How do you handle patch management in your organization? Here's an email I sent to a client that I contract for. We make sure to have a group of willing patch testers of different levels of experience. This organization also has a Change Management process where patches and updates need to be approved before they are widely released.
-
We're seeing an increased frequency of patches from Apple/Adobe/Microsoft/Firefox/Google addressing security and/or vulnerability issues on the platform.
Recent releases with significant fixes include Adobe Flash Player, Microsoft Office 2011 for Mac, and OS X 10.10.5.
There is a huge tradeoff between testing these releases extensively versus getting them deployed quickly.
I'd like to see some of these updates take precedence (i.e. typically by the time Flash Player is revised, there are a handful of known 0-day vulnerabilities in the wild) and be deployed ASAP.
Not suggesting we avoid the test loop, or change management, but, once a critical update is out, it gets deployed to test and tech workstations immediately that evening upon logout. If no problems are discovered within a week, it is run through change management and deployed everywhere.
Perhaps the speed at which updates are deployed should be categorized in some manner, i.e. High (critical, exploits in wild), Medium (exploits possible but not necessarily in the wild) and Low (minor changes which may not impact users).
High updates get deployed within a week of being pushed to testers
Medium updates get deployed within a couple of weeks of being pushed to testers
Low updates get deployed within a month of being pushed to testers
Examples of recent High updates: Flash Player 18.0.0.232, Adobe AIR 18.0.0.199, Office 2011 14.5.4, Firefox
Examples of recent Medium updates: Adobe Bridge 6.1.1
Examples of recent Low updates: Adobe Camera RAW 9.1.1
I realize the impact classification may be subjective (i.e. is 10.10.5 a High or Medium update? My vote would be High based on the DYLD vulnerability), but there will be times it may not be so clear-cut.
Open to thoughts and discussion.
