Guide to Patch and Vulnerability Management

Wednesday, May 14, 2008 12:00 PM PDT

Patch management best practices

by Network World Staff

Create an enterprise group responsible for identifying, testing and executing patches. Members should include people from the security team and daily operations. The team should include patches in an overall change-management workflow so that less critical patches will not wait long to be tested and deployed. Such patches will instead be rolled out on a similar schedule as other upgrades, feature changes and the like.
Use a phased approach to applying live patches. First apply them to a small test group of users before a universal patch. When working with the small test group, reboot after each patch, rather than after the entire set of patches, to help identify which patch may be troublesome.
Standardize IT configurations wherever possible. Obviously, though, no one has a completely standardized IT infrastructure. So in your test group for live patches be sure to include a sample for each typical configuration that you will routinely ask the patch management product to update.
Include a measurement phase after each patch is implemented. This should measure current levels of susceptibility to attack, but should also document the time needed for patching and the cost for patching. This will help you make informed future business decisions on the patching process.
Automate the patch management process as much as possible.

Sponsored Resource:Are you ready for virtualization? Try the sever assessment tool.
Sponsored Resource:Learn more about ultra light notebooks from Asus and the best warranty in the industry.
Sponsored Resource:Thinking about a new Laptop? Lenovo has models to meet everyone's needs.
Sponsored Resource:Get the truth about remanufactured ink. Learn more from HP.
Sponsored Resource:Six smart ways to grow small business IT

Security - August 28, 2008
European Court Won't Stop UK Hacker's Extradition to US The European Court of Human Rights has refused U.K. hacker Gary McKinnon's appeal against demands for his extradition to the...
Security - August 27, 2008
Nortel Uses USB Drive to Secure Remote Work Nortel hopes to tackle the security of remote work with an "office on a stick," a USB drive for VPN sessions.
Email / Instant Messaging - August 27, 2008
Four Quick Tips for Choosing an IM Security Product Four simple steps from a Forrester analyst can help your company choose the best instant messaging security product for its needs--from plugging data leaks for compliance and preventing IP theft to virus scanning and preventing SpIM.
Data Protection - August 27, 2008
Social Security Numbers Can Be Posted Online Virginia can't prevent dissemination of personal data readily available from its own Web sites.

Glenn Fleishman on Hardware - August 15, 2008 10:11 AM
Wake Me When You Need Me, Says Intel Intel's Remote Wake lets a computer listen intelligently for a signal to rouse from sleep mode and carry out an activity.
Neil McAllister on Software - August 19, 2008 6:04 PM
Microsoft Sends Up Trial Balloons for Windows 7 While Vista takes a beating in the press, Microsoft seems increasingly willing to disclose details of its forthcoming OS.
Erik Larkin on the Web - August 27, 2008 2:28 PM
Olympic Gold Medalist Gives Props to Google Earth Kristin Armstrong, a U.S. Olympic Cyclist, credited Google Earth with helping her to find the ideal training route.

Premier Content From Our Sponsors

HP Ink Center You don't need a big budget to produce high quality marketing materials. Click here for more info...
CDW Virtualization Center What is Virtualization and how can it help you save money? Click here for more info...