Improving Web Application Security: Threats and - CGISecurity

How To:Implement Patch ManagementApplies ToThis information applies to server or workstation computers that run the following:● Microsoft ® Windows ® 2000SummaryThis How To explains patch management, including how to keep single or multipleservers up to date. Additional software is not required, except for the tools availablefor download from Microsoft.Operations and security policy should adopt a patch management process. This HowTo defines the processes required to create a sound patch management system. Thepatch management process can be automated using the guidance in this How To.What You Must KnowBefore using this How To, you should be aware of the following issues andconsiderations.The Patch Management ProcessPatch management is a circular process and must be ongoing. The unfortunate realityabout software vulnerabilities is that, after you apply a patch today, a newvulnerability must be addressed tomorrow.Develop and automate a patch management process that includes each of thefollowing:● Detect. Use tools to scan your systems for missing security patches. The detectionshould be automated and will trigger the patch management process.● Assess. If necessary updates are not installed, determine the severity of theissue(s) addressed by the patch and the mitigating factors that may influence yourdecision. By balancing the severity of the issue and mitigating factors, you candetermine if the vulnerabilities are a threat to your current environment.