Server Patching Best Practices for Enterprise Patch Management
侨福管理十大赌博正规老平台
恶意网络攻击继续成为头条新闻. It seems like there is a massive new breach every month or so. The truth is that cyberattacks can happen to any business at any time. 和 although there a very few universal truths when it comes to information technology, one of t最好的办法s to reduce your risk is through timely server patching 固件更新.
企业补丁管理 并不是特别迷人. It doesn’t get the same attention that anti-malware and DevSecOps Tool Chains do, 但更重要的是. 给十大赌博正规老平台器打补丁可以确保您能够在恶意行为者利用潜在漏洞之前消除它们.
跳转到节
当然，补丁管理不是一件简单的事情. 你需要正确的策略和计划, and you must ensure that you’re adapting best practices to your business needs. We’ve developed a list of the most critical steps for patching cycles, as well as a rundown of the benefits of 补丁管理 for your servers.
什么是打补丁?
让我们从一个总体定义开始. Patching is the act of applying a change to installed software – such as firmware, 操作系统, 或者应用程序——纠正安全或功能问题，并在某些情况下增加新功能.
Now consider this: when the 操作系统 (OS) of your servers, 网络, 存储也得到了发展, 程序员编写代码来实现功能. In some instances, that code can be exploited by human attackers and malicious software.
原始设备制造商(oem)和软件供应商定期推出这些操作系统问题的更新，以防止不法分子利用这些问题. 这些更新被称为“补丁”.” So, patching is nothing more than applying the updates delivered from the software authors.
这有点过于简单化，因为打补丁是一个复杂的过程，适用于您组织中的所有网络连接设备(任何带有IP地址的设备都应考虑在内)。. 您的组织使用的每个应用程序也需要补丁和更新，以防止漏洞利用. 在尽量减少停机时间的同时编排这些补丁的安装是至关重要的，但也是非常具有挑战性的.
为什么补丁管理很重要
为什么企业补丁管理如此重要? First, patching can improve server, 网络, 存储, and application performance. 它还可以增加功能——一些更新提供新功能或扩展现有功能.
然而, 养成良好的补丁管理习惯的最重要原因是减少安全漏洞. 根据 近期脆弱性响应研究, 在遭遇数据泄露的公司中，多达60%的公司意识到没有实施安全相关补丁.
补丁管理vs. 变更管理
Patch management is the technical process of managing and implementing software updates for servers, 网络, 存储, 和应用程序. 变更管理, 另一方面, 业务流程是否用于计划, 批准, 沟通, 测试, 并编排这些补丁的实现. They work together to ensure that patches are applied correctly, 及时, and without a detrimental effect on the organization, 比如意外停机.
十大赌博正规老平台器补丁的7个最佳实践
While patching is critically important, it’s just as important that you do so correctly. 补丁管理行业标准可帮助您在供应商提供补丁后尽快解决安全漏洞. Below, we’ve outlined the most important 补丁管理 best practices as recommended by the National Institute of Standards and Technology (NIST).
1. 把库存
第一步是盘点. 您应该了解组织中需要随时更新的设备和应用程序的数量, but this type of 补丁管理 audit goes even deeper. 探索这些资产之间的依赖关系非常重要，这样您就可以预测由于It补丁流程无效而导致特定设备或应用程序不可用时会发生什么.
2. 评估风险
Next, assess the risk for each component you identified. For instance, is a server at greater risk than a particular app used on just a few workstations? Some of the things you’ll want to consider during this stage include:
- 漏洞被利用的容易程度如何.
- The duration of time in which a system has been left unpatched.
- 如果系统访问Internet.
- 漏洞扫描的结果.
By assessing the risk level for each component and system identified during your inventory, 你可以创建一个准确的时间表.
3. 制定时间表
您应该多久执行一次补丁管理? 使用您在前面步骤中学到的知识来建立更新系统和组件的时间表. 时间表应该是什么样的?
推荐的补丁时间表
The recommended patching schedule should look something like this:
- 每月一次, 更新桌面操作系统, 恶意软件和防病毒软件, 安全工具, VPN客户端, 客户端应用程序.
- 每月一次, update server 操作系统 和应用程序.
- Every quarter, update physical and virtual appliances, management tooling, and hypervisors.
- Every six months, update your infrastructure firmware, drivers, and management software.
4. 创建补丁管理策略
In addition to implementing an informed patch schedule, it’s also important that your organization adheres to 补丁管理 policy best practices. This policy should spell out when systems and components should be scanned, 如何应用补丁, 在特定情况下如何确定优先级, 和更多的.
NIST补丁管理策略
国家网络安全卓越中心(NCCoE)最近发布了两份关于企业补丁管理政策和标准的新最终出版物.
NIST特别出版物(SP) 800-40修订4， Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology recommends that leadership at all levels of an organization, along with business/mission owners and security/technology management teams, 是否应该共同创建一个企业战略，以简化和操作补丁，同时提高其风险的降低.
Nist sp 1800-31; 改进一般IT系统的企业补丁:以更好的方式利用现有工具和执行流程, 演示了如何使用工具来实现SP 800-40 Revision 4中描述的补丁功能. 它还展示了组织如何在常规和紧急修补情况下使用商业工具, as well as implementing temporary alternatives to patching.
这两份文件都反映了及时的补丁管理策略和政策对于努力保持强大的网络安全态势的组织的重要性.
5. 跟踪补丁可用性
如果您不确定这些补丁何时发布，则不可能使您的十大赌博正规老平台器与最新的补丁保持同步. Patch availability tracking ensures that you know what patches are being released and when. 然后应该创建一个时间表，以确保尽可能快地安装高优先级补丁，同时为低优先级补丁创建一个总体计划.
Remember that every vendor will have a different patch/update release schedule. Most of them publish this information to their websites, but some may also 沟通 their update schedule in less typical ways.
跟踪补丁可用性将要求您有一个适当的流程来监控供应商通信，以便您可以随时了解何时提供更新和补丁.
6. 集中补丁管理
集中式补丁管理是一种解决方案，旨在帮助限制在整个组织中实现补丁所需的时间和精力. This is a software-based approach that eliminates the need to manually apply patches; it works across multiple 操作系统 and can even work in the cloud.
7. 自动补丁管理
Automated 补丁管理 is the next step up from centralized 补丁管理. 比如集中解决方案, automated solutions rely on advanced software to eliminate manual updates. 然而, in this situation, you allow the software to handle all aspects of patching and updating. 这可以确保您的系统始终是最新的，并且能够快速地减少安全漏洞.
选择合适的补丁管理合作伙伴
很明显，成功的补丁管理对于发现和解决安全漏洞以及提高软件性能是不可或缺的. But despite widespread recognition that patching is effective, 攻击者经常利用未打补丁的软件, many organizations do not have the resources to keep up with regular patching. 好消息是? You don’t have to be responsible for your organization’s 补丁管理 any longer.
IT基础设施管理十大赌博正规老平台 通过简化计算环境的管理，简化IT操作，并为您提供事件管理, 补丁管理, 和修复. Our 7×24 Enterprise Operations Center (EOC) engineers, 结合我们强大的监控工具, 将继续监视您的十大赌博正规老平台器并执行定期补丁，以释放完整的团队成员，使其专注于创新而不是维护的更重要的项目. OS Patching specifically is currently available under our Plus (定义的补救)及Full (企业管理)侨福™支持分层.
Looking to take 补丁管理 off your IT team’s to-do list? Contact Park Place Technologies today to get a quote and learn more about what our 十大赌博正规老平台器管理和监控十大赌博正规老平台 可以为您的组织做什么!