Major Change Management Activities - Patch Management

Patches may be small changes to a system element or a suite | of updates delivered by a systems vendor; in either case, they generally are involved with security vulnerabilities or related issues and must be installed as a unit.

As these may directly or indirectly affect the organization's systems and their current vulnerabilities, management of patch installation and verification is of primary interest to the security professional.

Software routinely requires updating to address weaknesses, improve operating efficiency or add functionality. The implementation of changes to production software should follow the procedures identified in the organization's change management practice.

The practice of patching systems, while necessary to ensure a continually secure environment, entails its own set of challenges. These include the following:

Interoperability

A patch to a given system might conflict with the proper function of another system or systems that have some interrelated dependency on or for the patched system. The organization might apply the patch and then discover that this causes an outage for another system/process within their environment.

Poorly crafted patches

If a patch is not designed and created properly, the implementation of that patch might degrade system performance, cause the aforementioned interoperability problems, or even introduce new vulnerabilities and risks to the environment. This is particularly true for reactive patching, but it can also result from routine patches.

Vendors cannot possibly create patches that will work properly in all environments where their products are deployed, because the vendors do not know all the circumstances of every organization that uses their products.

Required downtime

Patches often require a reboot of the affected systems to properly take effect; this can interrupt the organization's operations and incur additional costs.

Virtualization-specific concerns

Virtualization is the practice of running multiple software-based hosts on a single device; virtualization allows for resource optimization and pooling, rapid scalability, and ease of configuration/replication. Cloud computing, for instance, is a viable financial endeavor because the use of virtual machines allows a limited number of devices to service an almost unlimited number of customers.

Although the technology exists to patch live and snapshot instances, patch management practice in the cloud has moved toward immutable infrastructure practices, where patches are applied to a completely new instance and load is shifted to the new instance away from the old instance. This aligns with Continuous Integration/Continuous Deployment (CI/CD) practices, where configuration management tools (Puppet, Chef, Ansible, etc.) work in conjunction with the orchestration environment to ensure systems deploy to security baselines.

Timing

Because of the aforementioned outage problems/reboot requirements, organizations that operate across multiple time zones are at a particular risk of not applying patches uniformly throughout their environments).

The industry has responded to these challenges with a fairly standard patching process; each organization should create a patching policy/program/process that best suits its needs.