1
00:00:00,000 --> 00:00:03,450
In this lesson, we're going to discuss updates and patches.

2
00:00:03,450 --> 00:00:05,490
Now, updates and patches are an important part

3
00:00:05,490 --> 00:00:06,870
of your hardening efforts.

4
00:00:06,870 --> 00:00:09,180
After all one of the best ways to increase the security

5
00:00:09,180 --> 00:00:11,070
of our workstations and servers is to ensure

6
00:00:11,070 --> 00:00:13,620
that we have a good patch management program in place.

7
00:00:13,620 --> 00:00:15,360
When a software developer discovers a bug

8
00:00:15,360 --> 00:00:16,500
or error in their code,

9
00:00:16,500 --> 00:00:18,120
they're going to develop a code fix for it,

10
00:00:18,120 --> 00:00:20,160
and then release a software patch.

11
00:00:20,160 --> 00:00:22,440
These are designed to plug any security holes in a piece

12
00:00:22,440 --> 00:00:24,811
of software, such as operating systems, applications,

13
00:00:24,811 --> 00:00:27,690
cloud instances, or even our firmware.

14
00:00:27,690 --> 00:00:30,120
Now a formal patch management system should be used inside

15
00:00:30,120 --> 00:00:31,350
of our organizations,

16
00:00:31,350 --> 00:00:32,610
and this system is going to ensure

17
00:00:32,610 --> 00:00:34,740
that we have a routine method for scanning our network

18
00:00:34,740 --> 00:00:35,730
for vulnerabilities,

19
00:00:35,730 --> 00:00:37,170
ensuring that our systems are updated

20
00:00:37,170 --> 00:00:38,790
with the proper software patches

21
00:00:38,790 --> 00:00:41,400
to prevent these vulnerabilities from getting exploited.

22
00:00:41,400 --> 00:00:43,590
Patch management can be a manual process,

23
00:00:43,590 --> 00:00:46,800
an automated process, or a combination of both of these.

24
00:00:46,800 --> 00:00:49,230
It is quite rare that anyone conducts their patch management

25
00:00:49,230 --> 00:00:51,330
program fully manually these days though,

26
00:00:51,330 --> 00:00:52,163
because the amount

27
00:00:52,163 --> 00:00:54,780
of workload involved would just be way too much.

28
00:00:54,780 --> 00:00:57,180
For the most part, we're going to use patch management software

29
00:00:57,180 --> 00:00:59,280
tools to automate the checking of our endpoints

30
00:00:59,280 --> 00:01:01,200
to see if they need that given patch.

31
00:01:01,200 --> 00:01:02,940
Then we can automatically deploy it

32
00:01:02,940 --> 00:01:04,920
to those machines when they need it.

33
00:01:04,920 --> 00:01:07,320
Some administrators will also manually implement patches on

34
00:01:07,320 --> 00:01:09,120
sensitive high value systems,

35
00:01:09,120 --> 00:01:11,520
but for the most part, we try to automate as much

36
00:01:11,520 --> 00:01:13,050
of the patch deployment as possible

37
00:01:13,050 --> 00:01:16,350
for our general information technology and client systems.

38
00:01:16,350 --> 00:01:18,810
When a software manufacturer like Microsoft releases a

39
00:01:18,810 --> 00:01:20,850
patch though, hackers are going to often try

40
00:01:20,850 --> 00:01:22,530
to reverse engineer these patches

41
00:01:22,530 --> 00:01:23,850
to discover the vulnerability

42
00:01:23,850 --> 00:01:26,130
that Microsoft was trying to protect against.

43
00:01:26,130 --> 00:01:29,010
This can happen very quickly and often in just a few days

44
00:01:29,010 --> 00:01:30,660
after a patch is released,

45
00:01:30,660 --> 00:01:33,090
this reverse engineering develops a usable exploit

46
00:01:33,090 --> 00:01:34,800
for attackers that they can then use to try

47
00:01:34,800 --> 00:01:36,480
to break into your networks.

48
00:01:36,480 --> 00:01:39,480
For example, many data breaches in the headlines are simply

49
00:01:39,480 --> 00:01:41,640
the result of missing a software patch.

50
00:01:41,640 --> 00:01:43,980
If the system had the proper hotfixes, updates,

51
00:01:43,980 --> 00:01:45,330
or service packs installed,

52
00:01:45,330 --> 00:01:46,590
then a hacker would simply not be

53
00:01:46,590 --> 00:01:48,600
able to exploit them so easily.

54
00:01:48,600 --> 00:01:50,550
Now, a hotfix is a software patch

55
00:01:50,550 --> 00:01:52,110
that involves a security issue

56
00:01:52,110 --> 00:01:53,490
that should be applied immediately

57
00:01:53,490 --> 00:01:55,500
after being tested in your lab environment

58
00:01:55,500 --> 00:01:58,320
because the vulnerability could be exploited by an attacker.

59
00:01:58,320 --> 00:02:00,300
An update is going to provide the system with some kind

60
00:02:00,300 --> 00:02:02,700
of additional functionality, but it doesn't usually provide

61
00:02:02,700 --> 00:02:05,250
any kind of patching of security related issues.

62
00:02:05,250 --> 00:02:07,770
In fact, updates because they provide new functions

63
00:02:07,770 --> 00:02:09,900
and features, can often introduce new security

64
00:02:09,900 --> 00:02:11,820
vulnerabilities that are going to require another

65
00:02:11,820 --> 00:02:13,500
hotfix to be implemented.

66
00:02:13,500 --> 00:02:15,450
When a significant number of these security patches

67
00:02:15,450 --> 00:02:17,550
and hotfixes have been released, as is in the case

68
00:02:17,550 --> 00:02:19,470
of the Microsoft Windows operating system,

69
00:02:19,470 --> 00:02:21,540
they'll actually bundle them all together into a single

70
00:02:21,540 --> 00:02:23,970
installer known as a service pack.

71
00:02:23,970 --> 00:02:25,410
This includes all the hotfixes

72
00:02:25,410 --> 00:02:28,290
and updates since the release of that operating system.

73
00:02:28,290 --> 00:02:32,160
For example, Windows XP, which was released back in 2001,

74
00:02:32,160 --> 00:02:35,550
had been updated many times over its long 13 year lifecycle.

75
00:02:35,550 --> 00:02:38,700
And the final release was Windows XP Service Pack 3

76
00:02:38,700 --> 00:02:39,660
that contained thousands

77
00:02:39,660 --> 00:02:41,760
of updates in hotfixes over the original

78
00:02:41,760 --> 00:02:43,710
Windows XP operating system.

79
00:02:43,710 --> 00:02:47,160
So what constitutes an effective patch management program?

80
00:02:47,160 --> 00:02:49,260
Well, first, you need to make sure you have an individual

81
00:02:49,260 --> 00:02:51,320
or a specific team that's responsible for tracking all

82
00:02:51,320 --> 00:02:53,400
of the vendor supplied security patch bulletins

83
00:02:53,400 --> 00:02:55,260
and releases when they come out.

84
00:02:55,260 --> 00:02:57,600
Second, you need to have a mechanism in place

85
00:02:57,600 --> 00:02:59,070
to patch your operating systems and

86
00:02:59,070 --> 00:03:01,470
all your applications on all of your systems.

87
00:03:01,470 --> 00:03:04,410
If possible, this should be an automated process as well,

88
00:03:04,410 --> 00:03:05,340
because it will make sure

89
00:03:05,340 --> 00:03:06,900
that things are being done properly.

90
00:03:06,900 --> 00:03:08,820
Even if people are off work that day

91
00:03:08,820 --> 00:03:10,920
because it's a weekend or a holiday.

92
00:03:10,920 --> 00:03:12,570
Third, you should ensure you account

93
00:03:12,570 --> 00:03:14,250
for your cloud-based resources as part

94
00:03:14,250 --> 00:03:15,870
of your patch management as well.

95
00:03:15,870 --> 00:03:17,130
And fourth, you should review

96
00:03:17,130 --> 00:03:19,410
and triage all your patches as urgent,

97
00:03:19,410 --> 00:03:21,330
important and non-critical.

98
00:03:21,330 --> 00:03:23,700
That way you can prioritize your patching efforts

99
00:03:23,700 --> 00:03:26,310
and dedicate the proper amount of resources to it.

100
00:03:26,310 --> 00:03:27,750
Fifth, you should have a lab

101
00:03:27,750 --> 00:03:29,700
or test environment in which you're going to test all your

102
00:03:29,700 --> 00:03:31,200
urgent and important patches

103
00:03:31,200 --> 00:03:32,910
to make sure the functionality is right,

104
00:03:32,910 --> 00:03:35,520
prior to deploying them to your production environment.

105
00:03:35,520 --> 00:03:37,410
Sixth, you should maintain detailed logs

106
00:03:37,410 --> 00:03:39,540
of your patching activity so that way you can evaluate

107
00:03:39,540 --> 00:03:40,800
and monitor your patch management

108
00:03:40,800 --> 00:03:42,690
program and its deployments.

109
00:03:42,690 --> 00:03:45,450
Seventh, you should have a mechanism to evaluate, test,

110
00:03:45,450 --> 00:03:47,400
and deploy firmware updates.

111
00:03:47,400 --> 00:03:49,770
Eighth, you should have a technical process in place

112
00:03:49,770 --> 00:03:50,940
to push urgent patches

113
00:03:50,940 --> 00:03:53,430
and hotfixes into the production environment if they've

114
00:03:53,430 --> 00:03:56,220
been approved by an emergency change advisory board.

115
00:03:56,220 --> 00:03:58,590
And finally, ninth, you should conduct an evaluation

116
00:03:58,590 --> 00:04:01,830
of non-critical patches for a combined rollout periodically.

117
00:04:01,830 --> 00:04:04,140
For example, every two weeks, you might be scheduled

118
00:04:04,140 --> 00:04:06,030
to deploy all your non-critical patches,

119
00:04:06,030 --> 00:04:09,060
and this way you can do them all at once in one big push.

120
00:04:09,060 --> 00:04:11,880
So remember, updates and patches are crucial to the security

121
00:04:11,880 --> 00:04:12,840
of your devices,

122
00:04:12,840 --> 00:04:15,000
and you need to have a patch management program in place

123
00:04:15,000 --> 00:04:17,370
to make sure you can minimize the risk of attack.

124
00:04:17,370 --> 00:04:18,959
When it comes to updates and patches,

125
00:04:18,959 --> 00:04:19,980
remember there are three

126
00:04:19,980 --> 00:04:21,600
main types that we have to consider.

127
00:04:21,600 --> 00:04:24,870
These are hotfixes, updates and service packs.

128
00:04:24,870 --> 00:04:27,690
A hotfix is a security patch that solves a security issue

129
00:04:27,690 --> 00:04:28,950
and should be applied immediately

130
00:04:28,950 --> 00:04:31,530
after being tested in your lab environment to make sure

131
00:04:31,530 --> 00:04:34,260
that vulnerability cannot be exploited by attackers.

132
00:04:34,260 --> 00:04:36,420
An update on the other hand, is going to provide your system

133
00:04:36,420 --> 00:04:37,770
with additional functionality,

134
00:04:37,770 --> 00:04:39,450
but it doesn't usually give you any patching

135
00:04:39,450 --> 00:04:41,220
of security related issues.

136
00:04:41,220 --> 00:04:43,950
And a service pack is going to be a collection of hundreds

137
00:04:43,950 --> 00:04:45,870
or thousands of hotfixes

138
00:04:45,870 --> 00:04:48,240
and updates into one installer file so

139
00:04:48,240 --> 00:04:50,160
that when you install a new operating system,

140
00:04:50,160 --> 00:04:52,020
you can install all the security patches

141
00:04:52,020 --> 00:04:54,360
by using one installer file instead of having to go out

142
00:04:54,360 --> 00:04:56,850
and collect a hundred or a thousand different hotfixes

143
00:04:56,850 --> 00:04:58,230
and security updates to be able

144
00:04:58,230 --> 00:04:59,880
to implement them on your system.