Patch Management

Patch management is a careful process. It’d be reckless to deploy untested patches across your whole organization, so it’s often done with a test group beforehand.

A vulnerability scanner will highlight the need for patching automatically, but the reporting and deploying needs human intervention.

In this process, you’ll be able to structure your patch testing and deployment in a way that reduces the risk of error. It can also link into our scheduled maintenance process, so you can issue notifications of any expected disruptions.

Although this information can be collected manually, ideally an automated tool linked to a database should be used.

Make sure that the consequences of making changes to a system are fully understood and in any event, only implement changes one or two at a time and only on test systems first.

You can use a vulnerability scanning tool like Nessus to manage this step.

Depending on the importance of the systems and the priority of the vulnerabilities, scanning helps you decide which patches to apply where.

Store your scan report in the widget below to keep track of it.

Exactly how you create a backup of server config data varies based on the kind of server you’re running. Below you’ll find documentation for common options:

• Cisco Servers
• Tableau Servers
• Splunk Servers
• Windows Servers
• SQL Servers
• IBM Servers
• SME Servers

A test group is a limited number of users who receive patches before anybody else. This way, if anything goes wrong the damage is limited to just the test users. Test users should be technicians, or at least staff familiar with reporting bugs and finding errors.

Using the logs from your test group, create a summary of the patch results.

Check here (part one, part two) for a guide on generating a report for SCCM systems. Alternatively, here is a guide for managing configuring with Symantec.

Attach the summary below.

Use the scheduled maintenance notification process to make this easier by generating a report.

The best time to schedule patching is the early hours of the morning. Microsoft schedules updates for Tuesdays and even though there’s an (unscheduled) "Recall Thursday", it’s best to make patching a predictable and regular event.

Make sure to monitor the systems closely after roll-out.

• SANS – Practical Methodology for Implementing a Patch Management Process
• TechGenix – Patch or Not? Weighing the Risks of Immediate Updating