In this lesson, we're going to discuss updates and patches.
Now, updates and patches are an important part
of your hardening efforts.
After all one of the best ways to increase the security
of our workstations and servers is to ensure
that we have a good patch management program in place.
When a software developer discovers a bug
or error in their code,
they're going to develop a code fix for it,
and then release a software patch.
These are designed to plug any security holes in a piece
of software, such as operating systems, applications,
cloud instances, or even our firmware.
Now a formal patch management system should be used inside
of our organizations,
and this system is going to ensure
that we have a routine method for scanning our network
for vulnerabilities,
ensuring that our systems are updated
with the proper software patches
to prevent these vulnerabilities from getting exploited.
Patch management can be a manual process,
an automated process, or a combination of both of these.
It is quite rare that anyone conducts their patch management
program fully manually these days though,
because the amount
of workload involved would just be way too much.
For the most part, we're going to use patch management software
tools to automate the checking of our endpoints
to see if they need that given patch.
Then we can automatically deploy it
to those machines when they need it.
Some administrators will also manually implement patches on
sensitive high value systems,
but for the most part, we try to automate as much
of the patch deployment as possible
for our general information technology and client systems.
When a software manufacturer like Microsoft releases a
patch though, hackers are going to often try
to reverse engineer these patches
to discover the vulnerability
that Microsoft was trying to protect against.
This can happen very quickly and often in just a few days
after a patch is released,
this reverse engineering develops a usable exploit
for attackers that they can then use to try
to break into your networks.
For example, many data breaches in the headlines are simply
the result of missing a software patch.
If the system had the proper hotfixes, updates,
or service packs installed,
then a hacker would simply not be
able to exploit them so easily.
Now, a hotfix is a software patch
that involves a security issue
that should be applied immediately
after being tested in your lab environment
because the vulnerability could be exploited by an attacker.
An update is going to provide the system with some kind
of additional functionality, but it doesn't usually provide
any kind of patching of security related issues.
In fact, updates because they provide new functions
and features, can often introduce new security
vulnerabilities that are going to require another
hotfix to be implemented.
When a significant number of these security patches
and hotfixes have been released, as is in the case
of the Microsoft Windows operating system,
they'll actually bundle them all together into a single
installer known as a service pack.
This includes all the hotfixes
and updates since the release of that operating system.
For example, Windows XP, which was released back in 2001,
had been updated many times over its long 13 year lifecycle.
And the final release was Windows XP Service Pack 3
that contained thousands
of updates in hotfixes over the original
Windows XP operating system.
So what constitutes an effective patch management program?
Well, first, you need to make sure you have an individual
or a specific team that's responsible for tracking all
of the vendor supplied security patch bulletins
and releases when they come out.
Second, you need to have a mechanism in place
to patch your operating systems and
all your applications on all of your systems.
If possible, this should be an automated process as well,
because it will make sure
that things are being done properly.
Even if people are off work that day
because it's a weekend or a holiday.
Third, you should ensure you account
for your cloud-based resources as part
of your patch management as well.
And fourth, you should review
and triage all your patches as urgent,
important and non-critical.
That way you can prioritize your patching efforts
and dedicate the proper amount of resources to it.
Fifth, you should have a lab
or test environment in which you're going to test all your
urgent and important patches
to make sure the functionality is right,
prior to deploying them to your production environment.
Sixth, you should maintain detailed logs
of your patching activity so that way you can evaluate
and monitor your patch management
program and its deployments.
Seventh, you should have a mechanism to evaluate, test,
and deploy firmware updates.
Eighth, you should have a technical process in place
to push urgent patches
and hotfixes into the production environment if they've
been approved by an emergency change advisory board.
And finally, ninth, you should conduct an evaluation
of non-critical patches for a combined rollout periodically.
For example, every two weeks, you might be scheduled
to deploy all your non-critical patches,
and this way you can do them all at once in one big push.
So remember, updates and patches are crucial to the security
of your devices,
and you need to have a patch management program in place
to make sure you can minimize the risk of attack.
When it comes to updates and patches,
remember there are three
main types that we have to consider.
These are hotfixes, updates and service packs.
A hotfix is a security patch that solves a security issue
and should be applied immediately
after being tested in your lab environment to make sure
that vulnerability cannot be exploited by attackers.
An update on the other hand, is going to provide your system
with additional functionality,
but it doesn't usually give you any patching
of security related issues.
And a service pack is going to be a collection of hundreds
or thousands of hotfixes
and updates into one installer file so
that when you install a new operating system,
you can install all the security patches
by using one installer file instead of having to go out
and collect a hundred or a thousand different hotfixes
and security updates to be able
to implement them on your system.