Not patching clients??

["Paul Nelson" <[EMAIL PROTECTED]>]

Hi group,

Recently there has been talk in our IS group that patching clients is unnecessary and there will not be a dedicated person to research or resolve outstanding issues. We are primarily a Novell environment and have SUS running for a handful of systems, but that is about it.  We can push out patches via ZEN, but this is only done in emergencies (think Blaster).  Client-wise, that's absolutely scary.  We do however have dedicated individuals to cover any server or back-office system, so we are not in trouble there.  Our management's opinion is that network gear and the perimeter will take care of the business, so patching clients is irrelevant..

My question or issue to present to the group is how do you approach a situation when management considers it unnecessary to patch clients?  Being a technical person I know the impacts, but of course things don't change even after everyone talks about it.  We're in the situation where it almost takes a major exploit to wreck havoc and change opinions.  I'm surprised that only the server people are interested in defending the patch issue and they are the only ones taking action.

I know many people are (or were) in this situation.  After reading the survey posting in the group earlier this morning, it does not shock me that many organizations have only one person to handle this.  What do you do if you essentially have no one?

I'd like to see other's opinions or unique viewpoints on this.

Thanks,

Paul Nelson
Network Specialist
Medical College of Ohio
(419) 383-3638
[EMAIL PROTECTED]


---
To unsubscribe send a blank email to [EMAIL PROTECTED]