Italia
Spagna
UK
Portogallo
Autore: Kent Weigle, at Vicarius
We spend lots of time every month talking about the technical issues surrounding software updates, vulnerabilities, and the tools we use for patch management in our organization. However, the success of patch management depends on the coordination of everyone.
This article will focus on what Patch Tuesday means for your organization and some of the major players who are involved in the patch management process. Don’t get hung up on the job titles. Rather, consider the motivations and roles associated with each job. Bear in mind that big corporations often have the luxury of large IT experts with well-defined roles. However, small organizations may compress these roles into teams of one or two people.
The central position within an organization is the security analyst. This analyst is charged with the responsibility of collecting vulnerability results and evaluating them in terms of applications and groups of systems. The analyst is responsible for prioritizing the remediation of these vulnerabilities to lower risk to the organization and ensure both internal and external service agreements are met.
The security analyst works very closely with the traditional IT administrator. This administrator is responsible for taking the recommendations from the analyst and putting them into action. This individual conducts the actual patch operations and confirms the service level agreements are met.
Most times, business units are organized around a particular function and depend on a set of special applications. These business units often have an assigned application administrator and application owner. Their main duty is to ensure the performance and stability of these applications. This includes detailed knowledge about Patch Tuesday and understanding things associated with vulnerabilities for these applications and ensuring they are remediated to prevent negative business impact.
It’s essential that organizations have a direct and continuous channel of communication with the security analysts and IT administrators to ensure they are moving in the right direction as they recognize critical vulnerabilities, prioritize the patches, and execute the Patch Tuesday updates to protect their infrastructure.
The end-users in the organization normally want little or no involvement with any of this procedure. They want their desktops and laptops to be available when they need them. This will help them to focus on their jobs and productivity. But it’s important for them to have security awareness to recognize any threats or vulnerabilities during Patch Tuesday installation.
Yes, many non-essential security updates are made available for all supported versions of Windows, which include an update to the Windows Malicious Software Removal Tool.
Microsoft’s Surface tablets normally get driver or firmware updates on Patch Tuesday. You can get all the details about these security updates from the Microsoft Surface Update History page. Individual update histories are available for Microsoft’s Surface devices.
There may also be non-security updates that are included for Microsoft software other than Windows.
In most cases, the most ideal way to download patches on Patch Tuesday is through Windows update. Only the updates you need will be listed, and they will be downloaded and installed automatically except if you have configured Windows updates.
Microsoft has publicly commented that starting with Windows 10, they will no longer push updates based on Patch Tuesday, instead pushing them more often. This may basically end the idea of Patch Tuesday completely.
While this change is useful for both non-security and security updates, Microsoft is clearly updating Windows 10 outside Patch Tuesday. But they still seem to be pushing a majority of the updates to their latest operating system on Patch Tuesday.
Do you want to learn more about the importance of Patch Tuesday for your organization? Or do you need help managing Patch Tuesday? If yes, Vicarius is your go-to cybersecurity company.
Topia is a vulnerability management software that targets cybersecurity officers and operators, as well as IT managers and operators from the U.S. market. If you would like to implement a patch management tool, we are here for you.
You can read the original article in Vicarius website