1. THE RISKS OF ‘NOT’ PATCHING… WWW.SBSDIVA.COM
The risks of Patching…
THE RISKS OF ‘NOT’ PATCHING…

2. Who am I? Patchaholic SBS MVP Security MVP
Been ‘patchin’ SBS’s since SBS 4.0
Used to squint when rebooting

3. So… what’s the first questions to ask?
What tool?
What patch engine?
What will break what?
Tool isn’t important
Process

4. What is a patch? Bug Flaw Something that needs fixing
Patch = Security patch

5. Why ‘should’ we patch? Worst case scenario
Fixing an issue where attacker from remote can hurt
Code Execution
Take control of system

6. Understanding the risks of patching
Worst case – Line of business stuff breaks
Best case – everything works
Typical patch month for your networks
What’s broken in the past for you?

7. What if you don’t patch?
What’s the worst thing that happens?
Well…..

8. Risks in a SBS network Server? Ports open? WORKSTATIONS
Local administrator
Download anything?
Free stuff?

9. History of risks in SBSland
Code Red
Nimda
Nail the server
Today?
Keep the system working
Borrow the bandwidth

10. Greatest risks? Review your networks Desktops If you nail the server?
If you nail a workstation?
How expendable?

11. How to determine what/when?
Read the bulletin
What’s the riskiest?
Read the criticality
From remote?
Mere surfing?

12. Win2k3 /XP sp2 Typical threats come from authenticated connections
Lesser risks to these platforms
A/V
Spyware
Safe surfing
IE 7 coming out soon

13. Windows 2000 Risks from anonymous connections From remote
Coded up exploits typically work

14. Window to patch Patch comes out at 10:00 a.m – 11:00 a.m Pacific
Reverse engineer the patch to see what it’s fixing
Determine issue
Code vulnerability
Typically within 20 minutes or so vulnerability is identified

15. Zero Days Vulnerability is out Used to exploit/to harm No patch
But does that mean we are unprotected?

16. Window to patch Can it be automated? Can it be “wormable”
What’s “Metasploit”?

17. Recent issues Focusing more on workstations
Focusing more on applications
Less on servers

18. When to patch? Do we have to do servers as soon as possible?
Where’s our biggest risk of patching?
What’s hurt in the past?
Build an “ouch” database for your clients’ applications

19. When to patch? If we’ve mitigated already?
Why do we need to patch now?
Mitigate, patch later?

20. Now that we will patch Will it hurt? Check the caveat section
Review the community
Google on the KB number
Review the Windows update newsgroup
“Are you seeing?”

21. How/what to test? Microsoft performs patch testing
Don’t test the “basics”
Identify the clients’ key applications
Identify a “patch canary”

22. Patch gets approved Tested on one workstation Done your research?
NOW deploy

23. Deploy with?
WSUS
SBS 2003 r2
Shavlik
Patchlink
Other?

24. ..but what about non MS? Adobe Flash Firefox Sun Java
Even your antivirus

25. Tuesday’s patches
…. To come…