Patching & Maintenance

What is Patching in Computer Maintenance?

A patch is a set of changes to a computer program or its supporting data designed to update, fix, or improve it. This includes fixing security vulnerabilities and other bugs, with such patches usually being called bugfixes or bug fixes. Patches are often written to improve the functionality, usability, or performance of a program.

Patches may be installed either under programmed control or by a human programmer using an editing tool or a debugger. They may be applied to program files on a storage device, or in computer memory. Patches may be permanent (until patched again) or temporary.

Patching makes possible the modification of compiled and machine language object programs when the source code is unavailable. This demands a thorough understanding of the inner workings of the object code by the person creating the patch, which is difficult without close study of the source code. Someone unfamiliar with the program being patched may install a patch using a patch utility created by another person who is the Admin. Even when the source code is available, patching makes possible the installation of small changes to the object program without the need to recompile or reassemble. For minor changes to software, it is often easier and more economical to distribute patches to users rather than redistributing a newly recompiled or reassembled program.

Although meant to fix problems, poorly designed patches can sometimes introduce new problems (see software regressions). In some special cases updates may knowingly break the functionality or disable a device, for instance, by removing components for which the update provider is no longer licensed.

Patch management is a part of lifecycle management, and is the process of using a strategy and plan of what patches should be applied to which systems at a specified time.

How Often Should Patching Be Done?

Set a regularly scheduled routine every month to patch your systems. You can do it most efficiently all in one big event over a weekend, where all systems are patched. Or, you can elect to do 20% of them at a time over the course of the month, to mitigate impacts from unexpected patching problems. There are many other approaches you can take. You need to decide what is best for your business.

Why is Patching your Device Important?

Software updates are important to your digital safety and cyber security. The sooner you update, the sooner you’ll feel confident your device is more secure — until the next update reminder.

Why are software updates so important? There are a lot of reasons. Here are 5 that show why it’s important to update software regularly.

1. Software updates do a lot of things

Software updates offer plenty of benefits. It’s all about revisions. These might include repairing security holes that have been discovered and fixing or removing computer bugs. Updates can add new features to your devices and remove outdated ones.

While you’re at it, it’s a good idea to make sure your operating system is running the latest version.

2. Updates help patch security flaws

Hackers love security flaws, also known as software vulnerabilities. A software vulnerability is a security hole or weakness found in a software program or operating system. Hackers can take advantage of the weakness by writing code to target the vulnerability. The code is packaged into malware — short for malicious software.

An exploit sometimes can infect your computer with no action on your part other than viewing a rogue website, opening a compromised message, or playing infected media.

What happens next? The malware can steal data saved on your device or allow the attacker to gain control over your computer and encrypt your files.

Software updates often include software patches. They cover the security holes to keep hackers out.

3. Software updates help protect your data

You probably keep a lot of documents and personal information on your devices. Your personally identifiable information — from emails to bank account information — is valuable to cybercriminals.

They can use it to commit crimes in your name or sell it on the dark web to enable others to commit crimes. If it’s a ransomware attack, they might encrypt your data. You might have to pay a ransom for an encryption key to get it back. Or, worse, you might pay a ransom and not get it back.

Updating your software and operating systems helps keep hackers out.

4. It’s not all about you

OK, cyber security is mostly about you, but you’ve got other people to think about, too. If your device gets a virus, you could pass it on to your friends, family, and business associates. That’s why you want to keep your software and systems updated.

A trusted security program such as Norton 360^TM can help keep your devices secure. And that can potentially help all those people you interact with online. But it’s also important to know anti-virus protection isn’t enough to protect your devices against all cyberthreats

5. You deserve the latest and greatest

Updates not only patch security holes, they can also add new features and improve existing ones. You don’t want to fall behind the times, right?

In that way, software updates really are all about you. Your software program may get a new shot of stability — no more crashing. Or an update might boost program performance — more speed. You deserve no less.

You could ignore those reminders to update your software, but you might be missing out on a lot, starting with your cyber security.

How Do you Manage Patch Management?

A patch management software should be capable to:

• Apply patches across different operating systems that includes Windows, Linux and Mac
• Apply patches on different endpoints like desktops, laptops, servers, etc.
• Provide automated patch management to save time.
• Offer instant reports on latest patch update statuses.

Patch Management Life Cycle

• Update vulnerability details from software vendors
• Scan the enterprise network for vulnerability
• Examine the Vulnerability and identify the missing patches
• Deploy patches and validate patch installation
• Generate Status Report on the latest patch updates

Use the services of a Managed Service Provider

Managed service providers such as us at We The IT Team, offer patch management software to fit the requirements of the business – big or small. We take full control of the patch management process – while your businesses can focus on the management and revenue-generating aspects.

If you don’t want to use our services and would like to do it yourself, please see below;

18 recommended best practices for patching your software:

1. First, identify all the software you are using. Today’s IT systems present a challenge because most systems run dozens of different software titles. You can’t know what you need to patch until you know what you have. You have operating systems, server applications and desktop applications.
2. You need to patch servers, PCs and mobile devices.
3. Remember, you need to have a strategy to patch many of your hardware based appliances, like firewalls, routers, SANs and more.
4. Set a regularly scheduled routine every month to patch your systems. You can do it most efficiently all in one big event over a weekend, where all systems are patched. Or, you can elect to do 20% of them at a time over the course of the month, to mitigate impacts from unexpected patching problems. There are many other approaches you can take. You need to decide what is best for your business.
5. When dealing with multiple servers, you need to identify if you have dependencies that require a certain server reboot in order for everything to work right on restart. For example, it is best practice to bring down a multi-tier system by starting with the presentation tier (web server), then the application tier, and then lastly, the database tier. Your systems should be brought up in reverse order.
6. Read the release notes or ReadMe files to learn more about the implications of deploying a set of patches. You should also review software user forums to see if anyone else is reporting problems with the new patches.
7. It is good to apply patches in a timely manner, but unless there is an imminent threat, don’t rush to deploy the patches until there is an opportunity to see what effect it is having elsewhere in similar software user communities. A good rule of thumb is to apply patches 30 days from their release.
8. Before applying patches to your production system, you should test the patches out on a test environment. This can be difficult and expensive for most companies, since it requires buying a lot of extra hardware and software to build the test environment. If you don’t have a budget to do this, there are alternatives. There are companies that provide patching services. Testing those patches before deployment to production systems is one of the tasks they perform.
9. During the testing process in the test environment, determine if the computers require a reboot or if they do so automatically. If so, then you need to plan for a maintenance window in which to apply the patches to the production system, so you don’t have unexpected system reboots that hurt your business operations or do damage to databases, etc. You can expect 90+ percent of your patch deployments to require reboots.
10. After you have applied patches, utilize a smoke testing procedure to make sure all applications and services are back online and running properly when servers and PCs restart.
11. Change Management is important, but often overlooked. You need to involve other stakeholders in the organization before making the changes. Often they will let you know of system or organizational demands that will have an effect on your patch deployment task.
12. Notify your end-user community of your planned time frame for patch deployment, so they know what to expect. When patching workstations, remind the users just prior to patching to save all documents, close all applications, and logout of their workstation, but DO NOT SHUT THE PC DOWN. Let them know what they should do if they encounter a problem after the patch deployment.
13. Have a good roll-back plan. A roll-back plan allows you to quickly reverse the patches and go back to the pre-patched system if there is a significant problem with the deployment. Good patching tools and procedures will allow for a roll-back of patches.
14. Have a good backup of all your systems and, if possible, take an image snapshot of your servers right before your patch deployment.
15. Are there any auto-scheduled maintenance jobs running to do maintenance, such as for a SQL database? If yes, be sure to put them on hold, as they can really mess things up if left running.
16. Use a service or automated tools whenever possible. Don’t use tools like Auto-Update, as you cannot control when patches are applied, you cannot test applications before patches are applied, there is no smoke testing procedure post-patching to determine everything is running fine, and there is no patch deployment reporting that is required to show yourself, management, auditors and regulators that you are running a securely patched operation.
17. Review the patching report after deployment and look for patches that failed to deploy. Investigate why they failed to deploy, develop your remediation plan, and then redeploy.
18. Make sure you accommodate your exceptions. Sometimes certain servers or applications cannot be upgraded or patched in order to maintain compatibility with a critical application that is in use. When this happens, you need to make sure you have an alternative strategy for securing that system from the vulnerability left exposed by the inability to patch the software.
    

If you have any questions, please contact us and we would be happy to discuss our proactive monitoring and maintenance support package.