Software Deployment, Updating, and Patching

Transcription

1 Software Deployment, Updating, and Patching Bill Stackpole Patrick Hanrion A Auerbach Publications Taylor & Francis Group New York London CRC Press is an imprint of the Taylor & Francis Croup, an informa business

2 Contents About the Autbors xix 1 Introduction 1 Landscape and Land Mines 3 Best of Breed versus Risk Need 4 Updates and More Updates 5 More Work, Same StafF. 6 Configuration Management Solution 7 Update Management Solution 8 Goal and Scope of This Book 9 People Aspects of Configuration and Update Management 10 Process Aspects of Configuration and Update Management 10 Technology Aspects of Configuration and Update Management 10 Measurement Aspects of Configuration and Update Management 11 Definitions and Terms Used in This Book 12 2 System Lifecycle Overview 15 Configuration Management throughout the Lifecycle Process 17 Envision Phase 18 Strategy 19 Organization 22 Organizational Reviews 22 Budget 22 Planning and Design Phase 22 Determining Configuration Requirements 23 Determining Test Requirements 23 Determining Deployment Requirements 23 Determining Operation and Maintenance Requirements 24 Managed and Unmanaged Systems 25 Determining Training and Skill Requirements 26 Determining Performance and Compliance Baselines 26 Determining Organizational Requirements 27 vii

3 viii Contents Determining System Retirement 27 Documenting System Plans and Designs 28 Test and Stabilize Phase 29 Verifying System Configurations 29 Verifying System Interfaces 29 Verifying System Performance 29 Verifying Security Requirements 29 Verifying System Interoperability 30 System and Support Documentation Updates 30 Deploy Phase 31 System Build 32 Hardening 32 Installation 32 System Compatibility Testing 33 Change Control 33 Operations Verification 33 Security Verification 33 System Support Documentation 34 Operate and Maintain Phase 35 Adding New Software, Hardware, or Firmware 35 Changing Software, Hardware, or Firmware 35 Deleting Software, Hardware, or Firmware 36 Routine System Service 36 Retire Phase 38 Retirement Notification 38 Verification of Nonuse 39 Power Down 39 Remove from CMDB and Infrastructure Services (DNS, Directory, etc.) 39 Conclusion 39 3 Configuration Management Program Overview 41 Configuration Management Roles and Responsibilities 43 Management 43 Testing 43 Librarian 44 Administrators 44 Support 44 Strategy 44 Planning 45 Processes 45 Goals 48 Strategy 51 Policies 53

4 Contents ix Identification 55 Infrastructure and Facilities 55 Network Scanning 57 Procedures 57 Control 58 Policies 58 Change Control 59 System Control Tools 59 Status Accounting 60 Configuration Management Lifecycle 60 Configuration Management Change Status Modes 60 Verification 61 Compliance Checking 61 Compliance Remediation 61 Configuration Management and Its Relationship to Other Programs 62 Risk Management 62 Incident Management 62 Change Control 62 Information Technology Strategy 63 Update Management 63 Compliance and Audit 63 Operations 63 Information Technology Security 63 Conclusion 63 4 Configuration Management Planning 65 Planning 65 Processes 66 Goals 69 Strategy 75 Policies 79 Conclusion 81 5 Configuration Management Identification 83 Infrastructure 84 Hardware and Software Owners 84 Naming Standards 85 Base Architecture 86 Platform Standards 87 Software Standards 88 Intelligence 88 Configuration Management Database 89 Classification Filtering 90 Compilation and Storage of Information 91

5 x Contents Generalized Risk 91 Threat Analysis 92 Network Scanning 92 Vulnerability Scanning 92 Types of Systems and Scanned Vulnerabilities 93 Frequency of Scans 93 Frequency of Updates 93 Actions to Take Based on the Information Obtained 94 Reporting and Alerting Requirements 94 Escalation and Remediation Requirements 95 Identifying Rogue Systems 95 Testing Facilities 95 Receiving Updates 95 Testing Updates 95 Packaging Updates 96 Procedures 96 Installation and Configuration Guidance 96 Configuration Change Procedures 96 New Product Introduction Procedure 96 Risk Assessment 98 Compliance Monitoring 100 Conclusion Configuration Management Control 103 Policies 104 Change Policy 104 Identification Policy 110 System Software 112 System Lifecycle 112 System Usage 112 System Security 112 Change Control 114 How a Change Request Is Submitted for Each Update 115 Exception Process for Emergency Updates 115 Appropriate Change Window for Deploying Updates 116 Appropriate Backup and Rollback Requirements 116 Change Approval Requirements 116 Pre- and Postchange Notification and Reporting Requirements 116 System Control Tools 116 Asset Inventory System 116 Other Information Required to Determine Updating Requirements and Criticality 117 Deployment Infrastructure 117

6 Contents xi Primary Automation Methods 118 Secondary Automation Methods 118 Manual Methods 118 Communications Portal 118 Security Bulletins and Update Release Notification 118 Update Binaries 119 Discussion and Feedback Lists 119 Compliance Reports 119 Other Communications 119 Incident Response and Forensics 119 Forensics 121 Conclusion Configuration Management Status and Verification 123 Status 123 Configuration Management Lifecycle 124 Configuration Management Changeof Configuration Item Status Modes 125 Measurements 126 Verification 129 Compliance Checks 129 Compliance Remediation 132 Conclusion Deployment Processes 135 Selection Process 135 Needs Assessment 135 Vendor Assessment 138 Build versus Buy 139 Staffing Requirements 139 Hardware Requirements 140 Software Requirements 140 Budgeting 141 Skills Assessment 141 Training, Consulting, or Both 141 Solution Architecture Build Process 141 Application Build Process 142 Solution Architecture 143 Configuration Management 143 Connecting It Together 143 Trial 143 Hardening Process 144 Threat Modeling 144

7 xii Contents Vulnerability Assessment 147 Mitigating Vulnerabilities 148 Testing 148 Test Lab 148 Duplicate Environment 149 Change Process 150 Documentation 150 Software and Hardware Documentation 150 Organization-Specific Documentation 150 Installation 151 Installation Type 152 Installation Method 153 Installation Planning 153 Finalization 153 Installation and Operational Verification Process 153 Security Verification Process: Vulnerability Assessment 155 Initial System and Support Documentation 156 Conclusion Operate and Maintain Processes 159 Routine Service Tasks 160 Account Provisioning and Maintenance 160 Security Management 162 Storage Management 164 Performance Management 165 Update Tasks 166 Operating System and Application Updates 166 Patch/Update Challenges 166 Overview of ITIL: Patch Management Quadrants and Tasks Baseline System Measurement 171 Remediation Tasks 172 System and Support Documentation 173 System Support 173 Incident Management 173 Problem Management 175 Change Management 175 Release Management 176 HelpDesk 176 Conclusion Patch/Update Management: Assess Tasks 179 Setup and Periodic Assessment Tasks 179 System Baselining 180 Requirements Baselining 186

8 Contents xiii Subscription Baselining 186 Architecture Review 188 Functional Building Blocks Infrastructure Review 194 Test Infrastructure 194 Deployment Infrastructure 194 Monitoring/Discovery Infrastructure 195 Communications Infrastructure 196 Program Optimization Review 196 Ongoing Tasks 197 Information Technology Asset Discovery 197 Unknown System Remediation 207 Remediation Procedures 209 Conclusion Patch/Update Management: Identify Tasks 213 Identify New Updates 214 Relevance 219 Severity 220 Release Notes 222 Download and Verify 222 Quarantine 223 Acceptance Testing 224 Handover to the Evaluate and Plan Phase 225 Conclusion Patch/Update Management: Evaluate and Plan Tasks 227 Change Management 228 Request for Change 228 Release Management 230 Evaluating Deployment Risks 231 Planning for the Various Deployment Scenarios 232 Determining Deployment Scheduling 238 Developing Deployment Procedures and Packages 240 Handover to the Deployment Phase 249 Conclusion Change Management 251 Change Management Program Requirements 252 Change Management Policy: Scope 252 Change Management Policy: Process 254 Change Management Policy: Roles and Responsibilities 255 Change Management Policy: Authority 256 Change Management Policy: Compliance and Reporting 257 Change Management Policy: Communications Plan 258

9 xiv Contents Roles and Responsibilities 259 Managing Change 261 Change Request 261 Change Tracking System 263 Change Classification 264 Change Authorization 265 Change Advisory Board 265 Change Advisory Board Meetings 266 Change Evaluation 267 Approving, Rejecting, or Rescheduling Changes 269 Change Development 270 Change Review and Reporting 271 Conclusion Update Testing 273 Test Strategy 273 Test Planning 275 Test Scope: What Is Going to Be Tested? 276 Test Assignment: Who Will Do the Testing? 276 What Types of Tests Will Be Conducted? 277 Deployment and Rollback 279 Test Facilities 279 Software 281 Reference Materials 282 Staffing 283 Operator/Tester 284 Test Development 285 Test Procedure: Turning Goals into Targets 285 Test Suite 285 Test Case 285 Test Automation 288 Test Tips and Tricks 290 Only Test What Needs to Be Tested 290 Prioritize Your Tests 290 Maximize Coverage 291 Use the Best Tools 292 Minimize Target Interactions 292 Leverage System Automation 292 Leverage System Logging 294 One Piece at a Time 295 Watch your P's and F's 295 Conclusion 295

10 Contents xv 15 Patch/Update Management: Deploy Tasks 297 Deployment Preparation 298 Production Staging 298 Select Target Groups 302 Training 302 Backup 303 Communicate Rollout Schedule 304 Distribute and Install 304 Distribute 304 Summary 307 Install 309 Privilege/Permissions 310 Available Disk Space 311 File Usage 312 Manual Installation 312 Installation Triggers 313 Primary and Secondary Deployment 313 Pilot Deployments 315 Deploying to Build Environments 316 Monitoring and Reporting 317 Verifying Successful Installation 317 Reporting Deployment Progression 318 Handling Issues and Exceptions 318 Verifying Issues 319 Determining Impact 319 Rolling Back Deployments 319 Granting Exceptions 320 Review Deployment 320 Conclusion Baseline Compliance Management Processes 323 Role of Baseline Compliance Management 324 Program Requirements 324 Baseline Compliance Process 327 Task 1: Identify and Classify Assets 328 Task 2: Establish Ownership 330 Task 3: Define Baselines 331 Task 4: Scan and Measure Compliance 333 Task 5: Enforce Compliance 335 Task 6: Continuously Improve 338 Dealing with Unmanaged Systems 339 Conclusion 343

11 xvi Contents 17 Technologies and Resources 345 Tips and Best Practices 345 Tool Types 346 Configuration Management Tools 346 Inventory Tools 346 Build and Hardening Tools 348 CMDB Tools 352 Update and Compliance Management Tools 352 Update Management 352 Compliance Management 354 Network Discovery Tools 355 Microsoft Nbtstat 355 Foundstone/Symantec SuperScan 355 SolarWinds SNMP Sweep 356 Network Mapper 356 Services 357 Microsoft Network Access Protection 357 Cisco Network Admission Control 358 Notification Services and Resources 358 French Security Incident Response Team 359 SecurityTracker 359 Change Management Resources 360 Computer Associates Enterprise Change Management 360 Tideway Change Management System 360 Testing Tools 361 IBM Rational Software 361 Scripting Languages 361 Simulators 361 Mapping Tools 362 Packaging and Rollback Tools 363 Microsoft Sysdiff 363 Macrovision InstallShield 363 OnDemand Software WinlNSTALL Desktop Management Suite Reporting Tools 364 Crystal Reports 364 MS SQL Reporting Service 364 Monitoring/Audit Tools 364 Microsoft Operations Manager 364 Open Source and Freeware Tools 365 Shavlik HFNetChkPro 365

12 Contents xvii Standards and Frameworks 365 Information Technology Infrastructure Library 365 COBIT 366 International Organization for Standardization 366 National Institute of Standards and Technology 366 Conclusion 367 Glossary. 369 Appendix A Request for Change (RFC) Template 373 Appendix B System Owner Roles and Responsibilities 375 Appendix C Update Management Process Diagrams 377 Index 381