Managing patches on your operating system
is very similar to managing the patches for applications.
We spoke of that in an earlier video.
And it's just as important for our apps.
We want our operating systems to be secure.
We also want our operating systems to be stable.
So there will constantly be updates
that come out for our operating system to work.
In fact for Windows we get at least one update every month.
And we always have to be sure that we're
keeping our systems up to date.
Sometimes we get service packs, though.
After a certain amount of time goes by you've
got a lot of different patches.
And when you bring up a new operating
system for the first time we have
to make sure that all of those patches are installed.
But if it's been six months, and every week a new set of patches
has come out, then we may end up having
to download install a lot of patches.
So one of the things that Microsoft does
is create these things called service packs, where
you can install all of the patch is at one time.
And you can even integrate them into the operating system
installation so that when you install the operating
system for the first time it may be at a certain service patch
or service pack level.
And that makes it much quicker.
If we know we can install Windows 7
and automatically have it service pack one,
we only need to install the patches that
have occurred since service pack one was released.
It makes a little bit faster for our patch management.
As we mentioned, these updates are usually
going to occur every month.
You're going to get incremental updates.
And these are going to be relatively important updates.
Microsoft doesn't a release an update unless it's
something that does affect security and stability,
and it puts it into different categories.
It tells you about important updates.
And it tells you about optional updates.
If you're updating a driver in your computer
that does not have a security concern associated with it,
maybe that's an optional update.
But if this is part of the operating system, where
a security problem has been found,
it generally gets put into the important update category.
Which brings up another point, which
is what if you find a really, really bad vulnerability
before the update time comes at the every month time frame?
Well then that is something called an out-of-band update,
where Microsoft has been presented with a problem that
affects a large number of end users
and it's too long to wait to put this patch out.
So they'll create an emergency update
for the zero-day and these other important vulnerability
so that your operating system remains as secure as possible.
In our previous video, we spoke about the type of updates.
But I thought a review would be useful
depending on how you manage updates in your environment.
For Windows, you may want each individual machine
to do a Windows update, which is 1 by 1 by 1.
Or if you're a larger, domain-type environment,
you might want to take advantage of Windows Server update
services so that you have one central server,
and you get to decide how you roll those patches out.
Apple, of course, and Linux, has also other options
to be able to update all of the operating system
patches, security updates, and everything
else for those operating systems.
This update process for operating systems
isn't exactly seamless when you get
into a large and complex environment.
For our home computers, we tend to turn on updates
and just have it download the updates and install them.
We don't care very much.
But we also have to consider that, when we are installing
these updates, they might introduce other problems.
They might break an application that we
use in our environment that is a mission critical app.
This application must run for us to be
able to perform the duties and functions of our organization.
So you don't want to install a patch
and suddenly your entire business
comes to a complete halt.
So sometimes you have to pick and choose
exactly what patch you want to install.
And that's when that Windows update server
can be really, really useful, because you
can deploy the patches as you would like.
Maybe you'd like some patches to be installed, other patches not
to be installed.
You can control that all from a central place.
That central management really gives you a lot of flexibility
not just with the type of apps that are being deployed,
but also the bandwidth, because that central update server is
the only one downloading the patches.
Everybody else is getting their patches
from this internal server.
And you're saving a little bit more bandwidth
on your internet connection.
No matter what system you use, or how you deploy these,
patch management becomes an incredibly important part
of your overall security strategy.