Managing MS security patches
Last week we looked at an overview of the Microsoft Automated Deployment Services (ADS) imaging process and associated tools. This week, we discuss managing Microsoft security patches.
Over the past year, Microsoft has released a large number of security related patches. Initially, they were releasing patches on a weekly basis, but eventually moved to a monthly (second Tuesday of every month) schedule. Since then, administrators have come to realize that scheduling the patches of your Windows servers is not project-based work any longer - it is now a routine 'business as usual' task.
Each month, we get a list from Microsoft stating the patches that will be released and their severity level. Last month we received 10 patches and seven were rated as "critical". Now every organization is different in terms of their flexibility in modifying and updating system files (those files usually impacted by security updates) on servers impacted by the patch. In organizations that are regulated by the FDA (i.e. pharmaceutical companies), the challenge is much greater.
In a pharmaceutical company, applications can be rated as GxP validated applications, meaning that they adhere to good clinical practices (GCP), good manufacturing practices (GMP), or good laboratory practices (GLP). When a Windows server contains a GxP validated application, any change to the system may affect the validation of the application - thus requiring extensive change controls to be implemented. These change controls require extensive documentation and testing so that the full impact of the patch can be understood. Thankfully, Microsoft does a good job of identifying exactly what changes with each patch; however, there are still impacts to other components that may not be easily understood.
With the changing landscape and increased awareness on providing a secure environment within IT, IT administrators must become open to this new way of life and new way of doing business. Remember, the only thing constant in this world is change.
Join me next week when we discuss the latest version of Microsoft Windows 2003 Server Operating System in its arsenal against Linux.
» posted by jnaze
ITworld.com
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
jfruh
Apple syncing patent can't come soon enough
pasmith
New Twitter features borrow from 3rd party clients
Esther Schindler
Open Source Changes the Software Acquisition Process
mikelgan
How to set up continuous podcast play on the new iTunes
David Strom
Five important Windows 7 mobility features
sjvn
Guard your Wi-Fi for your own sake
Sandra Henry-Stocker
Grepping on Whole Words
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.












