How, What, and When to Patch

How an enterprise decides to manage patch administration probably varies based on who is doing it, the maturity of the Vulnerability Management program, and the business’ tolerance of maintenance windows.  In my opinion patching should be broken into four categories:

(1)  Infrastructure.  This would be servers, devices, applications that are used by IT and can be patched with no impact to business users or business processes.   This patching can be accomplished as often as necessary, but monthly will probably work out the best.

(2)  Servers / Operating Systems.  This category includes the Windows and / or Linux servers in the environment.  This is where IT management needs to get a recurring maintenance window from the business that is always available for IT to use whether it is needed or not.   In my humble opinion this window should be available weekly.   While we are probably not going to patch weekly, this windows can be used to fix application problems, apply emergency / critical patches, etc…   Server patching probably can’t be performed more that quarterly because you will need time to test patches in the non-prod environment.

(3)  Applications.   This category includes business applications such as ERP systems, HR systems, etc…   These systems should be patched during the maintenance window arranged by IT management above.  How often this patching occurs will depend on the business’ desire because it will take good amount of resources to test the patches and identify any impacts on systems that may feed or receive data from the patched system.   Twice a year maybe the best case scenario; once a year maybe the answer the schedule that works best for the business.

(4)  Workstations.  This is where the biggest risk may be located for the enterprise.  While the endpoint security (anti-virus, anti-malware, etc…) should be updating daily, OS patching should be applied monthly.  If a standard desktop image is used, testing should be pretty straightforward and a reboot by users once a month isn’t to much to ask.

No matter what schedule an enterprise decides on, the key is management buy-in and communications to the user community.   Once the schedule is set, stick to it and only deviate in rare and unique situations.

Until next time…

~Skeeter