| |||
|
|
||
|
|||
| |
|
Home > Security News > What's all the fuss about WSUS? |
| |
|
|
|
|
| Security News: |
|
||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Tom Kroll and Jeffrey Jarzabek are two IT managers with a different take on the newly-released Windows Server Update Services [WSUS]. Kroll thinks it'll be an improvement over Software Update Services (SUS) and is eager to use it. Jarzabek thinks SUS is good enough and sees no reason to switch now. Their views capture the wider discussion that has unfolded since WSUS came out last week. Some IT shops want to deploy it now, enticed by extra features that allow greater control over the patch management process. Others are taking the wait-and-see approach that followed last summer's SP2 release. They want to make sure it actually works before diving in. "I want to get on WSUS right away," said Kroll, network systems and security administrator for Chicago-based law firm Hinshaw & Culbertson. "There's no reporting in SUS. But from what I've seen and heard, WSUS reports which machines are patched and which ones are not. And with SUS, if I approve something it's out there. What do you do when you approve SP2 and you have a remote office of 25 machines with a partial T1? You'll kill the bandwidth. With WSUS, you can approve SP2 for one office and not another."
That's better than the all-or-nothing approach he sees as the hallmark of SUS. "With all or nothing, sometimes it's better going with nothing," he said. "The release of WSUS to manufacturing won't change anything here," said Jarzabek, IT director for Matocha Associates, an Oakbrook Terrace, Ill., firm specializing in architecture, engineering, general contracting and construction management. "We are using SUS and some other applications/processes and have patch management taken care of." It's not that he thinks WSUS is a waste of computer space. Jarzabek just thinks it's better suited for companies that never used SUS and are now looking for a patching solution. While Microsoft plans for WSUS to ultimately replace SUS, he's content to keep using the latter as long as it keeps functioning. "It is like buying last year's model off the lot while next year's models are being delivered," he said by e-mail. "If you don't need the latest car and yours gets you from point A to point B just fine, there is no need to get a new car. Had we not already had a great solution in place, we would be installing WSUS." Microsoft's patch management overhaul
On its Web site, the software giant describes WSUS as the successor to SUS, saying it'll let IT administrators deploy the latest Microsoft updates to Windows Server 2000 and 2003, and Windows XP operating systems. Microsoft said it builds on the features of SUS by providing:
Ready for a test spin
"A year ago MS [Microsoft] had six different ways to get patches and updates," he said by e-mail. "Now you can go to one place or an internal server to get updates for desktop OS [operating systems], Office applications, server OS, and server applications. That's nice and efficient."
Dick Davis, information systems director for Vista, Calif.-based Jif-Pak Manufacturing, said WSUS isn't the right fit for his operation at the moment. His is a Small Business Server 2003 environment. Of the company's 150 employees, only 42 need to use the computer network. But he plans to give it a try soon and start preparing for a possible future deployment. "Right now it makes more sense for me to install patches on individual desktops," he said. "Given the size of the operation it only takes me about three days each month and it gives me a chance to see how each machine is working and if users are downloading things that aren't allowed." But he anticipates the possibility that his company will grow and eventually need a more centralized, automated patching process. So he's interested in using WSUS to get familiar with it and be ready for the day he might need it. Proceeding with caution
"Metro doesn't trust the reliability of Microsoft patches and would not automatically install them," she said. "When Metro network analysts determine that a released patch is needed, it is first thoroughly tested. After it's tested and ready for installation, installation is postponed until users make a request for a problem correction or enhancement." Even those who are ready to try it are moving cautiously. Davis said he'll monitor other IT shops' experiences and let them work out the kinks first. "I'm going to let someone else test it," he said. "I don't have the luxury of a testing environment, so I'll watch to see how others fare by talking to other admins and keeping an eye on the message boards. I need to know it works before I deploy it."
|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||
|
|||||||||||||||||||||||||||
| |||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||
