Strategies for automatic patch management

Computerworld - If the onslaught of Trojan horses, worms and viruses has taught us anything, it's that software patches are as vital to network security as virus updates. The infamous Blaster worm and the more recent Scob Trojan are just two examples of attacks that could have been easily avoided with timely and accurate application of software updates.
Patch management is one of many critical IT management tasks, which is why busy IT departments look to automation for relief. But what's the best approach to automated patch management? The answer depends on your network's infrastructure and design, both current and future.
The many third-party solutions available today generally break down into two major categories: stand-alone patch management utilities and patch management capabilities integrated into larger enterprise management systems. Each has its advantages and disadvantages. By understanding the pluses and minuses of each class of solution, IT administrators can choose the patch management alternative that fits their environment, their budget and their overall administrative approach.
Patch management utilities
Patch management utilities are available from a number of independent software vendors, including BigFix Inc., Shavlik Technologies LLC, PatchLink Corp. and Microsoft Corp. Most have incorporated a wealth of functionality as the market for patch management solutions has grown. However, because utility products evolve outside of a more comprehensive management framework, they are only point solutions, lacking true integration with a comprehensive management system.
An example of this type of solution is Microsoft's Software Update Services (SUS), which leverages the built-in Automatic Updates service supporting Windows 2000 Service Pack 2 and above. This product is a free add-on to Internet Information Server but doesn't provide integration with management technologies.
The monolithic architecture of SUS is largely an artifact of its origins as a Microsoft Web service packaged for enterprise use. SUS is getting some much-needed improvements in the next major upgrade, called Windows Update Services; however, the bulk of these improvements are in the area of broader patch coverage and improved patches, not in the fundamental architecture.
Utilities, especially when multiple point solutions are implemented for various management tasks, have the drawback of causing redundant management activity. For example, point solutions implement unique management consoles and reporting systems, many distribute services to workstations, and each has its own requirements for network communication. Point solutions can offer the benefits of a quicker implementation than full-blown enterprise management systems, at a reduced purchase price. However, this short-term gain may result in unforeseen longer-term costs.
Enterprise management systems
Patch management is now recognized as a persistent issue that