Patch management

Patch management is the area of COTS systems management for identifying, acquiring, testing, installing and verifying patches for software and firmware used by infrastructure (both systems and services layers), virtual server environments, OSs, middleware, applications and both infrastructure and end user devices.

Overview

Patches are applied for corrective and adaptive maintenance actions to resolve technical, security and functionality problems. Custom developed systems are managed via ALM. From a security perspective, patching is required to mitigate software vulnerabilities.

The main objectives of patch management are to determine which patches are missing from the ICT environment, to acquire, test and deploy those patches to end user devices, and to verify if these patches were successfully deployed.

Patch management is triggered by one of the following occurrences:

• Vendor notifications, security bulletins and patch release schedules. Automated patch schedules, such as Microsoft’s Tuesday patch, trigger the patching process if relevant patches are released.
• Security incidents that are the result of a vulnerability being exploited and for which patching is the appropriate remediation.
• Vulnerability management exposes areas of risk that need to be remediated by applying patches to the affected systems.

Patch identification

For automated patching, the patch management tool maintains a repository of known systems and installed software, and will periodically download a list of applicable patches for the known installed base.

For manual patching, vendor security bulletins and patch notifications are sent to subscribed e-mail accounts. Based on the source of the patch notification (i.e., the vendor), the patch manager forwards the patch notification to the responsible operator via e-mail.

Acquiring patches

Patches are acquired from vendors on a regular basis.

• Automated patching: the patch management tool automatically downloads the applicable patches from the respective vendors and queues them for deployment.
• Manual patching: if patch levels are monitored through a tool, patches can be acquired automatically. Otherwise, patches need to be downloaded manually from the vendor sites by the responsible operator.

Patch vetting

Patches are reviewed by the patching administrator and patching coordinator for criticality and relevance based on industry newsgroups and vendor security bulletins.

The importance of a patch depends on:

• The seriousness of the vulnerability that the patch is addressing
• The criticality of the systems affected

Patches are prioritized and scheduled according to the severity rating of the patch, the criticality of the system affected, and the impact of patching on the system affected.

Patch classification: Critical, Important, Moderate, Low

Patch testing

• Automated patches: distributed through the enterprise tool, deployed via a staged approach to ensure compatibility with the existing installed base.
• Manual patches: should pass the regular QA processes prior to deployment to production.

Patch deployment

• Automated deployment: phased approach; canary release first before deploying to all targets.
• Manual deployment: should follow regular change and release management procedures.

Review

Patch management compliance should be reviewed regularly by the patch management coordinator, in conjunction with roles like service management and information security.

References

(Add your references here as needed)