Chapter 9 — Patch management

Lesson map

Lesson 09 published. Map, example, EX025.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 The cycle"]
  N2["9.2 Testing"]
  N3["9.3 Servers and cloud"]
  N4["9.4 Systems that lag"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX025"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 The cycle"]
  N2["9.2 Testing"]
  N3["9.3 Servers and cloud"]
  N4["9.4 Systems that lag"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX025"]

[Learning outcomes]
    |
    v
[9.1 The cycle]
    |
    v
[9.2 Testing]
    |
    v
[9.3 Servers and cloud]
    |
    v
[9.4 Systems that lag]
    |
    v
[Worked example] --> [Exercise EX025]

Learning outcomes

You will (1) run a patch cycle; (2) test updates before wide deployment; (3) handle systems that cannot be patched quickly.

9.1 The cycle

Jamal learns the patch cycle: learn about new updates, assess their importance, test them, deploy them and confirm installation. Riverbend's IT manager receives vendor notices and checks a public catalogue of known exploited vulnerabilities. Updates for actively exploited flaws get priority. Ms. Grant explains that a reliable, routine cycle protects better than occasional bursts of effort after news stories. He writes the cycle as a monthly checklist with dates for each stage and the person responsible, so the IT manager and technician know exactly what to do and when. The checklist includes a step for checking the exploited vulnerabilities catalogue every week.

9.2 Testing

Updates can break things. Jamal sets up a test group of five workstations, one from each type of role, that receive updates first. After two days without problems, updates go to all workstations. When an update breaks a reception printer driver, the test group catches it before it reaches every centre. He records the problem and the fix in the IT log. Ms. Grant notes that test groups should include the most unusual machines, such as reception computers with printers, because those are most likely to break. Jamal adds two more machines to the group for this reason.

9.3 Servers and cloud

Riverbend's booking system is cloud-hosted, so its supplier handles server patching. Jamal checks the contract and finds the supplier commits to patching critical issues within fourteen days. Riverbend still patches its own file server and camera recorders. Camera recorder updates are rare and must be downloaded manually, so he adds a quarterly check to the calendar. He also asks the supplier for a summary of its recent patching performance, which the supplier provides. It shows critical issues patched within the committed time over the past year. Jamal files the summary with the contract and sets a reminder to request it annually.

9.4 Systems that lag

Some systems cannot be patched quickly. An old pool chemical controller runs software the supplier no longer updates. Jamal recommends isolating it on its own network segment, blocking internet access and asking the supplier about replacement. Ms. Grant notes that isolation reduces risk when patching is impossible, but should be recorded as a temporary exception with a review date. The supplier offers a replacement controller at a reduced price, and the centre manager includes it in next year's budget. Jamal records the exception with its controls and review date in the IT log, and checks that the isolation works by testing from a staff computer.

Worked example

Jamal follows the patch cycle, uses a five-machine test group that catches a printer problem, checks the cloud supplier's commitment and isolates an unpatchable pool controller.

Synthetic case. Systems are synthetic.

Errors and limits

Deploying untested updates everywhere at once can break every centre.

Exercises

• EX025 — Priority updates. Which updates get priority?
  Show marking criteria

  Rubric: 3 = those for actively exploited flaws;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX026 — Test group. How many workstations are in the test group?
  Show marking criteria

  Rubric: 3 = five;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX027 — Pool controller. How is the pool controller protected?
  Show marking criteria

  Rubric: 3 = isolated segment without internet;; 2 = partly correct;; 1 = vague;; 0 = none.