November 12, 2004, 9:13 AM — Last week we looked at an overview of the Microsoft Automated Deployment Services (ADS) imaging process and associated tools. This week, we discuss managing Microsoft security patches.
Over the past year, Microsoft has released a large number of security related patches. Initially, they were releasing patches on a weekly basis, but eventually moved to a monthly (second Tuesday of every month) schedule. Since then, administrators have come to realize that scheduling the patches of your Windows servers is not project-based work any longer - it is now a routine 'business as usual' task.
Each month, we get a list from Microsoft stating the patches that will be released and their severity level. Last month we received 10 patches and seven were rated as "critical". Now every organization is different in terms of their flexibility in modifying and updating system files (those files usually impacted by security updates) on servers impacted by the patch. In organizations that are regulated by the FDA (i.e. pharmaceutical companies), the challenge is much greater.
In a pharmaceutical company, applications can be rated as GxP validated applications, meaning that they adhere to good clinical practices (GCP), good manufacturing practices (GMP), or good laboratory practices (GLP). When a Windows server contains a GxP validated application, any change to the system may affect the validation of the application - thus requiring extensive change controls to be implemented. These change controls require extensive documentation and testing so that the full impact of the patch can be understood. Thankfully, Microsoft does a good job of identifying exactly what changes with each patch; however, there are still impacts to other components that may not be easily understood.
With the changing landscape and increased awareness on providing a secure environment within IT, IT administrators must become open to this new way of life and new way of doing business. Remember, the only thing constant in this world is change.
Join me next week when we discuss the latest version of Microsoft Windows 2003 Server Operating System in its arsenal against Linux.
