Hello All,

If you guys don't mind, I was wondering if people could share there advice and their experience on patch management.  How often they patch their systems, every day, week, quarter, etc?  What tools they use and their experiences with those tools?  Whether they concentrate on critical patches instead installing all patches?

Thanks in advance.

A certain company I may or may not be familiar with, has used various patch management tools, from rolling our own, Bladelogic, Patchlink, and SMS for OS and common applications  Before any system is deployed, there is a risk assessment done on it, part of which involves a miniumum level of patching.

We patch the week following M$ Patch Tuesday.  I believe other applications are caught in our defense in depth strategy of vulnerability scanning.  If there is a known high or medium level vulnerability with an associated patch, then it is applied.  (Unless it is a business critical application and nobody wants to take the blame for something going wrong)

It helps that there are corporate policies in place which outline that patch management must be performed on a regular basis, it's up to the individual areas to figure it out for themselves.

Thank you everyone for the replies.  I agree that patch management depends on the policies of the organization. I thought it was a good question to ask the community since it is such an important procedure for an organization with a security conscience. I know companies have different ways and applications of accomplishing it.  I have seen SMS, shavlik, WSUS, Altiris, BigFix, etc. I was wondering if anyone was partial to one of them and why? 

Also, I have seen people argue how often it should be done due to the testing required to install patches. Personally, I think once testing is done, you can install all tested patches.  You never know if a low priority patch can be used for a higher vulnerability. 

That is why I just wanted to see how other security minded people handled the task. Also, I think VMware is perfect for patch management because of snapshot.  It is faster than using Ghost or Clonezilla.

Again, I want to say thanks for the comments.