1

I'm updating the OS on several servers before they run out of support. I'd like to say the new OS (Windows Server 2008 R2 to Windows Server 2016) is more secure because it includes all security patches made to date and developers would have had the chance to rewrite code with more knowledge of threats and vulnerabilities.

Then again... new software could expose new vulnerabilities by exposing new functionality.

In general, does the act of patching software decrease or increase risk?

2
  • 2
    In the long run it usually increases the security while in the short run it might decrease security because it accidentally introduces a new vulnerability. Jul 2 '17 at 11:56
  • Why am I asking? Because while I'm not a security export, a business representative will ask if this change makes our solution more secure, and I would like to offer some generic advice. :)
    – Kye
    Jul 3 '17 at 8:05
10

Patching addresses known risks while introducing unknown risks, like new unknown vulnerabilities, bugs, performance issues, etc.

That's why places like banks wait a while to quantify the unknowns before patching.

Patching is not something that should be done without a risk assessment. Do you leave known vulnerabilities in place because you fear availability risks? Do you mitigate the known and test the patch before deploying? You have to answer these questions for yourself.

I advocate having processes in place that patch immediately but also have a quick rollback and mitigate plan in place ("patch, test, rollback" instead of "test, patch"). From experience, the downtime from bad patches and rollbacks is less than the downtime from known exploits hitting a server, but those metrics can change at any time.

You are correct to ask this question, but the answer is far from clear or universally applicable (even with WannaCry experience being so recent).

4
  • 1
    You mean that banks are like Java where the major security flaws counter has to exceed 10+ before a new release becomes available?
    – user633551
    Jul 2 '17 at 15:03
  • @user633551 no, banks need to be up and running, even if they leak like a sieve - the costs of being down are more than the costs of recovering funds from a hack
    – schroeder
    Jul 2 '17 at 15:42
  • Hm, with WannaCry, the gap between patch and attack was just a few weeks, so depending on the "while", waiting might have turned out to be problematic. Jul 2 '17 at 16:55
  • This is why debian stable insists on not adding new features, but only patching security holes. That's why virtualbox from "evil company" had to be removed (their programmers are banned from telling about security issues), and why there was the iceweasel fork for a long time. (Mozilla enforced upgrade all-or-nothing to use the Firefox branding)
    – pipe
    Jul 2 '17 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.