I'm working for a public sector organisation (around 6000 staff) with a mixed IT skill set. We're looking at setting up a patch advisory board to assist in server patching.
The plan is to have a team from different areas of the business (Apps, DBs, infrastructure, etc) to review each patch and then approve whether they're installed on any of our 1100 servers. Typically the patches reviewed will be from below.
https://portal.msrc.microsoft.com/en-us/security-guidance
My questions are:
How feasible is this approach given the work, effort and time involved to regularly understand dozens of patches and then decide whether to apply them?
Given that we don't fully understand our own servers and the patches, reviewing each patch doesn't guarantee success.
How many of you use a patch advisory board in your current work place?
As opposed to just applying critical and security patches on dev and test before moving to production
Thanks