RE: Not patching clients??

["Dean, Bill" <[EMAIL PROTECTED]>]

I can confirm the nightmare of not patching clients. We have a modestly
secure perimeter. When Blaster came out, our server group patched all
350 servers in about a week. The organization drug their feet on
committing the resources to patch our 5000 clients and we did not have
SUS running on SMS yet. We had a "shove it down your throat and reboot
whether you like it or not" SMS package scheduled to go out on Thursday
at noon to all clients. Nachi hit us Thursday morning at 7:30am. A very
large Healthcare organization was down for 3 days. Lesson learned?
Maybe..Maybe not. My responsibility is primarily servers, It seems like
I still have to spend days convincing people we need to send out roll-up
packages using SUS and we don't have time for a month of testing. Things
are getting better though.

Long story short.. If you can't patch everything at one time, patch your
servers first and be prepared to take all of them off the network to
protect your data if an outbreak occurs. Then address your clients.


Bill Dean, MCSE 2000/NT4.0, CNA, CCA
Operating Systems Analyst


-----Original Message-----
From: Matthew L. McGuirl [mailto:[EMAIL PROTECTED] 
Sent: Thursday, April 29, 2004 5:34 PM
To: Patch Management Mailing List
Subject: RE: Not patching clients??

Robert,

Wow. What a nightmare scenario. If anyone in your organization has a
laptop and you have a DHCP server that will hand out IP addresses to all
who ask for one, it's just a matter of time before the fit hits the
shan.

As Slammer taught us, many networks, even those belonging to first
responders, are connected to the internet in unforeseen ways. The notion
of "protect the perimeter and pray for everything else" is ancient
history. Perimeters are porous and prayer doesn't hurt but it won't keep
your stuff safe.

There are vendors who address internal security in novel and very
practical ways. The one I suggest you check out is MetaInfo. They make
tools which make sure that every IP address that gets allocated is going
to a machine which meets specific authentication criteria. 

http://www.metainfo.com/ 

Cheers,

Matt McGuirl
Lucid Security



---
To unsubscribe send a blank email to
[EMAIL PROTECTED]

---
To unsubscribe send a blank email to [EMAIL PROTECTED]