• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 472
  • Last Modified:

patching and audit

What do (or should) auditors be looking for in terms of process and documentation for patching of windows servers (guests running 2008 server on esxi)? What kind of weaknesses or lack of documentation/process would they pick issue with? What is best general practice, what can go wrong with the process? If you have ever had your WSUS procedures or a corporate wide patch management policy audited, what areas did they focus on.
0
pma111
Asked:
pma111
  • 2
  • 2
1 Solution
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
firstly, it should not matter whether the server is physical or virtual, and also what OS type.

Do the patches which you are deploying,. fix a secutiry risk within your organisation?

how are the security patches being regression tested in your environment?
0
 
pma111Author Commented:
Thanks

1)Do you maintain any sort of documentation on 'this is how we patch and the steps we follow?', if so what do you refer to this document as and is it important to have such a document?

2) Secondly how would an auditor verify the last patching exercise followed that process to the letter , what evidence would their be?

3) And thirdly do you set targets on patch application, ie 3 critical security patches released by MS - we aim to apply them within x days? If yes what do you refer to that target as?
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
1. All documentation is maintained by the patch system that's used. Patches are issued are checked, against Microsoft's KB to check what they do. Patches are then tested against the test environment, on a PASS OR FAIL basis, and documented on a monthly basis.

2. Check the Excel spreadsheets of Patches deployed and tested.

3. All patches are regression test, after patch Tuesday, and then applied a 7 days later, providing Change Control/Change Board Approve Patches for Services. Sometimes some patches are rolled out into schedules for server maintence windows.
0
 
pma111Author Commented:
So is your overall workflow from patch release to patch applied documented? A scan of our systems show they are almost fully patched - but there's no real documentation on how they did the whole patching and decision process? Is this a big risk in your opinion? If yes can you elaborate why the patch process needs a documented step by step? Thanks
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now