Instructor: In this lesson, we will learn
about automated patching.
Automated patching is the process
of automatically applying software updates
and security patches
to systems and applications without manual intervention.
This involves scheduling or triggering updates
based on predefined criteria,
such as the severity of a vulnerability
or a predefined maintenance window.
In this way, scheduling and triggering
ensure that network disruptions are minimized,
and that organizations stay ahead of potential threats
by ensuring all systems are consistently updated
with the latest security fixes.
Let's learn more about automated patching.
Automated patching is the process
of applying software updates and security patches
to systems and applications
without needing manual intervention.
In this context, updates are generally used
to add new features or improve functionality,
while patches specifically address and fix
security vulnerabilities or bugs in software.
In this discussion, we will refer to this process
as automated patching.
Recognizing the concept and planning
for both updates and patch automation can be the same.
So automated patching ensures all systems
are regularly updated against vulnerabilities.
The scheduling and triggering of automated patching
then helps organizations maintain security
while minimizing network disruptions,
typically by planning for updates to happen
during defined maintenance windows,
or in an unplanned maintenance window
in response to specific criteria such as high
or critical severities of vulnerabilities.
For example, an organization might schedule
automated patches to deploy critical security updates
across all its servers overnight within 24 hours of receipt.
This approach ensures network vulnerabilities
are addressed quickly,
without waiting for manual approval
and without risking exposure
or downtime during business hours.
But do we need a program to manage this?
Well, yes, we do.
One of the best ways to secure
or harden network workstations and servers
is to adopt an effective patch management strategy
and program.
This is better than implementing one patch
or update at a time where each implementation
is planned for as a new event.
That way, when external software developers identified bugs
or security issues and release patches or fixes,
the patches are immediately implemented
to address security vulnerabilities
across operating systems, applications,
cloud instances, and firmware.
Patch management tools can facilitate this.
An example of a patch management tool
is Microsoft Systems Center Configuration Manager, or SCCM,
which helps streamline patching across enterprise networks.
Tools like SCCM make it easy
by automatically checking endpoints for required patches
and then automatically deploying patches across the network,
reducing the need for manual oversight and intervention.
However, some administrators
may still manually apply patches to sensitive
or high value systems to minimize the possibility
of unexpected disruption or compatibility issues
that could impact critical production operations.
Still, automating as much of the patching process
as possible benefits IT and client systems
by maintaining security
while reducing administrative effort.
If a patch management process is slowed or delayed,
risk is directly incurred.
This is because when manufacturers
release significant patches,
hackers reverse engineer them to identify
and exploit the vulnerabilities addressed by these patches.
This reverse engineering often happens within days
of a patch release,
and many data breaches are the result
of missed software patches
where proper updates could have blocked attackers.
An example of a significant patch is a hotfix
or critical update, which is a type of patch
for a critical security flaw,
usually one that is being actively exploited in the wild,
while an update on its own is often used
to add functionality to a system
without addressing security directly.
Sometimes updates can even introduce new vulnerabilities
that will require hotfixes or critical updates.
Over time, manufacturers like Microsoft can compile patches
and updates into a service pack,
which is a cumulative bundle that includes all updates
and security fixes in one installation.
In recent years though,
Microsoft has shifted from using traditional service packs
to a continuous update model, especially with Windows 10.
So rather than releasing large bundled service packs,
Microsoft now provides cumulative updates regularly.
These cumulative updates roll out monthly
and include all previous patches and security fixes,
ensuring that any new installation of Windows
receives all necessary updates in one update.
Major updates known as feature updates
are typically released twice a year
and bring additional functionality and improvements
along with the latest security enhancements.
This approach allows Windows 10 to stay consistently
up to date with the latest features and security protections
without the need for traditional service pack.
Now that we understand the importance of patching,
how do we make it all happen?
To establish an effective patch management program,
organization should first designate an individual or team
responsible for tracking vendor supplied security patches
and releases, as well as firmware updates.
Next, all systems, including cloud-based resources,
should have a consistent patching mechanism
where automated patching is preferred,
but manual updates can occur if automation isn't possible.
Additionally, a prioritization and patch testing environment
should exist to facilitate
and enable the patch management program.
With prioritization, patches can be categorized
as urgent, important, or non-critical,
with resources allocated based on the patch priority.
After prioritization, all patches, regardless of urgency,
should be tested in a staging
or a non-production environment
before being deployed to the production environment
to minimize functionality issues.
This can take time.
Urgent patches, however, may trigger the need
to be fast tracked through an emergency change
for prompt deployment.
Finally, the periodic implementation of non-critical patches
can streamline the update process.
For instance, scheduling noncritical patches
for rollout every two weeks
balances resource allocation with security maintenance.
By dedicating time and resources
to a comprehensive patch management strategy,
organizations significantly reduce their risk of attack,
making automated patching an indispensable part
of network and system security.
So remember, automated patching ensure systems stay secure
by applying updates and patches without manual intervention,
and there is a difference between updates and patches.
Generally, updates add new features
and patches focus on fixing security vulnerabilities,
but both are needed to keep network systems protected.
By scheduling automated patches during maintenance windows
or triggering them based on risk severity,
organizations can maintain security
while minimizing disruptions.
Finally, effective patch management also includes
prioritizing patches and testing them
in a staging environment before pushing them to production.
So with a structured and automated patch management program,
organizations reduce their security risks significantly.