Five tips for effective patch management
July 14, 2003 (Computerworld) --
According to data from the FBI and Carnegie Mellon University, more than 90% of all security breaches involve a software vulnerability caused by a missing patch that the IT department already knows about. Even the SQL Slammer worm, which caused IT managers across the globe plenty of headaches, could have been avoided if a patch that was available six months earlier had been applied. Just ask the Bank of America and the U.S. departments of Defense and Energy, among many others, about the pain it caused.
If IT departments know about these risks ahead of time, why do these vulnerabilities exist? It's because the manual process of patching the thousands of workstations and servers in their environments is nearly impossible. Gartner estimates that IT managers now spend up to two hours every day managing patches. And when Microsoft alone issues a new security patch about every fifth day, how can anyone keep up?
Although IT managers fully understand the need to patch their systems (servers, workstations and desktops), the tediousness, staff dedication and deployment risks can affect when and how often systems get patched. Having some systems patched while others aren't can lead to an unstable and unsecured IT infrastructure.
Organizations are quickly finding that automating the enterprisewide patch analysis and remediation process is the only way to tackle this issue and provide a standardized patch environment.
Here are five tips to practicing effective patch management:
- Automate. These days, IT managers are expected to do more with less. Patch management is time-consuming. With an automated system, analyzing and deploying patches can be as easy as clicking a mouse from a single workstation and can provide a significant time savings.
- Plan your approach. Even with automated systems, you should plan out your approach to patch management. Group systems by department, location, etc., to get a better handle on your environment and to more productively manage patches.
- Test patches. Don't just push out patches before testing them. All patches should be thoroughly lab-tested. Even though patching is necessary to securing the IT infrastructure, patches can cause problems if not applied properly.
- Know the configurations. One configuration difference between your lab server and production server, even at the most minute level, can cause a server to fail. By making sure your production servers' configuration settings are standardized with your test lab server, you should have the confidence to deploy the patch.
- Maintain patch levels. With automation, patch management no longer needs to be a reactive process. Be proactive: Schedule scans on a daily or weekly basis to analyze the environment and deploy all critical patches. An environment that's up to date on current patches is more secure and stable.
Tips From Security Experts
Stories in this report:

|
|
|
"Yes, NASA has confirmed that some laptops taken to the International Space Station were infected with an online-gaming password stealing..."
Read more...
"Linux is more secure than most operating systems, but Not if you don't practice basic security measures..."
Read more...
Read more Security posts or See all Blogs
|
Telework can change office dynamics in ways you hadn't anticipated. Proceed cautiously.
Got a painfully slow connection or random dead spots? Our tips will help you get the most out of your wireless network.
Listen up, managers: Employees don't quit the job; they quit you.
Netbooks, ultraportables, mini-notebooks whatever you call them, they've been grabbing headlines. Are they here for the long term or just a flash in the pan?
Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS.
Four years from now, the IT field will be a vastly different place. Will you be ready?
|
 |
| From Laggard to Leader: Transforming the Data Center From Laggard to Leader: Transforming the Data Center Register for this complimentary live webcast today! Go to the webcast |
|
| Computerworld Executive Bulletin: Building a Robust Antivirus Defense Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. (Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more. Download this executive briefing |
|
| Online Security Issues in Regulated Industries Download this research paper, free for a limited time, compliments of Webroot! (Source: Webroot Software) In June 2008, Computerworld invited IT and business leaders to participate in a survey on online security initiatives at their organizations. The goal of the survey was to better understand Web and e-mail security issues faced today within the regulated education, financial services, government and health care industries. The following report represents top-line results of that survey. Download this white paper |
|
| White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. | View more whitepapers |
|
|