Security Patching

Benefits of Security Patching Mitigates software vulnerabilities, reducing risk of system exploitation Maintains software and systems at vendor baseline, reducing future performance issues Reduces risk of theft of Sensitive information (e.g., personal, proprietary, controlled) Reduces risk of malware injection into proprietary products Important part of system and software maintenance

Know Which Security Patches are Needed Identify Operating System and applications by version on the network Use vendor proprietary tools to identify systems that require patches Sign-up with vendors for notification of new security patches for specific versions in use - eliminates wasted labor reviewing patch advisories for versions not in use Purchase a security service that tracks and sends vulnerability alerts for security patches released by vendors – includes risk data for SLA decisions: Ex: https://www.riskbasedsecurity.com/ Sign-up with cyber-security organizations to receive vulnerability newsletters Ex: https://www.sans.org/newsletters/at-risk Ex: https://www.us-cert.gov/ncas/alerts Monitor cyber-security websites that discuss vulnerabilities Ex: https://nvd.nist.gov/ Ex: https://cve.mitre.org/

Use Automation to Test & Deploy Patches System Center Configuration Manager (SCCM) Use to deploy Microsoft and other vendor security patches Use to identify applicable systems – target list Use to generate compliance reports on patched percent Vendor proprietary automation tool to identify and patch systems using enterprise admin console & agent on systems SCCM – Microsoft: https://www.microsoft.com/en-us/cloud-platform/system-center-configuration-manager Red Hat Satellite Server https://access.redhat.com/products/red-hat-satellite Deploy patches to test development group/s – identify groups for specific products If no issues, approve PRODUCTION patch deployment across the network

Company Policy & Communications Identify standard security patching schedules so internal customers can plan work around patching tasks High risk vulnerabilities – test immediately and patch once testing is complete Via announcements, make employees aware of security patching prior to patch deployment Let employees know whether patching will require reboot of system Coordinate patching of servers with server stakeholders