Unpatched PC survival time in 16 minutes

The average unpatched Windows PC lasts less than 20 minutes on the internet before it's compromised, according to data from the Internet Storm Center.

Part of the SANS Institute, the Storm Center calculated the average 'life span' of an unpatched, unprotected PC by listening to IP addresses and tallying the number of probes run against them.

"If you are assuming that most of these reports are generated by worms that attempt to propagate, an unpatched system would be infected by such a probe," the Storm Center said in a statement.

In June 2003, the 'survival time' of an unpatched PC was approximately 40 minutes. Yesterday, the average was found to be less than half that: only 16 minutes.

Some systems, naturally, will have longer or shorter life spans. Users whose ISPs block ports typically used by popular worms report a much longer survival time, said the Center, while users of high speed services are often specifically targeted by bot networks sniffing for broadband-connected PCs to compromise and turn into spam or denial-of-service platforms.

"The main issue here is of course that the time to download critical patches will exceed this survival time," said the Internet Storm Center.

The under-20 minute period isn't long enough to pull down major updates, such as Windows XP Service Pack 2 (SP2), acknowledged Joe Wilcox, an analyst with Jupiter Research, in an online posting.

Wilcox recommended reading the Internet Storm Center's guide, "Windows XP: Surviving the First Day," which details how to enable Windows' firewall before connecting to the internet.

"Don't connect an unpatched PC to the internet without enabling some kind of firewall," Wilcox wrote. "For some consumers and small businesses without technical know-how, the only option might be patching the system via Automatic Update and then running anti-virus software to remove any worms or trojan horses."

Microsoft's Automatic Update started feeding Windows XP Home Edition users the beefy -- more than 80MB -- SP2 update this week. Users without a third party firewall can protect their PCs by enabling the integrated firewall within Windows.