-: Patch management, in this lesson, 2 2
we're going to discuss a network hardening technique 3 3
known as patch management. 4 4
So what exactly is patch management? 5 5
Well, patch management is the planning, testing, 6 6
implementing, and auditing of software patches. 7 7
Patch management is critical to providing the security 8 8
and increasing uptime inside your network, 9 9
as well as ensuring compliance and improving features 10 10
in your network devices, your servers and your clients. 11 11
Now patch management is going to increase the security 12 12
of your network by fixing known vulnerabilities 13 13
inside of your network devices, 14 14
things like your servers, your clients, 15 15
and your routers and switches. 16 16
Now, in terms of our servers and clients, 17 17
patch management is going to be conducted by installing 18 18
software and operating system patches 19 19
in order to fix bugs in the system software. 20 20
Patch management can also increase the uptime 21 21
of your systems, by ensuring your devices and software 22 22
are up to date, and they don't suffer 23 23
from resource exhaustion or crashes 24 24
due to vulnerabilities within their code. 25 25
Patch management is also used to support 26 26
your compliance efforts. 27 27
One of the biggest things is looked at 28 28
within a compliance assessment, 29 29
is how well your patch management program 30 30
is being run and being conducted? 31 31
This way you can ensure it's effective 32 32
and making sure your systems are up to date 33 33
and patch against all known vulnerabilities, 34 34
such as CVEs or common vulnerabilities and exposures 35 35
that have patches associated with those. 36 36
Now patch management is also going to be used to provide 37 37
improvements and upgrades to your 38 38
existing feature set as well. 39 39
Many of your patches don't just fix things or existing 40 40
problems inside of them, but they can also add other things 41 41
like features and functionality when you do those upgrades. 42 42
By ensuring that you're running the latest version 43 43
of the software and that it's fully patched, 44 44
you can ensure you have the best feature set 45 45
with the highest security available. 46 46
Now, as you can imagine, there are a lot of different 47 47
patches out there, because each manufacturer 48 48
is going to create their own patches 49 49
for their specific applications and software. 50 50
Part of your job inside of the patch management process 51 51
is keeping track of all the various updates and ensuring 52 52
they're getting installed properly 53 53
throughout all of your network devices. 54 54
This includes your switches, your routers, your firewalls, 55 55
and your servers and clients. 56 56
Patch management is not just concerned with ensuring 57 57
that a patch patches installed though, 58 58
it's also important to ensure it doesn't create new problems 59 59
for you when you do that installation. 60 60
After all patches themselves can have bugs in them too, 61 61
just like any other software can. 62 62
Therefore it's really important for you to effectively 63 63
conduct patch management by following four critical steps. 64 64
First, planning, second testing, 65 65
third implementing, and forth auditing. 66 66
Step one is planning. 67 67
Planning consists of creating policies, procedures, 68 68
and systems to track the availability of patches and updates 69 69
and having a method to verify that they're compatible 70 70
with your systems. 71 71
Planning is also used to determine how you're going to test 72 72
and deploy each of those patches. 73 73
A good patch management tool can tell you whether or not 74 74
the patches have been deployed, 75 75
installed and verified functionally, 76 76
on a given system or client. 77 77
For example, in large enterprise networks, 78 78
you may use 79 79
the Microsoft System Center Configuration Manager 80 80
known as SCCM, or you can buy a third party tool 81 81
to conduct your patch management. 82 82
Step two, testing, when conducting patch management, 83 83
it's really important to test any patch you receive 84 84
from your manufacturer before you automate its deployment 85 85
throughout your entire network. 86 86
As I said before, a patch is designed to solve one problem, 87 87
but it can also create new ones for you 88 88
if you're not careful. 89 89
Within your organization, you need to ensure 90 90
that you have a small test network, a lab, 91 91
or at the very least, a single machine that you're going to 92 92
use for testing new patches before you deploy 93 93
across your entire network. 94 94
After all many of our organizations have unique 95 95
configurations within our networks, 96 96
and these patches can break things. 97 97
So when a manufacturer tries to attempt to make sure that 98 98
patch is not going to harm our systems, 99 99
they cannot guarantee this 100 100
because everyone has different configurations. 101 101
Instead it is better to find out if a patch is causing 102 102
issues in your lab environment before you push it across 103 103
10,000 workstations across the entire enterprise network. 104 104
Because if you do that, you're going to have a lot of end users 105 105
yelling and screaming at you when their systems crash. 106 106
Step three, implementation. 107 107
After you've tested the patch, 108 108
it's now going to be time to deploy it 109 109
to all of the workstations and servers 110 110
that are going to need it. 111 111
You can do this manually by going to each system 112 112
and installing it yourself, 113 113
or you can do it automatically by deploying 114 114
that patch to your client, workstations and servers, 115 115
using one of those tools like SCCM 116 116
that we talked about earlier. 117 117
This way, it will install the patch 118 118
and move it into production for you. 119 119
If you have a small network of just a few clients 120 120
or servers, you may choose to install things manually 121 121
and do it that way because it's really quick and easy, 122 122
and it costs no additional money 123 123
by buying a third party tool. 124 124
But if you have a large network, 125 125
you're going to want to use some kind of tool. 126 126
Microsoft provides this one known as SCCM, 127 127
the Microsoft System Center Configuration Manager, 128 128
but you can also use third-party management tools 129 129
with a lot more features and additional 130 130
abilities if you want to. 131 131
Now, some organizations rely on automatic updates 132 132
from the Windows update system, 133 133
but others decide they want to have complete control over 134 134
the installation of patches. 135 135
For large organizations, it is highly recommended 136 136
that you essentially manage all your updates 137 137
through an update server 138 138
instead of using the Windows update tool. 139 139
This will allow you to test the patch prior to deploying it 140 140
across your entire environment. 141 141
To disable Windows update on your clients, 142 142
you simply need to disable the Windows update service 143 143
from running automatically on those workstations. 144 144
If you have a lot of mobile devices throughout your network, 145 145
you also to figure out how you're going 146 146
to do patch management for those devices. 147 147
The easiest way to do this is by using 148 148
a mobile device manager or MDM, 149 149
which works like one of these patch management servers, 150 150
but has additional features as well. 151 151
Alright, now, when you comes to testing, 152 152
you may not have your own dedicated test network 153 153
or lab environment to use, but you still need to do testing. 154 154
So what are you going to do? 155 155
Well, one thing you can do is split up 156 156
your production network into smaller groups. 157 157
Organizations I've led in the past, 158 158
we use the concept of patch ring 159 159
when we deploy out new patches. 160 160
In patch ring 1, we have 10 or 20 end user machines 161 161
that will deploy our patches to first. 162 162
If it doesn't break anything on those machines, 163 163
then we'll move out into patch ring 2 164 164
which has 100 or 200 people. 165 165
And this'll include things like our system administrators, 166 166
and our service desk workstations so we can instantly 167 167
figure out if things are going wrong. 168 168
If that works successfully, 169 169
we'll then go in to patch ring 3, 170 170
which contains 1000 or 2000 machines. 171 171
And finally, we'll move on to patch ring 4, 172 172
which includes everybody else, 173 173
and then maybe 10 or 20,000 machines. 174 174
Now the benefit of doing the deployments this way as we move 175 175
through the various patch rings, 176 176
is that if there is an issue, I'm only affecting 177 177
a smaller group of users before I break all the users 178 178
on the network. 179 179
If I did everybody at once, I'd have 20 or 30,000 people 180 180
who are complaining when things break, 181 181
but by doing it in these smaller steps, 182 182
I only have 10 or 15 people who are yelling at me, 183 183
and I can fix things quicker. 184 184
Alright, step four, auditing. 185 185
Now, auditing is important to understand 186 186
because you have to understand the client status 187 187
after you conduct your patch deployment. 188 188
So I pushed out the patch, did it work? 189 189
During auditing, you're going to be able to scan the network 190 190
and determine if that patch that you pushed out to install 191 191
actually installed properly, or are there any kind 192 192
of unexpected failures that may have happened, 193 193
and that meant that the patch wasn't really installed, 194 194
or isn't doing the protection it's supposed to do? 195 195
Again, if you're using a tool like 196 196
the Microsoft System Center Configuration Manager, SCCM, 197 197
or a third-party management tool, 198 198
you'll be able to conduct scanning and verification of your 199 199
workstations and servers to ensure that the patches have 200 200
been installed properly and with no issues. 201 201
Now, if you're using Linux or OS X, 202 202
they also have built in patch management systems. 203 203
For example, Red Hat Linux uses a package manager 204 204
to deploy RPMs, which are packages of patches 205 205
to your servers and workstations. 206 206
So the same concepts and principles are going to apply here. 207 207
Now, in addition to conducting patch management across our 208 208
workstations and servers, it's also important for us 209 209
to conduct firmware management for our network devices. 210 210
After all, all of our network devices 211 211
are running some form of software, 212 212
and this is known as firmware inside of our routers, 213 213
our switches, our firewalls, 214 214
and our other network appliances. 215 215
If your network devices don't contain the latest and most 216 216
up-to-date firmware versions, 217 217
then you could have security vulnerabilities and software 218 218
bugs that could be exploited by an attacker. 219 219
If you look at the common vulnerabilities and exposures 220 220
or CVE website, you're going to see a long list 221 221
of vulnerabilities that we have 222 222
for all sorts of different networking devices. 223 223
Just select the Cisco devices, and you'll see a long 224 224
laundry list of those that have been patched 225 225
and fixed over time. 226 226
So just like you need to patch your operating system 227 227
for a Windows or Linux computer, 228 228
you also need to update the operating system 229 229
of your network devices. 230 230
In a Cisco device, this is known as the Cisco IOS 231 231
or Internetwork Operating System. 232 232
Now to update the IOS version, 233 233
you need to flash the firmware on that networking device. 234 234
Some manufacturers like Cisco provide a centralized method 235 235
of conducting firmware management inside your enterprise 236 236
network, and this helps with our patch management. 237 237
For example, Cisco use the Cisco UCS Manager 238 238
to centralize the management of resources and devices 239 239
and to conduct firmware management 240 240
for your server network interfaces and server devices. 241 241
There's also third-party tools like DeviceExpert 242 242
by ManageEngine that allow you to upgrade, 243 243
downgrade and manage the configuration of the firmware 244 244
for all of your network devices, 245 245
using automation, orchestration and scripting. 246 246
The bottom line here is that you need to do firmware 247 247
management, to ensure you have the right firmware versions 248 248
loaded onto those network devices, to ensure that you have 249 249
the right security for those devices, 250 250
just like we do with our workstations and clients, 251 251
when we use patch management.