Testing patches prior to deployment is a major roadblock to full automation. And if you have complex, heterogeneous...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
systems, it will lengthen the testing process because it will take longer to test the patches in a variety of systems' configurations. Vendor patches can contain errors that require yet another patch to fully fix the problem, so it is essential that you adhere to strict validation and testing and document risk assessments prior to deployment when possible. You may have to compromise this practice, however, when the risk of an attack is deemed to outweigh the risk of system downtime. Remember, part of the patch management process involves ensuring that they are properly installed and monitoring that they are working as expected. Deploying patches to remote users can be a real headache because they may not be connected at the time of deployment. This can leave a network vulnerable if a laptop connects to the network after being infected by other sources.
Microsoft realized there were problems associated with keeping systems patched and up-to-date and revamped their Software Update Services, now calling it Windows Update Services. Now their Systems Management Server 2003 offers advanced patch deployment, reporting and compliance-enforcement features. There are also a wide variety of third-party patch management solutions. These are either scanner-based or agent-based, which install small programs on each computer to periodically poll a patch database for new updates, giving the administrator the option of applying the patch. Although agent-based solutions require set up work to integrate agents into workstations and servers, they are better-suited to large organizations than scanner-based solutions as they generate less network traffic and provide a real-time network view. I would recommend using at least one management solution along with strict policy rules in order to be able to role out patches in a reasonable time frame.
Finally, you may be interested in a paper titled, Timing the Application of Security Patches for Optimal Uptime by WireX Communications and Zero Knowledge Systems, which tries to factor in the problem of glitches in new patches while calculating the ideal time to apply patches after their release. According to their model, after 10-30 days is the ideal time.
Dig Deeper on Microsoft Patch Tuesday and patch management
Related Q&A from Michael Cobb
A technique known as the GhostHook attack can get around PatchGuard, but Microsoft hasn't patched the flaw. Expert Michael Cobb explains why, as well...continue reading
Software developed by the hacking group Platinum takes advantage of Intel AMT to bypass the built-in Windows firewall. Expert Michael Cobb explains ...continue reading
Tensions between the U.S. and Russia have led to source code reviews on security products, but the process isn't new. Expert Michael Cobb explains ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.