1

We're trying to implement a patch schedule in our environment for both linux and windows systems.

I'm curious to hear how often other enterprise companies are patching their servers so we can get an idea of what the rest of the world is doing.

I've found plenty of documentation from SANS etc on the policy but haven't found much on the frequency of patching. Mainly I'd like some ammunition when the complaints begin from our admins; generally to avoid reinventing the wheel.

1
  • 2
    Whenever it is necessary. If it’s a security patch, it’s urgent.
    – Gumbo
    Feb 5, 2015 at 6:09

2 Answers 2

2

If it is a Microsoft environment, then you would benefit most by installing patches monthly, scheduling this just after Patch Tuesday each month.

Be prepared to break this schedule for critical, out of band patches though. Make sure that all patches are tested first in a pre-production environment before applying to production.

For other platforms you should do the same if there's a published update schedule. The aim is to patch production platforms as soon as possible once they have been tested.

Regarding standards, an example is PCI DSS v3 which states:

6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor supplied security patches. Install critical security patches within one month of release

So at the very least you should be looking at once a month, but I recommend expediting this for critical bugs with publicly available exploits (e.g. ShellShock).

1

I've seen enterprise companies that install all (required) updates in an acceptance environment the day the updates are released. Once installed in this environment, it is thoroughly tested.

If all goes well then they patch the production environment two weeks later. However, this goes for regular patching. If there are one or more security patches that are applicable to your environment it is recommended to do this as soon as possible.

Examples for immediate patching (within 24 hrs) are: Heartbleed, Shell Shock, GHOST etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .