In this lesson,
we're going to discuss patch management.
So what exactly is patch management?
Well, patch management is the planning, testing,
implementing and auditing of software patches.
Patch management is critical for providing security,
increasing uptime, ensuring compliance,
and improving features in your network, devices,
servers, and clients.
Patch management increases the security of your network
by fixing known vulnerabilities in your network
devices, servers, and clients.
And in terms of servers and clients,
patch management is going to be conducted
by installing software or operating system patches in order
to fix bugs in the system software.
Now, patch management can also increase the uptime
of your systems by ensuring that your devices
and software remain up to date
and don't suffer from resource exhaustion
or crashes due to vulnerabilities inside of their code.
Patch management is also used
to support your compliance efforts.
Now, one of the biggest things that's looked at from
a compliance standpoint is
how well your patch management program is being run,
and how effectively your systems are being protected against
known vulnerabilities like those CVEs
that have patches associated with them.
Patch management is also going to be used
to provide improvements and upgrades
to your existing feature set.
While many patches will only fix existing problems or bugs,
there's also other types of patches out there
that include feature or functionality updates.
By ensuring that you're running the latest version
of the software and that it is fully up to date and patched,
you can ensure that you have the best feature set available
with the highest levels of security.
Now, as you can probably imagine, there are a lot
of different patches out there
because each manufacturer is going to create their own patches
for their applications and software.
Part of our job as cybersecurity professionals is to be able
to keep track of all the various updates
and ensure that all being installed properly throughout
our network to all of our different endpoints
to fully harden our network devices, servers, and clients.
Now, that's a pretty big job,
and patch management is not just concerned with ensuring
that a patch is installed,
but also that it doesn't create new problems
for us once we install that patch.
After all, patches can also have bugs in them,
just like any other piece of software can.
Therefore, to effectively conduct patch management,
you really should follow a basic four step process
of planning, testing, implementing, and auditing.
Now, step one is planning.
Planning consists of creating policies, procedures,
and systems to track the available patches and updates,
and then having a method in place to verify
that they're compatible with your systems.
Planning is also used to determine how you're going to test
and deploy each of those patches before you install them.
A good patch management tool can really tell you whether
or not the patches have been deployed, installed,
and verified functionally on a given server or client.
For example, in a large enterprise network,
you might use the Microsoft Endpoint Configuration Manager,
or you might buy a third party tool
to help you conduct your patch management.
Step two, testing.
Now, while we're conducting patch management,
it's always going to be important
to test the patches we receive from the manufacturer prior
to automating its deployment throughout your entire network.
As I said before, while a patch is designed
to solve one problem, it can often insert new code
that creates new problems for you if you're not careful.
Within your organization,
you should have a small test network lab,
or at the very least, a single workstation that you can use
for testing a new patch
before you deploy it across your entire network environment.
After all,
many of our organizations have unique configurations
within our networks, and that can actually break some
of the security patches when you try to install them.
So, while manufacturers are attempting
to ensure patches are not going to cause harm to our systems,
this simply cannot be guaranteed
because every network has its own individual configurations.
So instead, it's much better to find out
that the patch is causing issues in your lab environment
before you start pushing it out across 10,000 workstations,
and then have all your end users yelling
and screaming at you because their systems are
crashing and they can't get their work done.
Step three is implementation.
Now, after we test the patch, it's going to be time for us
to deploy it to all of our workstations
and servers that need that patch.
You can do this manually by going to each system
and installing it, or you could do it automatically
by deploying the patch to your client's workstations
and servers so that it's installed
and moved into a production environment.
Now, if you have a small network with only a few clients
or servers like your home network, you may choose
to manually install the patch across the network.
But if you're working for a large company
that has a really big network, you're going to want
to use some sort of tool to perform your patch management.
Now again, Microsoft provides a great tool known
as the Microsoft Endpoint Configuration Manager
that you can use for this purpose,
or you can license a third party patch management tool
that has additional features
and functions that you may be interested in.
Now, some organizations do rely on automatic updates using
the Windows update system,
but most large organizations won't do that.
Instead, they want to have complete control over the
installation of patches.
For large organizations, it is really highly recommended
that you essentially manage your updates
through an update server instead
of using the Windows update tool.
By doing this, you're going to be able to test the patch prior
to deploying it inside of your network environment.
To disable Windows update on your systems, you simply need
to disable the Windows update service from running
automatically on the workstation
whenever it's being booted up.
Now, if you have a lot of mobile devices in your network,
you also need to implement patching there too,
and you do this through an MDM or Mobile Device Manager.
Now, even if you don't have a dedicated test network
or lab environment to use during your testing phase here,
you can split up your production network into smaller groups
and use those as a form of test environment.
For example,
in one of the large organizations I led in the past,
we actually used this concept
of patch rings when we're deploying our new patches.
Inside of Patch Ring 1, we only had 10
or 20 end user machines that we needed
to deploy our patches to first.
Then if nothing was broken
and we didn't hear about any issues, we would deploy it out
to Patch Ring 2, which contained 50 or 100 machines.
This included our system administrators
and our service desk workstations too,
so we could see quickly if something was going wrong.
After that, we'd move into Patch Ring 3,
which contained about 1000 to 2000 machines.
And once that was successful, we moved into Patch Ring 4,
which included the rest of the network, which was about 10
to 20,000 machines at the time I was working there.
Now, the benefit of doing these types of deployments
as we move through these various patch rings is
that if there's an issue, we're only affecting a smaller
group of users before we break all 10,000
or 20,000 user computers.
And this saves us a lot of work at the service desk
because we're not going to have to field 10,000 calls.
We'll only have to field 5 or 10 calls.
Now, step four is auditing.
Auditing is important to ensure
that you understand the client status
after you conducted your patch deployment.
During auditing, you're going to be able to scan the network
and determine if the patch was installed properly,
if there's any unexpected failures that may have occurred
because of that installation.
Again, using a tool like
the Microsoft Endpoint Configuration Manager
or a third party patch management tool,
we'll be able to conduct scanning
and verification of your workstations and servers for you,
and this will help ensure the patches
have been properly installed.
Now, if you're using Linux or Mac-based systems,
they also have built-in patch management systems too.
For example, in Linux, you can use a package manager
to deploy RPMs or packages of those patches to all
of your servers and workstations.
And the same concepts
and principles apply like the ones we were talking about
when using the
Microsoft Endpoint Configuration Management tool.
Now, in addition to conducting patch management across our
workstations and servers, it's also important
that we conduct firmware management
for all of our network devices.
After all, our network devices, like our switches
and routers, are all running a form of software known
as firmware on those devices to be able
to provide the operating system to them.
If your network devices don't contain the latest
and most up-to-date firmware versions,
then you could have security vulnerabilities
and software bug that could be exploited by an attacker.
If you look at the common vulnerabilities and exposures
or CVE website, you'll see a long list of vulnerabilities
that are identified in various Cisco networking devices
as well as other brands too.
So just like you need to patch the operating system
of a Windows, Mac or Linux computer,
you still need to update the operating system
of your network devices.
In a Cisco device,
this operating system is known as Cisco's iOS
or the inner network operating system.
To update the iOS version,
you need to flash the firmware on that networking device.
Now, some device manufacturers like Cisco do provide
a centralized method of conducting firmware management
in your enterprise networks.
For example, Cisco uses the Cisco UCS Manager
to centralize the management of resources and devices
and to conduct firmware management
for server network interfaces and server devices.
There are also third party tools like device expert
by manage engine that allows you to upgrade, downgrade,
and manage the configuration of the firmware on all
of your network devices using automation,
orchestration and scripting.
The bottom line here is that you need
to have firmware management in place to ensure
that you have the right firmware versions
loaded onto your network devices
in order to secure your devices just like we do
for our workstations and clients by using patch management.
So remember, patch management is the planning, testing,
implementing and auditing of software patches.
Patch management is critical for providing security,
increasing uptime, ensuring compliance,
and improving features in your network
devices, servers, and clients.
To conduct patch management at scale, though, you do need
to use either a tool, automation
or orchestration to ensure that all your network devices,
servers, laptops, and mobile devices remain up to date
and patched against any known vulnerabilities.