Solved

Best Practices for Critical and Security Patches in Banking Environment

Posted on 2014-03-23
5
385 Views
Last Modified: 2014-04-11
We have a bank client with whom we provide IT and Managed Services.  In the new contract, they are asking us to provide, among other things,  the following:

       Quarterly analysis and delivery of customized patch bundle, monitor patches as released.  Critical Security Patches shall be addressed quarterly or on an as-need basis. Critical Patch Updates will be provided within 3 days after OEM release.  (FIRST ABC BANK needs to be notified on all critical and high risk alerts). All patches require testing prior to releasing into the FIRST ABC Bank environment.

QUESTION:  What is the best practical way to apply critical updates and security patches that meets these requirements?

Microsoft recommends updates to be applied in a test environment first to ensure compatibility.  This is impossible.  There is no way the bank can maintain a fully functional "test" environment with all their corporate applications installed and current, to "test" Microsoft's constant releases, critical updates, security updates, fixes to updates, fixes to fixes, etc.

We are being asked to sign the contract with such wording in the contract---test before deployment.  

Please provide recommendations!

Thanks in advance!

Regards,
SFJCPU
0
Comment
Question by:sfjcpu
5 Comments
 
LVL 25

Expert Comment

by:Mohammed Khawaja
ID: 39948846
As part of the agreement and best practices, ask the bank to setup a test environment.
0
 
LVL 25

Expert Comment

by:Tony Giangreco
ID: 39948892
As mentioned above, setup a test environment with the same apps used in the bank.  Document the environment and run tests after applying the security updates. Maintain a log of results after each update is applied for your protection and the ability to backup the work you have performed.
0
 
LVL 25

Expert Comment

by:madunix
ID: 39949071
When implementing updates, I prefer to plan ahead, test on a non-critical server, create a change plan B, also be sure to read the release notes, there may be special instructions related some patches.
0
 

Author Comment

by:sfjcpu
ID: 39955886
Thanks for the above comments.  

With a complex network such as a banking environment, with many servers and applications, is it practical to set up an test environment where all Microsoft security and critical updates can be applied before deploying in the "real" network?  

Compliance requires them to be installed soon after release but there are unforseen risks when they are installed.  We all have a limited amount of time to research every patch!

I like "madunix's" comment on planning ahead, reading the release notes but it still comes down to deciding on:
1.  being compliant for the auditors,
2.  being at risk for having unpatched systems,
3.  taking the risk of installing updates in a live environment.  

This surely is a dilemma for many IT professionals!   How are others balancing the problem?
0
 
LVL 25

Accepted Solution

by:
Mohammed Khawaja earned 500 total points
ID: 39955988
We are not a bank but what we do is that we create snapshots for virtualized environments prior to patching as well as system state backup and for non-virtualized, we ensure to take a system state backup of the servers.  In case of failure, we could revert the snapshot or system state.
0

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
This Micro Tutorial demonstrates using Microsoft Excel pivot tables, how to reverse engineer competitors' marketing strategies through backlinks.
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question