For a federal government agency, simply relying on Microsoft's System Center Configuration Manager (SCCM) for patch management is not enough to guarantee network security. Threats are equally — if not more — prevalent through third party (non-Microsoft) applications, such as Adobe, Apple or Java. In fact, according to reports from the National Vulnerability Database, 9 of the top 10 threats in 2010 were not Microsoft applications, but applications from Apple, Adobe and Google. Apple Safari had the highest number of vulnerabilities, followed by Mozilla Firefox and Google Chrome. Other third party applications that ranked within the Top 10 in terms of security flaws included Adobe Flash Player, Reader, Acrobat and Air, as well as Java Runtime and Mozilla SeaMonkey.
To ensure that all network endpoints are appropriately patched in a timely manner and that compliance guidelines are met, federal government agencies must find a way to expand their patching of third party applications. This is no easy feat, considering that agencies today are faced with tighter budgets and are being required to do more with less. This paper will look at ways federal government agencies can maintain a strong and effective patch management program by seamlessly integrating third party patch management solutions into existing SCCM infrastructure and can be rest assured that all applications in use by their employees — Microsoft, Microsoft legacy and third party applications alike — will not expose critical government networks to security breaches.