I'm trying to implement an automated patching program at a small SaaS provider.
When a customer signs up for our software, we provision them a Linux VM in our primary datacenter.
Each customer also gets a QA and sandbox server in another datacenter. All the servers in this datacenter are registered to a central Linux patching tool, so that we can do bulk automated patching and this works well.
However, I'm concerned with doing the same in the primary production datacenter. The Linux patch management tool has the ability to push packages/files to any machine that is registered to it. So in the event that this patch management tool is compromised, an attacker will have access to compromise all our customer servers.
In the interest of isolating each customer from each other and preventing an attacker getting access to further machines, how can I centrally manage these production servers? Are there any best practices for this type of situation, or do I bite the bullet and patch each server individually?