What is server patch management?

What is server patch management?

Server patch management is the process of testing and deploying patches to physical and virtual services to protect your environment from security threats. The reality is that for most Sysadmins, availability and uptime are the ‘name of the game’ when managing your server estate effectively. A considerable part of availability ensures servers are patched appropriately to protect them from vulnerabilities that could cause unplanned downtime and disrupt the business.

Best practices

Effective server patch management is an essential step in keeping your environment secure. By adopting patch management best practices, you will ensure that patches are deployed to your servers effectively, efficiently, and safely, avoiding or reducing the likelihood of cyber-attacks and data breaches. Here are some best practices to follow:

• Know your infrastructure. It’s important to regularly scan and inventory your server estate so that you know what needs to be patched and plan accordingly. You will need to consider both physical and virtual servers. 

• Make sure any patch management tool covers the basics. For example, to scan both physical and remote networks and cope with machines that make up your environment.

• Track patch availability. Patch management can be complicated, especially in hybrid environments, and keeping track of released patches is essential. To add to the challenge, there is no consistent approach to patch releases; each vendor will have their approach to communicating patches and updates, so you need a process for monitoring this information and sharing it with the rest of your team.  

• Speed matters. Make sure that any patches needed for your server estate are applied promptly. Taking too much time to apply necessary patches can leave your systems vulnerable to attack from security threats and exploits. 

• But so does timing. Ideally, patching to production systems should be done outside of business hours to reduce disruption. The downside is that if there are issues, you may not hear about them until end users reaccess the system, which isn’t ideal from an experience perspective. Look at what testing you can put in place and work with your event management team so that if a patch causes issues, the correct unit is automatically notified and can address the issue.  

• Have a plan for emergencies. Some patches will be more urgent than others, so work with your change management/enablement practice to agree on a process for emergency patching.

Pitfalls to avoid

The reality is that applying patches is an essential security principle, which doesn't mean it's always easy to do in practice. Here are some pitfalls to avoid:

• Panicking. We get it. IT security and threat management can be scary, and there are some terrifying stories out there of cyber-attacks, ransomware, and loss of personal data. It's important not to panic because panic leads to a mentality of "patch all the things all of the time." Why is that a bad thing, I hear you ask? Not all vulnerabilities will hurt your environment. Some won’t be exploitable on your hardware, and some won’t get past your firewalls. By trying to patch everything instead of focusing your effort on your IT ecosystem, you risk missing a critical update/patch leaving your environment vulnerable to attack rather than protected.

• Not scheduling effectively. No one likes service downtime, but scheduling patching exercises out of hours is generally safer to prevent disruption and unhappy users. Work with change management/enablement to schedule an appropriate time with the business to give you enough time to patch your servers while protecting any service level agreements (SLAs) in place comfortably. Agreeing on a regular, out-of-core hours maintenance window takes the pressure off; everyone knows the patching is taking place well ahead of time, and you’re not rushing to cram patching during the workday.

• Not testing and verifying. Truth is, patching introduces risk. Sometimes despite your best efforts, a security patch will break something that adversely impacts the business, so plan for patching to move services and act accordingly. This could involve setting up a dev environment to test patches before deploying them into production or having support teams check that critical services are available and respond once the patching that underpins the server is complete.

How to get started

Consider patch management a life cycle of small, uniform work stages that a patch undergoes before being applied to your server estate. Effective server patch management includes the following steps:

• Updating vulnerability details from hardware vendors. 

• Scanning the devices on your network to identify areas that are vulnerable or need to be updated.

• Working with the relevant support teams to identify patches for any vulnerabilities. 

• Downloading the patches from the vendor secure servers and testing them appropriately.

• Deploying the patches to your live environment and ensuring that the appropriate post-release testing is carried out to ensure services are still available and responsive.

• Looking at ways to automate patching to increase speed and reduce the potential for human error.