Patch management: Filling security holes

Once you know the who, what and where of your systems, you'll be in a position to start assessing patches as they become available. Does the patch affect any of your computers? A buffer overrun in SNMP may be very serious, but only if SNMP is in use: it may be quicker, easier and more effective to make sure that you have disabled the service. Microsoft is finally moving to a model where services default to off when installed, but most of us are still running systems with unused yet active components. Locking down is cheaper and more effective than fixing up.

Controlled testing
When you have assessed that a patch is relevant and necessary, it should be deployed first in a controlled test. A common approach is to first release the patch to internal developers, who have the appropriate skills to check for problems that the patch may bring and are usually highly motivated to ensure the integrity of their systems. If the patch passes that test, then a limited deployment on a subset of live systems is a good next step -- if possible, with a check of any rollback procedure so that further problems with the patch can be reversed. Only then can the patch be considered as safe for universal application.

This process would seem ideal for patch management software, and there are many packages that promise to help. However, to date the situation is overly complex: Microsoft itself has around eight different patch management tools, not all of which agree with each other. The company is working towards integrating these tools into two or three main applications, and to further integrate these into its main system management software. But for now, patch managers have to consider Windows Update -- where the clients themselves detect and install patches -- alongside the Baseline Security Analyzer, Office Update, the Office Update Inventory Tool, and the Software Update Service (SUS) -- which lets managers check and control patch deployment by server. Lately, Microsoft has integrated SUS with its System Management Server 2003, which can automate patch roll-out, make patches mandatory after a specified period, and report on which users have been patched and which remain untouched.

Outside Microsoft, the patch management industry is serviced by a small group of companies. The tools they provide cover much more than just the Windows environment -- every large application and operating system needs similar care -- but none as yet is capable of coping with everything. Companies to investigate include BigFix, Ecora, Kintana, Novadigm, Shavlik Technologies, Patchlink and On Technology, and always consult your application and OS vendors for recommendations.

A serious business
Patch management is finally becoming recognised as a serious and important part of overall system management. Like so many aspects of IT, it has grown up in a haphazard fashion from the days of stand-alone PCs and tightly controlled centralised mainframes, but its true nature has been sharply illuminated by the evolution of the Internet. In the end, responsibility for making it work well is divided between vendors, users, managers and systems designers: now the tools are becoming available, it is up to those at the sharp end to evolve the processes and discipline required to use them sensibly and effectively.