Shavlik and the mound of FUD

I would like to nominate Mary Landesman and Shavlik for the "Quality FUD" award, for their paper entitled Security Patch Management: Breaking New Ground. The subtitle is "A discussion of agent and agentless technology", although how this relates to the title is beyond me.

In this eight page paper with precisely five references (of which one, while using the word 'agent' is clearly referring to autonomous semantic-web based agents and not client/server architecture agents) she manages to make a plethora of unsubstantiated claims plainly meant to sell Shavlik's agentless technology. Her main ploy is to make it sound like installing agents to every machine is hard work, and so having to do that every time there is a patch emergency would be bad. Of course you only need to install them once, but lets not confuse 'facts' with the truth. She doesn't seem to realise that if her Shavlik software can deploy executable patch content it could probably deploy agents too, *sssh* don't tell.

This isn't a bash at Shavlik software or an endorsement of agent based solutions. She even quotes her CEO as saying he thinks the whole debate is a "red herring", I prefer the term "a load of crap". If you are logging into a box remotely with administrator rights, then you aren't doing much different from an agent, the code just happens to be transmitted every time instead of stored locally.

I wonder how many morons they fool with this faux-academic ninja-marketing technique?

Posted by Dominic White