WIXLIB

Lumension Guide toPatch Management Best PracticesWith the sophistication and sheer volume of exploits targetingmajor applications and operating systems, the speed ofassessment and deployment of security patches acrossyour complex IT infrastructure is key to mitigatingrisks and remediating vulnerabilities. Here are theLumension-recommended steps to cure yourpatch management headache.April 2012WP-EN-04-17-12

Lumension Guide to Patch Management Best PracticesIntroductionLaying the Groundwork1. Discover Assets32. Agent Maintenance 43. Classify Value and Risk84. Establish Workflow and Groups5. Identify Test Groups6. Staff Training81214Before Patch Tuesday7. Schedule Resources158. Reserve Down-Time for Servers159. Watch for Pre-Announcements1510. Confirm Reporting Up-to-Date1611. Deploy missing updates and prerequisites17On Patch Tuesday12. Study Vendor Information and Patch Tuesday Security Briefings 1913. Prioritize Potential Patches14. Change Control2015. Staged Testing211916. Installation of the Patches 22After Patch Tuesday17. Deployment History2418. Calculate Time to Deploy 2519. Monitor for Compliance2620. Checks and Balances2721. Metrics Improvement282

Lumension Guide to Patch Management Best PracticesIntroductionPatch and vulnerability management is a core component of your risk mitigation strategy. It is the first andlast line of defense against existing and new exploits – laying the foundation from which your AV and othersecurity technologies work. As the sophistication and sheer volume of exploits targeting operating systemsand major applications increases, the speed of assessment and deployment of security patches is key tomitigating risks and remediating vulnerabilities – and reducing costs.In this best practice guide, we are going to take a deep dive into a best practice process for patch and vulnerability management, developed by Lumension over thousands of customer engagements. This process– which is flexible and simple enough to be adapted into your environment – revolves around the well-knownmonthly release of security updates from Microsoft known as Patch Tuesday, and includes:»» Laying the Groundwork for a Successful Patch Process»» Before Patch Tuesday»» On Patch Tuesday»» After Patch TuesdayEvery company’s Patch Management process is going to be a little bit different, but what’s important about thesebest practices are: It’s a repeatable cycle. It’s based on calendar events – in this case Microsoft’s Patch Tuesday.It’s iterative – it can be tweaked based on what’s learned from previous patch cycles. It’s measureable.Documenting a process for the organization is really the best way to communicate the importance of patching your environment to the rest of the organization. In this best practice guide we chose to base the processon the well-known Patch Tuesday event, but you can align your patch process with other recurring IT tasks– with equally effective results – that works best for your organization.Laying the GroundworkThis section is about gaining an understanding of the machines under management and preparing the Patchand Remediation process. At a high level, this means identifying the systems to be managed, defining thepatch-roll out plan, and training the organization on the Patch and Remediation process.1. Discover AssetsWithin Lumension Endpoint Management and Security Suite (L.E.M.S.S.), identif y all hardwareand sof t ware on the net work and categorize themby platform, applications, depar tment, etc.Practical Steps:»» In L.E.M.S.S., navigate to Discover Assets3

Lumension Guide to Patch Management Best Practices»» Follow the Discover Assets wizard to set up an Asset Discovery job.»» As a best practice, administrators will want to schedule a more frequent recurring scan to identifynew endpoints that enter the network, then a less frequent scan as the number of machines undermanagement stabilizes2. Agent MaintenanceEnsure that all endpoint assets in the network have been fully installed with an automated patch solution.Install new patch management agents where required, if this task has not yet been fully automated witha group policy, login script or other technique. Identify offline agents and last contact date – either insideL.E.M.S.S. or by running the Endpoint Check-in report in Lumension Reporting Services (LRS), a free,integrated add-on to L.E.M.S.S.4

Lumension Guide to Patch Management Best PracticesPractical Steps:»» You can either set up a recurring Asset Scan oran Asset Scan/Install Agents job. In L.E.M.S.S., navigate to Discover Assetsor Discover Assets and Install Agents andfollow the wizard to set up a recurring or onetime job.5

Lumension Guide to Patch Management Best Practices»» We also recommend verifying agent availability and last check-in via LRS: Run the Asset Management report “Endpoint Check-in” in LRS. Select the desired date of last endpoint check-in (“Last Contact Date on or before”) – typically yourcurrent date. The report displays the list of endpoints that have not checked-in with the server in a giventimeframe. Ensure that agent communication is established with all the endpoints in your environment. Review endpoints that have not checked in recently and verify which endpoints need follow-up orattention prior to rolling out updates (training computers that are off vs. sales guy in field that needsto check in)6

Lumension Guide to Patch Management Best Practices»» It may also be useful to verify the agent versions and operating systems of your endpoints throughLRS, especially if you are planning to perform an upgrade to a newer version of L.E.M.S.S.: Run the Operational Report “Agent Version and Operating System Distribution” in LRS The report displays the mix of agent versions and operating systems in the endpoint environment,along with a detailed endpoint count. Ensure that all desired endpoints are listed, have the expected agent version(s) and communicateproperly.7

Lumension Guide to Patch Management Best Practices3. Classify Value and RiskDetermine which systems are most critical to protect based on the assets housed and/or the function theyprovide. Define the level of risk by criticality of system and how prone it is to attack.Practical Steps:»» Review your network topology and classify your assets by level of criticality.4. Establish Workflow and GroupsDetermine ownership, permissions needed and responsibilities for threat identification, testing and remediation across security, IT and business units. Define correlating system groups. L.E.M.S.S. will predefinesystem groups based on desktops, servers, physical or virtual hardware, as well as operating systems. Ifmore granular management is required, IT managers can create additional groups based on specific requirements, e.g. if servers are internet-facing, they may be grouped as high-risk but also as limited downtime. Use RBAC controls and set up permissions for desktop patch admin, server patch admin, as well asindividuals who have reporting access only.Practical Steps:»» Determine system ownership, uptime requirements,and patch windows for these machines. Define thepatch cycle for different managed systems.»» Define users and roles within your organization andwho needs access to which systems. On the Tools Users and Roles page, select theRoles tab and either select and assign existingrole(s) or create new roles.8

Lumension Guide to Patch Management Best Practices Next, assign users to the selected role(s) from the Users tab.»» Set up your categorized assets in custom groups in L.E.M.S.S. On the Manage Groups page, click on Custom Groups.Navigate to View in the upper right corner and select GroupMembership to create a custom group. Navigate to View in the upper right corner and select EndpointMembership to assign endpoints to that group. Click on Manage to assign endpoints to that group.9

Lumension Guide to Patch Management Best Practices»» Set Hours of Operation (HOP) for managed endpoints thatrequire a specific patch window. On the Manage Agent Policy Sets page, create a new agentpolicy and define the hours of operation. Then, apply that policy to specific endpoints or groups thatrequire this HOP policy.10

Lumension Guide to Patch Management Best Practices»» For machines managed over the WAN, it is recommended to set up a caching proxy per remotelocation to cache the package content. Deploy “Lumension Caching Proxy 2.7 for Windows” to a target machine in the remote location Create Agent Policy and set FastPath Servers – Both Interval and Define Servers Manage Agent Policy Sets Select Create and Save when completed Apply Agent Policy to your custom group Manage Groups Right-click on the group Select Policies Select Add Select Agent Policy andclick Save Note: Policy will not set until the next check-in to L.E.M.S.S. For more information on setting up a caching proxy please review the following resources: Best Practices Fast Path: KB article 523 Distribution Point (PDP) Does not Cache Large Deployment: KB article 23111

Lumension Guide to Patch Management Best Practices5. Identify Test GroupsBuild a representative sample set of each type of machine based on steps 2 (Agent Maintenance) and 3(Classify Value and Risk), in readiness for patch testing step 15 (Staged Testing). Make sure your test groupincludes a representative sample of platforms under management and includes a representative sample ofapplications in the environment, especially machines that have custom, in-house developed applications.As a best practice, at least one machine from each major group in the organization should be included in atest group.Practical Steps:»» Once test groups have been identified, create custom groups forthose test groups. On the Manage Groups page, click on Custom Groups. Navigate to View in the upper right corner and select GroupMembership to create a custom group.12

Lumension Guide to Patch Management Best Practices Navigate to View in the upper right corner and select Endpoint Membership, then click on Manage,select the desired endpoints and click Assign to assign these endpoints to that group.13

Lumension Guide to Patch Management Best Practices6. Staff TrainingTrain applicable staff on vulnerability monitoring and remediation techniques. At a minimum, administratorsresponsible for deploying Patch updates need to be trained in the Patch and Remediation application. As abest practice, there should be an internal resource for all employees to learn more about why it is importantto keep machines in the organization fully patched.Practical Steps:»» Use Lumension Learning resources to help build your internal staff training.Continued »14