to match Microsoft products is that, today, we are an established Microsoft partner.
- We are a member of the Microsoft System Center Alliance, an ecosystem of vendors providing solutions and services that enable Windows operating systems to be a more flexible and better performing platform, by allowing vendors to be used together with Windows.
- We are the first vulnerability security partner in the Microsoft Technology Center Program, which means that Microsoft customers are able to test our complete patch management solution, the Secunia CSI, live at Microsoft Technology Centers around the world.
- We regularly present our solutions at Microsoft's System Center User Groups.
- We work closely with Microsoft MVPs like Kent Agerlund, Raphael Perez, and Chris Nackers to stay up to speed with the needs and requirements of the Microsoft System Center Configuration Manager community.
We are very glad that we chose the Microsoft path. Microsoft's System Center solutions continue to gain market share, and are being diligently maintained and developed. But having an effective third-party solution in place to fill the patch management gap in the System Center Configuration Manager has never been more important. This is because the threat from third-party vulnerabilities to IT environments continues to increase: since 2007, the share of vulnerabilities in third-party software has increased by 52%, and in 2012 the share of third-party vulnerabilities was 86% in the 50 most popular programs, according to the Secunia Vulnerability Review 2013.
By following the evolvement of Microsoft's solution we ensure that Secunia's complete patch management solution is perfectly suited to the requirements of Configuration Manager administrators; thereby delivering the optimal third-party patch management solution to all the organizations relying on the System Center Configuration Manager to keep their infrastructures running smoothly, and their security intact.
Morten R. Stengaard, Secunia CTO
Gartner's report, “Complementary Solutions for Microsoft System Center 2012 Configuration Manager” explains why organizations need a third-party solution to improve desktop application patch management in Microsoft's Configuration Manager.