-: What is patch management?
Patch management is the planning, testing,
implementing, and auditing of software patches.
Why is patch management so important?
Well, there are a lot of patches out there.
Each manufacturer is going to create
their own patches for their own applications.
Part of patch management is keeping track of all
of the various updates and ensuring that they get installed
properly throughout your environment.
But it's also important to have a patch management system
in place to ensure that a patch that is designed
to fix one problem doesn't create multiple,
new problems for you as well.
After all, patches can have bugs in them too.
There are four steps to patch management.
Planning, testing, implementing, and auditing.
Planning consists of creating policies, procedures,
and systems to track available patches and updates,
and a method to verify that they
are compatible with your systems.
Planning is also used to determine
how you're going to test and deploy each patch.
Microsoft actually provides a useful tool
that can help us in determining the status of our system,
and whether or not a patch needs to be applied.
This is known as the
Microsoft Baseline Security Analyzer or MBSA.
This tool can help identify security misconfigurations
within your network's workstations.
After planning, the next thing is testing.
It's important to test any patch you receive prior
to automating its deployment throughout the network.
As I said before, while a patch is designed
to solve one problem, it can often create new ones for you.
Within your organization, you should have
a small test network or lab or, at the very least,
a single machine that you use for testing
where you deploy the patch first
and ensure it's working properly.
After all, many of our organizations
have unique configurations within our networks.
And while manufacturers attempt to ensure patches will not
cause harm to our systems, this can't be guaranteed.
It's better to find out in your lab
that a patch is causing issues
than to push it out across 10,000 workstations
and then have all your end users yelling and screaming
when their systems crashed.
After testing the patch, it's time to deploy it
to all of the workstations that might require it.
You can do this manually or automatically
by deploying that patch to your
clients' workstations to implement it.
If you have a small network, you may choose
to manually install the patch across the network.
If you have a large network, though,
you're going to want to use some sort of a tool.
Microsoft provides us with the
Microsoft System Center Configuration Manager,
but you can use third-party patch management tools as well.
Some organizations rely on automatic updates
from the Windows Update system,
while others decide they want to have complete control
over the installation of patches.
For large organizations, it is highly recommended
to centrally manage updates through an update server
instead of using the Windows Update tool.
This will allow you to test the patch prior
to deploying it in your environment.
To disable Windows Update,
you simply need to disable the Windows Update service
from running automatically on the workstation.
The Windows Update service is called wuauserv
in the list of running services.
Find that and disable it.
If you have a lot of mobile devices
throughout your network, you should also implement patching
through your mobile device manager.
The final step is auditing.
It's important for us to audit the client status
after conducting the patch deployment.
Auditing is used to ensure the patch
was installed properly and that there's no
unexpected failures that have occurred
because of our installation.
Again, using a tool like the
System Center Configuration Manager
or a third-party management tool
to conduct scanning and verification
of your workstations can help ensure
that those patches have been installed properly.
If you're using Linux or OSX,
they also have built-in patch management systems.
For example, Red Hat Linux uses a package manager
to deploy RPMs or packages of patches
to your servers and workstations.