There are many workstations on the company network with various kind of software installed: web browsers, OpenVPN clients, remote management agents, encryption utilities and other tools. Some of the applications update automatically, like Google Chrome or antivirus, but the others don't.

How do you verify if that software is up to date, and how to enforce update if it is not? Are you updating it manualy, use a dedicated software or enforce users to do so?

  • Or get them to use Linux, then you can update the entire system with a single package manager, optionally with unattended upgrades. – Lie Ryan Jun 7 '17 at 18:09
  • I know & use Linux, but it's not the case. – twk Jun 7 '17 at 19:11

There are multiple vendor products that exist to fulfill this purpose, and unfortunately we have to use more than one of them.

They are not foolproof; Microsoft SCCM may think we don't have any versions of Adobe Flash installed older than X.Y, but then (another product) finds a slew of them, while also missing versions of Internet Explorer below Y.Z.

(I think the divide comes, like all Microsoft solutions, where Microsoft products work best with Microsoft products but not third-party products, and third-party products work best with third-party products but miss the mark on interfacing with Microsoft products. Also inconsistent version string parsing across solutions)

What it comes down to is having some sort of agent on every local workstation that reads from the respective registry and reports software versioning information to a central server. From the central server you get an overview of what percentage of your infrastructure is up-to-date, and what remains vulnerable.

In a separate workflow, another server (something like WSUS, but again, the Microsoft divide rears its head) then forces update agents on the non-compliant workstations to update within compliance during the next update window. Automation tools like Puppet and Chef can be deployed to achieve something like this cross-platform; it's a simple problem with well-documented solutions.

Do NOT leave it up to users to diligently update. They won't, even under threat of firing.

  • 1
    there are products that allow you to do it all, for Windows, and without agents – schroeder Jun 7 '17 at 18:59
  • Can't we post products names here? I would like to see some. – twk Jun 7 '17 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.