講義參考說明v1

1、Patching Planning12GoalPatch Management is a practice designed to proactively prevent the exploitation of vulnerabilities on IT devices. The expected result is to reduce the time and money spent dealing with vulnerabilities and their exploitation. Taking a proactive approach to patch management will

2、 reduce or eliminate the potential for exploitation and involve considerably less time and effort than responding after vulnerability has been exploited.General Information3Microsoft releases new patches each 2nd Tuesday of the month for Windows systems and its server products. Patches covers Securi

3、ty Updates of all severity levels by default. As to current IATA ITS convention, All new servers on the WSUS site will be updated to the current baseline. All Windows servers will be updated on a regular basis after Microsoft has released new Security Updates patch. The Windows Servers will be patch

4、ed via WSUS. WSUS downloads patches from Microsoft update on a scheduled basis.According to the WSUS SOP, the patch procedure we are following,How many servers we need to patch?45How can we delivery patch for 266 servers?All Servers include windows and LinuxWindowsWintel TeamVmware TowerLinuxLinux T

5、ower Allocated whole task as two parts divide by two OS platformHow can we delivery patch for 266 servers? -Wintel6Yolanda and Joker will be in charge of 80% totally effortsBefore deliver patch will get owners approval like Bomi and ArieAfter confirm the time slot with owner manually push patches to

6、 destination machinesAfter several round reboot of servers until no more patches availableWhen finished operation operator need summary how many servers had patched and reported to P.MHow can we delivery patch for 266 servers? -Linux7Konny leads the processPatches SelectionsKernel Updates (abbr. KU)

7、Security Updates (abbr. SU)App Updates (abbr. AU)Time WindowsYMQ Servers GVA shift (if reboot required) GVA Servers YMQ shift (if reboot required)Prod and Non-prod ServersFor Non-prod ServersWork with Arie and Bomi, go through the patch-up list, finalize the listRoll out the patch process for KU/SU/

8、AUFor Prod ServersStart until patches are verified on non-prod servers for 1 weekPatch up with SU/AU, excludes KUPrepare roll back plan8 When can you finish whole task?Whole task will enduring 6 weeksFrom 21st Feb- 3th AprEvery week will progress 15% (Almost 40 severs, Include Wintel & Linux)Whats t

9、he milestone looks like?Task Initialize Feb 22th- 28thD.C and Lync Servers 49 servers will finish patching at this stage 18% occupied totally efforts Feb 29-Mar 27This stage will plish 66% totally effortsMar 28- Apr 4Ending stage plish less 16% efforts9How about communication status in the task?Exte

10、rnal Discuss patch detail and progress with Arie on every ThursdayGenerate progress report and send to BJS IT on every ThursdayInternal Discuss some difficulties issue on regular meeting10Whats the report looks like?11Red ColorMeans those servers will be handle after two weeksYellow ColorMeans serve

11、rs will be handle at next weekGreen ColorMeans servers are handling now or already patchedEasy to read and understandingWhat did you do at last week?12Patched 24 D.C and AD servers Occupied Wintel server number 1/9Occupied Totally server number 9%Improve Suggestion13Improvement SuggestionsA change r

12、equest shall be submitted in SNOW each month for the scheduled updates for the month, owner or approver need to verify and approve the change. Keep everything under track. Thus the procedure will like, Approved change ticket in SNOWThe WSUS agent is installed on the Windows serverWindows Update serv

13、ice is enabled on the Windows serverThe BITS service is enabled on the Windows server All servers are patched to a baselineWhen Wintel team has received approved Change Request for implementation including a final “l(fā)ist of servers in scope” in SNOW, They will start prepare the patch deployment. The servers are listed in a collection in WSUS. The Patch will be advertised to the servers at least 2 days before mandatory time (installation time) to ensure that the patches