SCCM PATCH DEPLOYMENT BEST PRACTICES UPDATE
SCCM PATCH DEPLOYMENT BEST PRACTICES SOFTWARE

This allows you not only to apply specific qualified patches only to the devices that are approved for them, but also gives you the ability to set specific schedules that meet your downtime requirements.

SCCM PATCH DEPLOYMENT BEST PRACTICES UPDATE

Tools like WSUS (Windows Server Update Services) and SCCM (Microsoft System Center Configuration Manager) can be utilized to define separate groupings for windows devices dedicated to the operations environment. But your environment may be running different versions or different vendorsвЂ™ automation software, so group the devices according to how you would be deploying these qualified patches. The qualified patches must now be staged in the industrial control environment where they are needed.

SCCM PATCH DEPLOYMENT BEST PRACTICES SOFTWARE

For example, Rockwell Automation validates MicrosoftвЂ™s weekly patches on its software and releases notifications that classify them as fully qualified, partially qualified or not qualified. When Microsoft releases patches, it is your responsibility to determine if those patches have been approved or validated for the software installed on your systems.

Investigate with your vendors to determine if their software has been tested and validated.

You may find both virtualized and physical compute devices running Windows operating systems consider leveraging technologies such as virtualization that allow you to consolidate compute and operating system surfaces into a single more manageable environment, in turn allowing you to speed up the patching process. So in most cases, itвЂ™s best to initially take a more passive approach to identifying what devices are out there and what their attack surface is. An active approach can carry some risk вЂ“ scanning the entire environment introduces traffic onto an OT network that might cause older or legacy devices to go down.

For collecting this inventory, determine if a passive or active approach is best.

Take advantage of tools that will help you understand what the known attack surface looks like. This includes a thorough inventory of your devices вЂ“ not just their identities but also their attack surfaces, and not just at a single site but at scale across a regional or global supply chain.

Start with identifying your vulnerabilities.

Here are some best practices to apply when developing a patch strategy. ThereвЂ™s no good excuse to avoid patching, especially when the stakes are so high.

The sad truth is, had the victims of those attacks been proactively patching, they would have been in a much better place to protect their assets. In short, the fixes had been available, but they hadnвЂ™t been implemented. Recent attacks including LockerGoga in March 2019 and NotPetya and WannaCry in 2017 were successful because they took advantage of known vulnerabilities for which Windows had already released patches. Patches are released weekly by Microsoft on its вЂњPatch Tuesdays.вЂќ As recently as May 2019, the company was releasing important patches related to warnings of potentially catastrophic вЂњzero-dayвЂќ exploits attacking Windows vulnerabilities, dubbed вЂњBluekeep.вЂќ OT patching is slightly different in that it needs to be scheduled during maintenance-related downtime вЂ“ but itвЂ™s just as important. Employees who have work-issued personal computers benefit from behind-the-scenes patches scheduled by IT to update software and systems to fix bugs or introduce improvements. The most common attack vector for any company is the Microsoft Windows operating system, on which almost all software runs. The good news is, itвЂ™s easy for manufacturers to adopt a proactive approach to patching as part of the overall lifecycle management process. Helping key stakeholders understand what patching is and why itвЂ™s worthy of funding can be daunting, but itвЂ™s the only way to raise awareness and secure buy-in for this crucial practice. Companies that ignore the need for more robust OT system security are putting themselves at unnecessary risk. These serve as a reminder to manufacturers of the importance of getting it right when it comes to OT patching.

Threats like 2017вЂ™s devastating NotPetya ransomware cyberattack costВ Merck more than $600 million andВ Mondelez $100 million. And itвЂ™s no coincidence, unfortunately, that those manufacturers have been some of the hardest hit victims of cyberattacks. Industrial organizations have been slow to recognize the importance of developing and using comprehensive OT patch management plans. This means that manufacturers need to be prepared to deal with threat actors looking to leverage known vulnerabilities that exist in within their OT environment вЂ“ and patch management should be part of the plan. As IT/OT convergence has become more prevalent, however, those threats have spread to the more-complex world of OT. Traditionally, and for many years, cyber threats have been handled almost exclusively by IT departments.

Sccm patch deployment best practices