1. What is patch management and how does it work?

2. Why is patch management important?

3. Patch management step-by-step

4. Patch management best practices

5. Patch management policy

6. Getting started using patch management software tools

7. GFI LanGuard customer stories

What is patch management and how does it work?

Patch management consists of scanning computers, mobile devices or other machines on a network for missing software updates, known as “patches” and fixing the problem by deploying those patches as soon as they become available. Patches are a type of code that is inserted (or patched) into the code of an existing software program. It is typically a stop-gap measure until a new full release of the software becomes available.

• Patches are created by software companies when they know of an existing vulnerability and ensure that hackers don’t use that vulnerability to break into your corporate network.

• In patch management, an individual team or an automated software determines which tools need patches and when fixes need to be made. Many times, installation can be done to a central administrative computer and be reflected across all other devices. In some cases, patches have to be installed separately on different devices – especially if the patches are for software installed only on a few computers.

• Patch management also involves determining which patches are essential and when they should be installed on a system.

• Patch management acquires, tests and installs multiple code changes to administered computer systems to keep them updated. The process also determines the appropriate patches for each software program and schedules the installation of the patches across different systems.

• Patches are necessary to ensure that the systems are fixed, up to date and protected against security vulnerabilities and bugs that were present in the software. Failure to patch makes a network doubly vulnerable – not only is the vulnerability there, but it has now also been publicized, making it more likely to be exploited by malicious users, hackers and virus writers.

Why is patch management important?

Proper patch management can greatly improve an enterprise’s security by addressing the vulnerabilities in its software and operating systems. Here are a few reasons why patch management is a critical expenditure in almost any IT budget:

• Security
  Security is the most critical benefit of patch management. Network security breaches are most commonly caused by missing patches in operating systems and other applications. Comprehensive patch management can guard against vulnerabilities across different platforms and operating systems – including Microsoft®, MAC OS X® and Linux® operating systems, Amazon Web Services (AWS), other cloud platforms – as well as third-party applications.

• BYOD
  The emergence of “bring your own device,” or BYOD, has opened up a whole new avenue of opportunities for cyber-attackers. Employees increasingly use their personal and office devices interchangeably to do their work – requiring personal devices to be protected as well. A good patch management software installs patches across all devices, regardless of their physical location. In the process, it addresses many of the challenges that come with using personal devices.

• Productivity
  Computer crashes due to defective software can still happen and this eventually leads to lower productivity levels. A patch, on the other hand, reduces the possibility of crashes and downtime, thereby allowing workers to do their tasks without interruptions.

• Compliance
  Cyberthreats have become commonplace and this is why regulatory bodies are mandating that businesses apply the latest patches to avoid these threats. Noncompliance can lead to stiff penalties, so a good patch management strategy is necessary to comply with these standards.

• Feature updates
  Patches are not always about fixing bugs. They can also include new features and functionality that can tap into the latest innovations of the software. Companies are constantly working on new features and sending new functionality in the form of patches, so downloading and installing them can help you work better and smarter.

• Perspective about the business environment
  Patch management can provide an overview of your current business environment. Many times, vendors stop sending patches for their software because they are working on the next version, or the company has gone out of business and is not producing bug fixes. It’s wise to stop using software that no longer has technical support. Patch management helps to identify such software, so you know when to change to new software.

Patch management step-by-step

Installing the latest updates is not the most effective process of patch management. In fact, every tool should follow a detailed set of steps to ensure that the end result is economical, efficient and effective.

Here are some keys steps to developing an up-to-date inventory of the existing devices:

1. Create a patch management policy.

2. Scan the network and devices on a regular basis to identify vulnerabilities and missing patches.

3. Validate the successful deployment of the downloaded patches in a testing environment and check for any incompatibilities or performance issues.

4. Apply the patch across the entire organization, if no issues were uncovered during the testing phase.

5. Create detailed documentation and reports about patch download, testing and installation for auditing and compliance.

Though these steps may vary, the larger point is the updates should not be installed as they become available. Instead, they should go through a process laid down by the organization. Such a process-oriented approach will also make it easy to follow some of the best practices of patch management.

Patch management best practices

Patch management is typically high on an administrator’s to-do list. If done incorrectly patch management can be a risk for the organization instead of a risk mitigator. A few simple best practices however easily eliminate all of these risks as well as ensure that the process is finished quickly and efficiently.

Here are some best practices for patch management to help an organization enhance its security and to stay updated on all the latest additions made to any software:

• Know why you’re doing it
  Patch management is an essential part of the software world and it is important for the management as well as the admin team to understand its benefits for the organization as a whole. Communicating the essential nature of patch management will help to make it an integral part of IT activities.

• Monitor the patch status of all your applications
  Always be aware when new patches are needed. The easiest way to accomplish this is by employing a solution that monitors your network patch status and notifies you automatically when patches are available. If budget is an issue another possibility is to keep track of what applications you use and periodically check the respective websites for new issued updates.

• Always run a test
  The patches provided by software companies are designed to work well in isolation. But in the real world, any computer will have more than one type of software. This means there is always a possibility for incompatibilities between a patch and other software. When deploying patches without properly testing them out, you risk that one of the patches might conflict and cause issues on the organization’s infrastructure. It’s a good idea to test the patch on a handful of computers before applying it to the entire network.

• Work with your managed service providers
  Many managed service providers offer patch management services to suit the needs of different businesses. If you’re pressed for time or resources, consider this option so you can focus on your core business while patches will be handled by these providers, thereby providing a win-win situation for you in both these aspects. If budget is an issue, there are free solutions by Microsoft that can help automate patch management for Microsoft products. However, it is still essential to patch non-Microsoft products even if this needs to be done manually.

• Establish a disaster recovery plan
  Another important, yet often overlooked, best practice is to have a disaster recovery plan should your patch management fail and cause problems. Backups are the easiest option and they can also be used to mitigate other risks such as a virus infection or intrusion.

Patch management policy

Having an established and documented patch management policy will help your organization protect itself from viruses and security vulnerabilities. But what should a patch management policy include, apart from deploying patches?

• Monitoring
  Know when there is a need for a patch to be made. A patch management policy should have a section detailing what must be done to ensure the security personnel know what to do in this situation. The policy should include monitoring of current events because it is not always the case that a patch is released before a vulnerability is made known to the world.

• Testing
  An essential step in patch management is to ensure that the patch about to be deployed will not conflict with the current environment. To do this the organization will require an effective change management policy so that patches can be tested on these systems before being deployed to live environments.

• What requires patching?
  Applications that are not connected with the operation system also require patching because they can be a security risk. It is important to define the scope of the patch management operation to ensure no application is overlooked during the patch management process.

• Patch deployment
  The patch management policy must list the times and limit of operations the patch management team is allowed to carry out. The policy needs to include a notification to users when they can expect reboots or when they are required to have their machines available for a patch deployment.

• Handling cases where a patch isn’t available
  The policy should include details of what the security team should do when an application or operation system component requires patching but that patch is not yet available.

• Disaster recovery
  Include a disaster recovery procedure, including details on how to revert bad patches or what the team should do if reverting to a previous version is not possible.

• Reporting
  Document patching efforts to demonstrate compliance with certain regulations. Effective reporting can also help pinpoint potential issues that will help the team avoid pitfalls in future.

Getting started using patch management software tools

Over the last few years, automated patch management tools have emerged to take this pressure off administrators and to improve the overall efficiency of downloading and installing patches across different devices. As a result, every organization can update all its endpoints with the latest patches and with little human interference, regardless of its hardware specifications and geographical locations.

But how do you choose the right patch management software, given the large number of patch management tools available today? Here are some capabilities that should be present in any good automated patch management software:

• Works across different platforms and operating systems – including Microsoft®, MAC OS X® and Linux® operating systems, Amazon Web Services (AWS), other cloud platforms, as well as third-party applications.

• Scans the entire network to identify missing patches across different software.

• Downloads patches directly from vendors’ sites.

• Includes efficient patch testing and deployment.

• Provides detailed reporting to give administrators a complete idea of missing, downloaded, tested and installed patches.

• Installs easily across all devices such as desktops, laptops and servers.

• Integrated with automated patch management to help you save time.

• Generates reports on the status of each update and relevant statistics about patch installs and updates for auditing purposes.

Case studies for patch management