sample Patching metrics table needed

sunhux
sunhux used Ask the Experts™
on
Anyone has a sample table (which I need to submit in monthly
ppt slide) for covering patching metrics?

I plan to have a column for virtual patches (as we use NIDS &
endpoint IPS) included, so columns like the following:

a) date vulnerability published by product principal
b) date virtual patch is released, tested in our UAT &
    implemented in Prod  (which I'll indicate as 'NA'
    if not available
c) date actual principal product (ie Oracle, , RHEL, Fwall
    vendor) release their patches & date scheduled to
    test in UAT & date to deploy in Prod

Any other information/columns that I miss?
 

In particular I have the following products to cover:
a) Solaris OS 10
b) Weblogic  middleware 12.2.1.3
c) Firewall
d) WAF
e) Oracle DB
f) RHEL 6
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Exec Consultant
Distinguished Expert 2018
Commented:
Consider
a) Patch Available Date (published by affected vendor).
b) Severity of Vulnerability (I.e CVSS score)
c) Affected devices (I.e. specific version and total count affected)
d) Affected System (I.e. Criticality and classification)
e) Patch implementation date (deployment to affected devices)
f) Unpatched device (count that yet to  e remediated)
g) Mitigation in place (include virtual patches, etc)
h) Reason for delay in implementing patch to all device (based on policy requirement such as within 2 weeks for critical vulnerability with patch made available)
i) Risk acceptance completion (for high and above, these should be reported to steering committee)
j) Status (closed, open, pending)

Not sure about virtual patch but I see them more of mitigation and the reason of not calling them out is the scorecard is supposed to be quarterly ( or based on policy requirement) asking otherwise it is going to be untenable for the teams to get such status. You should seek inputs on template from user before officiating it.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial