2KKUU7ita

Patch management
Chapter 17: Plugging Security Holes
If you can’t keep up with the deluge of security patches for all your systems,
don’t despair; you can still get a handle on the problem. Here are my basic
tenets for applying patches to keep your systems secure:
✓ Make sure all the people and departments that are involved in applying
patches on your organization’s systems are on the same page and follow
the same procedures.
✓ Have formal and documented procedures in place for these critical
processes:
• Obtaining patch alerts from your vendors, including third-party
patches for Adobe, Java, and so on, which are often overlooked
• Assessing which patches affect your systems
• Determining when to apply patches
✓ Make it policy and have a procedure in place for testing patches before
you apply them to your production workstations, and if possible, servers.
Testing patches after you apply them isn’t as big of a deal on workstations,
but servers are a different story. Many patches have “undocumented
features” and subsequent unintended side effects — believe me, I’ve
experienced this before. An untested patch is an invitation for system
(and job) termination!
Patch automation
The following sections describe the various patch deployment tools you can
use to lower the burden of constantly having to keep up with patches.
Commercial tools
I recommend a robust patch-automation application, especially if you have
these factors involved:
✓ A large network
✓ A network with several different operating systems (Windows, Linux,
and so on)
✓ A lot of third-party software applications, such as Adobe and Java
✓ More than a few dozen computers
327