Upload
vicky-ames
View
210
Download
3
Embed Size (px)
Citation preview
AUG 2013
Vicky AmesIS Security
Patch Management Program Training
Agenda
What is Patch Management?
Why is it important?
Which patches are we applying?
How do we manage patches?
When do we patch?
Who is responsible?
Future Plans
2
What is Patch Management?
Part of our overall Vulnerability Management strategyPatches are released by vendors to address issues
identified with their code Often security related Sometimes performance or functionality related
Patch Management is the formal program we use to address the need to apply these patches to our systems Identify available patches Select patches to be applied Ensure they are applied according to our policy Tested to ensure no negative impact Validate they have been applied
3
Why is Patch Management important?
Patches generally address security issues that if left unpatched could lead to Denial of Service Viruses, Worms, other Malware Data exfiltration Other malicious activities
Malicious code is generally available to take advantage of significant vulnerabilities within two days from patch release
Defense in depth
4
Which patches are we applying? Microsoft
OS patches Middleware patches
Open Source (AIX, Solaris, Red Hat) OS patches
Web Servers Apache, Tomcat and IIS
Databases Those that can be patched will be when patches are released and
through service packs
Thus far we have had 0 issues caused by a patch pushed by this program Rebooting systems has uncovered issues related to the system or the
application Other underlying conditions are revealed after patches are applied Good to have happen during patching
During scheduled maintenance window Teams are already engaged and can diagnose quickly
5
How do we manage patches?
All systems (servers and workstations) are subject to monthly patching Lab systems excluded for now
Leverage existing maintenance windows
Vulnerability Management Team meets monthly to decide which patches to apply
All servers are assigned to 1 of 4 patch groups Group 1 intended to be DEV Group 2 intended to be QAS/INFRA Group 3 intended to be PROD Group 4 intended to be for manual patching
Ensure we patch systems in Group 1 or 2 before we get to Group 3 so we can test patches before they hit production
Adhere to Change Management process
6
When do we patch?
2nd Tuesday of every month is “Patch Tuesday”
Team meets the next day to determine which patches to push
Group 1 patched the following Sunday 00:01 – 11:59
Group 2 patched the following Sunday 00:01 – 11:59
Group 3 patched the following Sunday 00:01 – 11:59
Group 4 patched the following Sunday 00:01 – 11:59
Schedule posted on ITCM Sharepoint site
Quarterly extended maintenance window
7
When do we patch?
Exceptions Process Request should be submitted 5 business days in advance of the
patch window Open a service desk ticket Required information
System name(s) Application(s) impacted Justification for exception request Exclusion date requested Date patches will be applied
Granted by Vulnerability Management Program Manager Backup is Director Information Security
Only granted for 1 patch cycle If needed for longer we will discuss alternative solutions
8
Who is responsible?
Wintel and Open Source Teams SME Apply patches
Contract Team Middleware Testing
Security Team Program oversight and validation
System Owners Some patching Some testing
9
Future Plans
Citrix systems late 2013
Expect to incorporate more 3rd party Middleware in 2014
10
Appendix
Appendix A – Patch Schedule
Appendix B - Links
11
Appendix A – Patch Schedule
12
Month Security Meeting Group 1 (Dev/Test) Group 2 (Infrastructure/QAS) Group 3 (Production/Network)1/1/2013 Wednesday, January 09, 2013 Sunday, January 13, 2013 Sunday, January 20, 2013 Saturday, January 26, 20132/1/2013 Wednesday, February 13, 2013 Sunday, February 17, 2013 Sunday, February 24, 2013 Sunday, March 03, 20133/1/2013 Wednesday, March 13, 2013 Sunday, March 17, 2013 Sunday, March 24, 2013 Sunday, March 31, 20134/1/2013 Wednesday, April 10, 2013 Sunday, April 14, 2013 Sunday, April 21, 2013 Saturday, April 27, 20135/1/2013 Wednesday, May 15, 2013 Sunday, May 19, 2013 Sunday, May 26, 2013 Sunday, June 02, 20136/1/2013 Wednesday, June 12, 2013 Sunday, June 16, 2013 Sunday, June 23, 2013 Sunday, June 30, 20137/1/2013 Wednesday, July 10, 2013 Sunday, July 14, 2013 Sunday, July 21, 2013 Saturday, July 27, 20138/1/2013 Wednesday, August 14, 2013 Sunday, August 18, 2013 Sunday, August 25, 2013 Sunday, September 01, 20139/1/2013 Wednesday, September 11, 2013 Sunday, September 15, 2013 Sunday, September 22, 2013 Sunday, September 29, 2013
10/1/2013 Wednesday, October 09, 2013 Sunday, October 13, 2013 Sunday, October 20, 2013 Saturday, October 26, 201311/1/2013 Wednesday, November 13, 2013 Sunday, November 17, 2013 Sunday, November 24, 2013 Sunday, December 01, 201312/1/2013 Wednesday, December 11, 2013 Sunday, December 15, 2013 Sunday, December 22, 2013 Sunday, December 29, 2013
Green indicates extended maintenance window
Appendix B - Links
Security Policies - Patch Management Policy is IT-AP-SEC-008-01– http://sharepointportal/Departments/InformationTechnology/ITDL/
Administrative%20Policies/Forms/AllItems.aspx
ITCM Site - patch schedule is on the right under Links– http://sharepointportal/Departments/InformationTechnology/RFC/
Default.aspx
Microsoft Security Bulletins– http://technet.microsoft.com/en-us/security/bulletin
Information Security Sharepoint site– http://sharepointportal/Departments/InformationTechnology/
InfoSecurity/default.aspx
13