Stop for just a minute and consider the computing equipment you have at home or at the office. Can you tell me which pieces of software or the types of firmware that are installed, what their release levels are, and what patches and service packs may or may not be installed? If you can, you're really on top of things, or you've implemented a patch management plan.

The truth is that most individuals and businesses don't closely track or manage the patches or service packs needed to maintain their systems. When viewed in the context of all the other priorities in our lives, we often don't pay close enough attention to patches and service packs. Well, at least not until there is a major vulnerability, such as the SQL Slammer that arrived earlier this year.

Improving your management of patches and service packs isn't as simple as allocating more time for it. As with all things, there are a few wrinkles along the way. For example, the SQL Slammer did a lot of damage despite Microsoft's best efforts. Redmond had already made a fix available some six months earlier. In fact, the existence of the fix might have led to the problem. Hackers may have discovered the fix at the Microsoft site and bet that most webmasters had not implemented the patch.

Many companies chose not to install the patch because they either considered the potential vulnerability to be minor or they disagreed with the contents of the licensing agreement that arrived with the fix. Still others tried to install the fix for SQL Slammer only to find that it caused problems with their SQL Server installation.

This example shows how tricky it is to manage patches due to lack of time, prioritization issues, license agreement problems, and bugs that the fix may introduce. In addition, also consider that fixes may introduce new security problems. If you have anything more than a few systems, you also must factor in time for patch management for each machine, which may require more bandwidth than you have available.

With all these challenges and the fact that patch management is needed regardless of what operating system or applications you use, it is no wonder that home users and businesses alike find it difficult to grapple with the issue. And, patch management can be costly, too. Boston-based IT research firm the Aberdeen Group estimates that businesses are already spending upwards of $2 billion per year on patch management.

So, what can you do? As you might suspect, quite a few patch management tools have arrived in the marketplace. This is a good thing considering the huge increase in the number of security vulnerabilities that require proactive patching to avoid. Using a patch management tool (see accompanying table for some solutions) is a good idea if you have anything more than just a few systems.

However, a patch management tool alone will not "auto-magically" solve all your patch and service pack woes. Whether you are at home or at work, you need to use a very similar strategy (which may include patch management tools) to gain the upper hand on applying patches and service packs with security in mind.

Proactive patch management

First, get used to thinking about patch management when doing business or home security risk assessments. Do you want to shut down your machine to apply every single patch as soon as it arrives? Probably not, as you'd likely not get a lot of work done.

You'll have to live with some short-term security risk so you can balance your time for the myriad of other tasks you need to complete. How often should you stop and apply patches or service packs? If you're a home user, once a month might suffice, whereas once per week might be more practical at the office.

Along with risk assessment, you need to decide how you will manage the changes that patches and service packs bring. For example, what will you do should a patch or service pack cause a problem on your systems? And, how will you keep track of which patches are installed on various computers? Automated patch management tools can help with the latter point and some even can help you back off a patch or service pack, if needed. It is still up to you to manage when and how you will make patch and service pack changes, however.

If you are at the office, it may be best to apply patches and service packs to one or more "test" machines that are not used for critical business functions. You could then validate the results of the change on the test machines for a period of time (maybe 30 days) before deploying the patches or service packs on the rest of the systems that you have.

At home, you may or may not have an extra machine to test patches and service packs. If you do have an extra system, by all means, install new patches and service packs and test them before putting them on computers where you have critical documents, financial data, or digital pictures of the kids.

If, for whatever reason, you don't have extra systems at home or work on which to test patches and service packs, you'll have to employ a different strategy--time and observation. You won't want to install the patch or service pack right away since you won't have a way to test it. Instead, if you have identified the patches and service packs that you think you need, monitor the mailing list for that operating system or application and see what others are saying about their experience with the update.

For example, if you use Microsoft's Internet Information Server or the Outlook e-mail client, stay tuned in to mailing lists that relate to these products to see what others say about a particular patch or service pack. You might even post an inquiry asking others for their experiences.

Once you decide how you will handle risk and the change process involved in installing patches and service packs, it's time to perform an initial inventory of what you have on of your systems. Some patch management tools offer inventory capabilities and ongoing status reporting.

However, you might want to perform a manual inventory initially so you can identify the operating systems and applications that you must have. This manual inventory will allow you to remove those pieces of software that you don't really need, which will help reduce your risk of security vulnerability.

As you inventory, you need to note the release levels of operating systems and applications. In addition, you'll need to identify which patches or service packs you may have already installed. Once you have performed an initial assessment, you'll probably want to inventory roughly every 90 days and several of the available tools can automate this process.

Next, compare the output from your inventory against vendor or open source-supplied patch or service pack data to see if your systems are up to date. Some patch management tools can link to or integrate with patch supplier databases, which simplifies the process.

It is not necessary to install every single patch that comes out. Most patch announcements will include a severity rating that portrays how critical the patch is from the supplier point of view. Also, many service packs contain multiple patches and, for this reason, it is sometimes better and easier to wait. Here too, patch-management solutions will usually let you selectively install just the patches that you need.

Getting a grip on patches and service packs helps increase security, regardless of the types of operating system(s) and applications in play. Using proactive practices and available automation tools can go a long way toward simplifying patch management.