The question I am about to ask is similar to the following question:
However, I would like to take the question a bit further or a bit deeper.
Consider the following environment, where a UCS virtualization layer, is hosting VMware ESXi instances, which themselves will be hosting Windows, Linux and other OSes, which layer should I protect in order to protect the underlying layers?
-> Hardware -> CPU -> RAM -> Mainboard -> Storage -> Operating System (UCS Management) -> partitioned "hardware" servers -> physical CPUs -> physical RAM -> Storage -> OS of VMware ESXi Hosts -> partitioned "virtual" servers -> virtual CPUs -> virtual RAM -> Storage -> OS of virtual Windows Server -> Microsoft Hypervisor -> virtual CPUs -> virtual RAM -> Storage -> OS of Microsoft Hypervisor Server/Client -> Microsoft SQL Server -> SQL Server OS (yes, SQL Server has its own OS)
Seeing as the various vendors are supplying patches for the various levels (VMware, Microsoft OS, Microsoft SQL Server), will it be sufficient for me to patch for example, only the first highest possible "physiscal" layer (UCS Operating system) to guarantee that the underlying layers will no longer be affected by the vulnerability?
The idea behind this question is to minimise the possible amount of patching that would have to be implemented to protect the underlying layers.
How far must I patch?