In this lesson, we're going to discuss
a network hardening technique known as patch management.
So what exactly is patch management?
Well, patch management is the planning, testing,
implementing and auditing of software patches.
Patch management is critical to the providing the security
and increasing uptime inside your network,
as well as ensuring compliance
and improving features in your network devices,
your servers, and your clients.
Now, patch management is going to increase
the security of your network
by fixing known vulnerabilities
inside of your network devices,
things like your servers, your clients,
and your routers and switches.
Now in terms of our servers and clients,
patch management is going to be conducted
by installing software and operating system patches
in order to fix bugs in the system software.
Patch management can also increase
the uptime of your systems
by ensuring your devices and software are up-to-date
and they don't suffer from resource exhaustion
or crashes due to vulnerabilities within their code.
Patch management is also used
to support your compliance efforts.
One of the biggest things that's looked at
within a compliance assessment
is how well your patch management program
is being run and being conducted.
This way you can ensure it's effective
and making sure your systems are up-to-date
and patched against all known vulnerabilities,
such as CVEs or common vulnerabilities and exposures
that have patches associated with those.
Now, patch management is also going to be used
to provide improvements and upgrades
to your existing feature set as well.
Many of your patches don't just fix things
or existing problems inside of them,
but they can also add other things
like features and functionality
when you do those upgrades.
By ensuring that you're running
the latest version of the software
and that it's fully patched,
you can ensure you have the best feature set
with the highest security available.
Now, as you can imagine, there are a lot
of different patches out there
because each manufacturer
is going to create their own patches
for their specific applications and software.
Part of your job inside of the patch management process
is keeping track of all the various updates
and ensuring they're getting installed properly
throughout all of your network devices.
This includes your switches, your routers, your firewalls,
and your servers and clients.
Patch management is not just concerned
with ensuring that a patch is installed though,
it's also important to ensure
it doesn't create new problems for you
when you do that installation.
After all, patches themself can have bugs in them too,
just like any other software can.
Therefore, it's really important for you
to effectively conduct patch management
by following four critical steps.
First, planning,
second, testing,
third, implementing,
and fourth, auditing.
Step one is planning.
Planning consists of creating policies,
procedures, and systems
to track the availability of patches and updates,
and having a method to verify
that they're compatible with your systems.
Planning is also used to determine how you're going to test
and deploy each of those patches.
A good patch management tool can tell you
whether or not the patches have been deployed, installed,
and verified functionally on a given system or client.
For example, in large enterprise networks,
you may use
the Microsoft Systems Center Configuration Manager,
known as SCCM,
or you can buy a third party tool
to conduct your patch management.
Step two, testing.
When conducting patch management,
it's really important to test
any patch you receive from your manufacturer
before you automate its deployment
throughout your entire network.
As I said before, a patch is designed to solve one problem,
but it can also create new ones for you
if you're not careful.
Within your organization,
you need to ensure that you have a small test network,
a lab, or at the very least, a single machine
that you're going to use for testing new patches
before you deploy it across your entire network.
After all, many of our organizations
have unique configurations within our networks,
and these patches can break things.
So while a manufacturer tries to attempt
to make sure that patch is not going to harm our systems,
they cannot guarantee this
because everyone has different configurations.
Instead, it is better to find out
if a patch is causing issues in your lab environment
before you push it across 10,000 workstations
across the entire enterprise network.
'Cause if you do that,
you're going to have a lot of end users
yelling and screaming at you when their systems crash.
Step three, implementation.
After you've tested the patch, it's now going to be time
to deploy it to all the workstations
and servers that are going to need it.
You can do this manually by going to each system
and installing it yourself,
or you can do it automatically by deploying that patch
to your client workstations and servers
using one of those tools like SCCM
that we talked about earlier.
This way, it will install the patch
and move it into production for you.
If you have a small network
of just a few clients or servers,
you may choose to install things manually
and do it that way because it's really quick and easy
and it costs no additional money
by buying a third party tool.
But if you have a large network,
you're going to want to use some kind of tool.
Microsoft provides this one known as SCCM,
the Microsoft System Center Configuration Manager,
but you can also use third party management tools
with a lot more features
and additional abilities if you want to.
Now, some organizations rely on automatic updates
from the Windows Update System,
but others decide they want to have complete control
over the installation of patches.
For large organizations, it is highly recommended
that you centrally manage all your updates
through an update server
instead of using the Windows Update Tool.
This will allow you to test the patch
prior to deploying it across your entire environment.
To disable Windows Update on your clients,
you simply need to disable the Windows Update Service
from running automatically on those workstations.
If you have a lot of mobile devices throughout your network,
you also to figure out
how you're going to do patch management for those devices.
The easiest way to do this
is by using a mobile device manager, or MDM,
which works like one of these patch management servers,
but has additional features as well.
Alright, now, when you come to testing,
you may not have your own dedicated test network
or lab environment to use,
but you still need to do testing.
So what are you going to do?
Well, one thing you can do
is split up your production network into smaller groups.
In organizations I've led in the past,
we use the concept of patch rings
when we deploy out new patches.
In patch ring one,
we have 10 or 20 end user machines
that we'll deploy our patches to first.
If it doesn't break anything on those machines,
then we'll move out into patch ring two,
which has a hundred or 200 people,
and this will include things like our system administrators
and our service desk workstations,
so we can instantly figure out if things are going wrong.
If that works successfully,
we'll then go into patch ring three,
which contains a thousand or 2,000 machines.
And finally we'll move out to patch ring four,
which includes everybody else,
and that may be 10 or 20,000 machines.
Now, the benefit of doing the deployments this way
as we move through the various patch rings
is that if there is an issue,
I'm only affecting a smaller group of users
before I break all the users on the network.
If I did to everybody at once,
I'd have 20 or 30,000 people
who are complaining when things break.
But by doing it in these smaller steps,
I only have 10 or 15 people who are yelling at me
and I can fix things quicker.
All right, step four, auditing.
Now, auditing is important to understand
because you have to understand the client status
after you conduct your patch deployment.
So I pushed out the patch.
Did it work?
During auditing, you're going to be able to scan the network
and determine if that patch that you pushed out to install
actually installed properly,
or are there any kind of unexpected failures
that may have happened,
and that meant that the patch wasn't really installed
or isn't doing the protection it's supposed to do.
Again, if you're using a tool
like the Microsoft Systems Center Configuration Manager,
SCCM, or a third party management tool,
you'll be able to conduct scanning
and verification of your workstations and servers
to ensure that the patches have been installed properly
and with no issues.
Now, if you're using Linux or OSX,
they also have built-in patch management systems.
For example, Red Hat Linux uses a package manager
to deploy RPMs, which are packages of patches
to your servers and workstations.
So the same concepts and principles are going to apply here.
Now, in addition to conducting patch management
across our workstations and servers,
it's also important for us to conduct firmware management
for our network devices.
After all, all of our network devices
are running some form of software,
and this is known as firmware
inside of our routers, our switches, our firewalls,
and our other network appliances.
If your network devices don't contain the latest
and most up-to-date firmware versions,
then you could have security vulnerabilities
and software bugs that could be exploited by an attacker.
If you look at the common vulnerabilities and exposures
or CVE website, you're going to see a long list
of vulnerabilities that we have
for all sorts of different networking devices.
Just select the Cisco devices
and you'll see a long laundry list of those
that have been patched and fixed over time.
So just like you need to patch your operating system
for a Windows or Linux computer,
you also need to update the operating system
of your network devices.
In a Cisco device, this is known as the Cisco IOS
or Internetwork Operating System.
Now, to update the IOS version,
you need to flash the firmware on that networking device.
Some manufacturers like Cisco
provide a centralized method
of conducting firmware management
inside your enterprise network,
and this helps with our patch management.
For example, Cisco uses the Cisco UCS Manager
to centralize the management of resources and devices
and to conduct firmware management
for your server network interfaces and server devices.
There's also third party tools
like Device Expert by Manage Engine
that allow you to upgrade, downgrade,
and manage the configuration of the firmware
for all of your network devices
using automation, orchestration, and scripting.
The bottom line here is that you need
to do firmware management
to ensure you have the right firmware versions
loaded onto those network devices
to ensure that you have the right security
for those devices,
just like we do with our workstations and clients
when we use patch management.