Testing patches prior to deployment is a major roadblock to full automation. And if you have complex, heterogeneous...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
systems, it will lengthen the testing process because it will take longer to test the patches in a variety of systems' configurations. Vendor patches can contain errors that require yet another patch to fully fix the problem, so it is essential that you adhere to strict validation and testing and document risk assessments prior to deployment when possible. You may have to compromise this practice, however, when the risk of an attack is deemed to outweigh the risk of system downtime. Remember, part of the patch management process involves ensuring that they are properly installed and monitoring that they are working as expected. Deploying patches to remote users can be a real headache because they may not be connected at the time of deployment. This can leave a network vulnerable if a laptop connects to the network after being infected by other sources.
Microsoft realized there were problems associated with keeping systems patched and up-to-date and revamped their Software Update Services, now calling it Windows Update Services. Now their Systems Management Server 2003 offers advanced patch deployment, reporting and compliance-enforcement features. There are also a wide variety of third-party patch management solutions. These are either scanner-based or agent-based, which install small programs on each computer to periodically poll a patch database for new updates, giving the administrator the option of applying the patch. Although agent-based solutions require set up work to integrate agents into workstations and servers, they are better-suited to large organizations than scanner-based solutions as they generate less network traffic and provide a real-time network view. I would recommend using at least one management solution along with strict policy rules in order to be able to role out patches in a reasonable time frame.
Finally, you may be interested in a paper titled, Timing the Application of Security Patches for Optimal Uptime by WireX Communications and Zero Knowledge Systems, which tries to factor in the problem of glitches in new patches while calculating the ideal time to apply patches after their release. According to their model, after 10-30 days is the ideal time.
Dig Deeper on Security patch management and Windows Patch Tuesday news
Related Q&A from Michael Cobb
Attackers using crafted TIFF images can exploit flaws in the LibTIFF library to carry out remote code execution. Expert Michael Cobb explains how ...continue reading
Companies and government agencies handling criminal justice information need to comply with CJIS Security Policy. Expert Michael Cobb explains the ...continue reading
An Intel chip flaw lets attackers bypass ASLR protection on most operating systems. Expert Michael Cobb explains the vulnerability and how to prevent...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.