Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 393
  • Last Modified:

Best Practices for Critical and Security Patches in Banking Environment

We have a bank client with whom we provide IT and Managed Services.  In the new contract, they are asking us to provide, among other things,  the following:

       Quarterly analysis and delivery of customized patch bundle, monitor patches as released.  Critical Security Patches shall be addressed quarterly or on an as-need basis. Critical Patch Updates will be provided within 3 days after OEM release.  (FIRST ABC BANK needs to be notified on all critical and high risk alerts). All patches require testing prior to releasing into the FIRST ABC Bank environment.

QUESTION:  What is the best practical way to apply critical updates and security patches that meets these requirements?

Microsoft recommends updates to be applied in a test environment first to ensure compatibility.  This is impossible.  There is no way the bank can maintain a fully functional "test" environment with all their corporate applications installed and current, to "test" Microsoft's constant releases, critical updates, security updates, fixes to updates, fixes to fixes, etc.

We are being asked to sign the contract with such wording in the contract---test before deployment.  

Please provide recommendations!

Thanks in advance!

Regards,
SFJCPU
0
sfjcpu
Asked:
sfjcpu
1 Solution
 
Mohammed KhawajaCommented:
As part of the agreement and best practices, ask the bank to setup a test environment.
0
 
Tony GiangrecoCommented:
As mentioned above, setup a test environment with the same apps used in the bank.  Document the environment and run tests after applying the security updates. Maintain a log of results after each update is applied for your protection and the ability to backup the work you have performed.
0
 
madunixChief Information Security Officer Commented:
When implementing updates, I prefer to plan ahead, test on a non-critical server, create a change plan B, also be sure to read the release notes, there may be special instructions related some patches.
0
 
sfjcpuAuthor Commented:
Thanks for the above comments.  

With a complex network such as a banking environment, with many servers and applications, is it practical to set up an test environment where all Microsoft security and critical updates can be applied before deploying in the "real" network?  

Compliance requires them to be installed soon after release but there are unforseen risks when they are installed.  We all have a limited amount of time to research every patch!

I like "madunix's" comment on planning ahead, reading the release notes but it still comes down to deciding on:
1.  being compliant for the auditors,
2.  being at risk for having unpatched systems,
3.  taking the risk of installing updates in a live environment.  

This surely is a dilemma for many IT professionals!   How are others balancing the problem?
0
 
Mohammed KhawajaCommented:
We are not a bank but what we do is that we create snapshots for virtualized environments prior to patching as well as system state backup and for non-virtualized, we ensure to take a system state backup of the servers.  In case of failure, we could revert the snapshot or system state.
0

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now