Skip to main content

Patch Management

 

Patch management is an area of systems management that involves acquiring, testing and installing multiple patches, or code changes, to an administered computer system. Patch management tasks include maintaining current knowledge of available patches, deciding what patches are appropriate for particular systems, ensuring that patches are installed properly, testing systems after installation, and documenting all associated procedures, such as specific configurations required. Several products are available to automate patch management tasks, including RingMaster Software's APM, ManageEngine's Desktop Central and SolarWinds Patch Manager.

Why is patch management important?

Patch management is important because patches help to maintain the health and security of the systems that are being patched. Additionally, patches are sometimes used to bring software up to date so that it will work with the latest hardware.

How does patch management work?

Patch management works differently depending on whether a patch is being applied to a stand-alone system or is being applied to systems on a corporate network. In the case of a stand-alone system, the operating system and the applications on that system will periodically perform an automatic check to see if any patches are available. If new patches are found to exist, the patches will typically be downloaded and installed automatically.

Patch management tends to work differently in a corporate environment, because organizations generally try to maintain software version consistency across their computers. As such, organizations usually perform centralized patch management rather than allowing each computer to download its own patches.

Centralized patch management uses a centralized patch management server that downloads patches on behalf of the organization and distributes those patches to the computers on the organization's network in accordance with the organization's patch management policy.

A centralized patch management server does more than just automate patch management. It also gives the organization a degree of control over the patch management process. For example, if a particular patch is determined to be problematic, then the organization can configure its patch management policy to prevent that particular patch from being deployed.

Another advantage to performing centralized patch management is that doing so helps to conserve internet bandwidth. It makes little sense from a bandwidth perspective to allow every computer in the entire organization to download the exact same patch. Instead, the centralized patch management server can download the patch and then distribute it to all the computers within the organization. This means that the patch only must be downloaded once, rather than downloading a separate copy for every computer.

Although many organizations handle patch management on their own, some managed service providers perform patch management in conjunction with the other network management services that they provide to their clients.

Benefits of patch management

Most major software companies periodically release patches for their products. These patches can serve any of three primary purposes.

First, patches are often used to address security vulnerabilities. If a software vendor discovers that there is a security risk associated with its product, it will commonly issue a patch to address that risk. It is important that organizations apply security patches as quickly as possible, because hackers and malware authors know about the security vulnerabilities that a patch is designed to correct, and actively look for unpatched systems.

A second reason why software companies commonly release patches is to fix bugs that have been discovered in their software. Applying such patches can improve software stability, while also getting rid of annoying problems.

Third, software companies occasionally release patches as a way of introducing new features. Feature updates are becoming much more common than they once were as a result of the transition to subscription-based software licensing.

Common problems with patch management

The most common problem associated with the patch management process is that of a buggy patch. Occasionally, a patch will introduce problems that did not previously exist. These problems may show up in the product that is being patched, or the problems may manifest themselves elsewhere if other software has a dependency relationship with the software that was recently patched.

Because patches can sometimes introduce problems into a system that was previously working correctly, it is important for administrators to test patches prior to deploying them on an organization wide basis.

Another common problem associated with patch management is that disconnected systems may not receive patches in a timely manner. If a mobile user rarely connects to the corporate network for instance, then that user's device may go for long periods of time without being patched. In such cases, it may be better to configure the device for stand-alone patch management rather than relying on centralized patch management.

Patch management life cycle

When a new patch is released, an organization should test the patch before deploying it on an organization wide basis. The IT department may initially perform some basic tests inside of a sandbox environment. This keeps any problems with the patch from impacting production systems.

If no obvious problems are discovered during sandbox testing, then the IT department may perform a pilot deployment. A pilot deployment involves deploying the patches to a limited number of production systems to verify that the patch works properly in a production environment. After a period of time, the patch is deployed on an organization wide basis.

Occasionally, the IT department may need to remove a patch that has been applied to production systems. This can happen if the patches are found to cause problems, but there are other reasons for removing a patch. A patch might be removed, for example, if a software vendor releases a new patch that cannot be put into place while the previous patch remains on the system. In such a case, the new patch is said to supersede the previous patch.

Examples of patch management

Microsoft often provides patches to its Windows operating systems and to other products such as Office 365. These patches are normally released on a scheduled basis, on a day that has come to be known as Patch Tuesday.

Stand-alone systems rely on Windows Update to automatically download and deploy any available patches. In business environments, however, it is much more common to use Windows Server Update Services to manage and deploy Microsoft patches. The Windows Server Update Services, which are commonly referred to as WSUS, are included with Windows Server and specifically designed to centralize patch management. However, there are numerous third-party products that are also able to download, manage and deploy Microsoft patches.


Comments

Post a Comment

Popular posts from this blog

Black swan

A  black swan event  is an incident that occurs randomly and unexpectedly and has wide-spread ramifications. The event is usually followed with reflection and a flawed rationalization that it was inevitable. The phrase illustrates the frailty of inductive reasoning and the danger of making sweeping generalizations from limited observations. The term came from the idea that if a man saw a thousand swans and they were all white, he might logically conclude that all swans are white. The flaw in his logic is that even when the premises are true, the conclusion can still be false. In other words, just because the man has never seen a black swan, it does not mean they do not exist. As Dutch explorers discovered in 1697, black swans are simply outliers -- rare birds, unknown to Europeans until Willem de Vlamingh and his crew visited Australia. Statistician Nassim Nicholas Taleb uses the phrase black swan as a metaphor for how humans deal with unpredictable events in his 2007...
Post a Comment
Read more

A Graphics Processing Unit (GPU)

A graphics processing unit (GPU) is a computer chip that performs rapid mathematical calculations, primarily for the purpose of rendering images. A GPU may be found integrated with a central processing unit (CPU) on the same circuit, on a graphics card or in the motherboard of a personal computer or server. In the early days of computing, the CPU performed these calculations. As more graphics-intensive applications such as AutoCAD were developed; however, their demands put strain on the CPU and degraded performance. GPUs came about as a way to offload those tasks from CPUs, freeing up their processing power. NVIDIA, AMD, Intel and ARM are some of the major players in the GPU market. GPU vs. CPU A graphics processing unit is able to render images more quickly than a central processing unit because of its parallel processing architecture, which allows it to perform multiple calculations at the same time. A single CPU does not have this capability, although multi...
Post a Comment
Read more

6G (sixth-generation wireless)

6G (sixth-generation wireless) is the successor to 5G cellular technology. 6G networks will be able to use higher frequencies than 5G networks and provide substantially higher capacity and much lower latency. One of the goals of the 6G Internet will be to support one micro-second latency communications, representing 1,000 times faster -- or 1/1000th the latency -- than one millisecond throughput. The 6G technology market is expected to facilitate large improvements in the areas of imaging, presence technology and location awareness. Working in conjunction with AI, the computational infrastructure of 6G will be able to autonomously determine the best location for computing to occur; this includes decisions about data storage, processing and sharing.  Advantages of 6G over 5G 6G is expected to support 1 terabyte per second (Tbps) speeds. This level of capacity and latency will be unprecedented and wi...
Post a Comment
Read more