1. Security Patching

2. Benefits of Security Patching
Mitigates software vulnerabilities, reducing risk of system exploitation
Maintains software and systems at vendor baseline, reducing future performance issues
Reduces risk of theft of Sensitive information (e.g., personal, proprietary, controlled)
Reduces risk of malware injection into proprietary products
Important part of system and software maintenance

3. Know Which Security Patches are Needed
Identify Operating System and applications by version on the network
Use vendor proprietary tools to identify systems that require patches
Sign-up with vendors for notification of new security patches for specific versions in use - eliminates wasted labor reviewing patch advisories for versions not in use
Purchase a security service that tracks and sends vulnerability alerts for security patches released by vendors – includes risk data for SLA decisions:
Ex:
Sign-up with cyber-security organizations to receive vulnerability newsletters
Ex:
Ex:
Monitor cyber-security websites that discuss vulnerabilities
Ex:
Ex:

4. Use Automation to Test & Deploy Patches
System Center Configuration Manager (SCCM)
Use to deploy Microsoft and other vendor security patches
Use to identify applicable systems – target list
Use to generate compliance reports on patched percent
Vendor proprietary automation tool to identify and patch systems using enterprise admin console & agent on systems
SCCM – Microsoft:
Red Hat Satellite Server
Deploy patches to test development group/s – identify groups for specific products
If no issues, approve PRODUCTION patch deployment across the network

5. Company Policy & Communications
Identify standard security patching schedules so internal customers can plan work around patching tasks
High risk vulnerabilities – test immediately and patch once testing is complete
Via announcements, make employees aware of security patching prior to patch deployment
Let employees know whether patching will require reboot of system
Coordinate patching of servers with server stakeholders