Windows Server 2003 Security: A Technical Reference

Maintenance Strategies for Patch Management

Patch management should be a part of your organization's formal change control process but should have its own set of rules and processes. Patch management should be defined separately because it is much more time-dependent than most change requirements. A new software upgrade often has some flexibility in its implementation plan. However, an announced vulnerability is often followed by an attack that uses it. The timeframe allowed for the application of security patches is the time between the patch availability and the attack. However, no one knows when an attack will occur, and the timeframe is getting increasingly shorter. Patch management should include processes to update all servers, devices, ...