Does a virtualised Windows machine without internet access need (security) updates?

Question

I recently saw a Windows 7 machine (virtually running in a Xen environment) and used in a production network to perform certain automated tasks.

This system was missing over a 100+ Windows update including critical security updates. The explanation that I got from the system administrator was that this system is only accessibly in two cases:

1. Over the Xen console when connected to the management virtual private network (VPN).
2. When connected to the production VPN over Windows Remote Desktop (RDP), using two factor authentication (2FA, Vasco Tokens) authenticating against an active directory (AD).

All servers in the production network are behind a Barracuda NG Firewall.

In his opinion that should do the job and updates are not required because the firewall blocks all incoming and outgoing internet traffic to and from that machine.

It feels unnatural not to update even when the machine is "isolated". So, does a virtualised Windows machine without internet access need updates and what are the potential risks when this machine isn't updated in this case?

Note: I allowed the firewall to let this machine connect to the Microsoft update servers in order to fetch a list of the missing updates. The in- and outgoing internet connections to/from this machine are all blocked in the firewall again.

Answer 1

You both have a point, so here are some questions to consider. My answers to those questions weigh on the side of patching.

When someone connects to it over either of those VPNs, what controls are there one what can be transferred? Any way of getting data onto a machine is a way of getting malicious code on there. This even includes typing (although I hope your admins are a bit more sophisticated than people tricked into typing "rm -rf /" on a unix box).

Layered security would suggest that the machines have some basic ability to look after themselves, but is opening up a connection of some sort to the outside world worse than no connection at all? What about vulnerabilities in the tools you do use to connect.

Don't forget that updates are not just security updates. You may well want updates that affect stability to get installed (but as with any production system you should be testing them first).

Answer 2

I agree with mootmoot, there is no such thing as a closed system if it talks to other machines/there is more than one person accessing it.

You could have a problem if someone breaches the xen server, if someone gets the keys to the vpn, if someone walks up to the host machine with a usb stick...

The vm is in a relatively isolated position, but there are still IO channels hooked up to it and an IO channel is always a potential attack vector.

Update it after you've backed it up. More security is better.