Are there any statistics on how reliable security patches are? Such as the fraction recalled or corrected?
Part of keeping a computer secure is applying security patches to it. The period between a patch being made available and installing the patch has a heightened risk of a compromise, since hackers have been tipped off about a vulnerability. If your only concern is security, you should therefore install all security patches, and install them as soon as possible.
Yet I know of professional (in the sense that they are paid to do the job) system administrators who do not install security patches because, they say, they are concerned that installing the patches will "break" their system in some way.
It easy to decry them as foolish. But a more nuanced analysis notes that their job is not simply to keep a computer system secure. The system has a business task to do, and a security breach is only one of several failures they must worry about. A rational approach takes into account the cost of each failure mode, the cost of protections against the failure, and its likelihood of occurring. Not installing patches can be a rational decision, at least theoretically, in some circumstances. More reasonably, delaying installation of a patch while waiting to see if it has problems could be rational in more circumstances.
However, for such decisions to be rational, the probability of a security patch breaking a business application must be known, and moderately high. Otherwise the given reason is more an excuse for laziness.
Just how likely is a security patch for an operating system component or framework (such as a web server) to break a business application running on that platform. Are there any statistics at all on how likely a patch is to break something?
Now, nobody really does a mathematical calculation of expected-gain, but rather operates on some intuitions about relative risk. I suspect the system administrators have a flawed intuition about the likelihood of a patch breaking their system. As a programmer of business applications, I find it hard to believe a patch to an operating system component or framework that had been reasonably tested by the vendor could break the application, unless the application was badly written and riddled with errors that posed other business risks anyway. But how can we correct such faulty intuitions without some kind of statistics on faulty patches? Such as the fraction of patches recalled or corrected?