1

I'm updating the OS on several servers before they run out of support. I'd like to say the new OS (Windows Server 2008 R2 to Windows Server 2016) is more secure because it includes all security patches made to date and developers would have had the chance to rewrite code with more knowledge of threats and vulnerabilities.

Then again... new software could expose new vulnerabilities by exposing new functionality.

In general, does the act of patching software decrease or increase risk?

  • 2
    In the long run it usually increases the security while in the short run it might decrease security because it accidentally introduces a new vulnerability. – Steffen Ullrich Jul 2 '17 at 11:56
  • Why are you even asking this? If security were a priority, you wouldn't be using Windows in the first place. You're arranging deck chairs on the Titanic – etherous Jul 2 '17 at 21:21
  • 1
    @etherous: Yeah, some of the worst attacks of the last decade (like Heartbleed, Shellshock, Gotofail, Stagefright, Dirty COW, ISeeYou, etc.) clearly show how insecure Windows is compared to Mac/Linux. Right? – Mehrdad Jul 2 '17 at 23:23
  • Why am I asking? Because while I'm not a security export, a business representative will ask if this change makes our solution more secure, and I would like to offer some generic advice. :) – Kye Jul 3 '17 at 8:05
10

Patching addresses known risks while introducing unknown risks, like new unknown vulnerabilities, bugs, performance issues, etc.

That's why places like banks wait a while to quantify the unknowns before patching.

Patching is not something that should be done without a risk assessment. Do you leave known vulnerabilities in place because you fear availability risks? Do you mitigate the known and test the patch before deploying? You have to answer these questions for yourself.

I advocate having processes in place that patch immediately but also have a quick rollback and mitigate plan in place ("patch, test, rollback" instead of "test, patch"). From experience, the downtime from bad patches and rollbacks is less than the downtime from known exploits hitting a server, but those metrics can change at any time.

You are correct to ask this question, but the answer is far from clear or universally applicable (even with WannaCry experience being so recent).

  • 1
    You mean that banks are like Java where the major security flaws counter has to exceed 10+ before a new release becomes available? – user633551 Jul 2 '17 at 15:03
  • @user633551 no, banks need to be up and running, even if they leak like a sieve - the costs of being down are more than the costs of recovering funds from a hack – schroeder Jul 2 '17 at 15:42
  • lol, exactly!!! now guess the banks tech association...;) – user633551 Jul 2 '17 at 16:05
  • Hm, with WannaCry, the gap between patch and attack was just a few weeks, so depending on the "while", waiting might have turned out to be problematic. – Hagen von Eitzen Jul 2 '17 at 16:55
  • This is why debian stable insists on not adding new features, but only patching security holes. That's why virtualbox from "evil company" had to be removed (their programmers are banned from telling about security issues), and why there was the iceweasel fork for a long time. (Mozilla enforced upgrade all-or-nothing to use the Firefox branding) – pipe Jul 2 '17 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.