I have read a number of conflicting 'best practice' documents on the subject of patch management and none of them agree with one another. :)
Most of them assign a minimum patch time based on the severity of the patch and climate (is womrable? do worms exist for it? are exploits in the wild? etc.). I believe its FIPS that says a critical patch has to be tested and installed within 24 hours of its release, others very or don't say.
My favorite document on the subject is the NIST guide found @ http://csrc.nist.gov/publications/nistpubs/800-40-Ver2/SP800-40v2.pdf
Hope that helps.
On Fri, 13 Apr 2007 13:33:46 -0400, Erik Selke <[log in to unmask]> wrote:
> My servers download the updates, but *never* auto-install. I have 3 of
> the same server, so I test on our least critical first. I manually
> install pretty much everything on our servers.
>
> Typically I wait for Shavlik to add it to their NetChk Pro scan setup as
> they do preliminary testing, and then I check out to see what problems
> early adopters have experienced. Our servers are pretty vanilla, so
> I've been lucky so far to not have any problems.
>
> Erik
>
> Laurence Bates wrote:
>> What is the general consensus about the best way of installing
>> Microsoft’s regular update Patches?
>>
>>
>>
>> 1) Automatically install when available
>>
>> 2) Automatically download and install ASAP
>>
>> 3) Automatic download and install after a reasonable comment
> period.
>>
>> 4) Do extensive testing before installing regular updates
>>
>> 5) Install first on a virtual LAN which mimics all of the major
>> servers ;-)
>>
>>
>>
>>
>>
>>
>>
>> Laurence A. Bates
>>
>> College of Education
>>
>> Michigan State University
>>
>> 217E Erickson Hall
>>
>> East Lansing
>>
>> MI 48824
>>
>> 517-355-2178
>>
>> [log in to unmask] <mailto:[log in to unmask]>
>>
>>
>>
>
> --
> Erik Selke
> Information Technologist
> Department of Sociology
> 316 Berkey Hall
> Michigan State University
> [log in to unmask]
> (517) 353-1804
--
Bryan Murphy, CISSP, MCP
|
