RE: Automating patch deployment

["Schmehl, Paul L" <pauls () utdallas edu>]

> -----Original Message-----
> From: Bassett, Mark [mailto:mbassett () omaha com] 
> Sent: Wednesday, August 06, 2003 9:21 AM
> To: full-disclosure () lists netsys com
> Subject: RE: [Full-disclosure] Automating patch deployment
>
>
> The good thing about SUS is that you can set it up to not 
> push out the packages until you approve them.  The SUS box 
> downloads all the critical updates and then they sit in queue 
> until you tell them it's ok to push them out.  I think that's 
> the best way to handle the situation.  Sure it creates a 
> little admin work, but I think the advantage is clear.  

The bad thing about SUS is that it uses Windows Update technology which
means it can be incorrect when determining if a box needs a patch.  This
means you can *look* like you're patched when you're not.

To me, that is unacceptable behavior.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html