re: Patch Management, the necessary evil

Yuri Diogenes [MSFT] — Mon, 09 May 2011 11:59:14 GMT

Thanks for your perspective on this. The only problem with this approach (don’t enforce patch management and don’t have AV) is that you are exposed to risks that sometimes you don’t even know. What if confidential information were leaked during the time that the AV was out of date or the machine was unpatched? Can you measure the damage? Did he really save money for the company in this case? There are risks that are not included in this scenario’s calculation that are key to define the true value of the final damage. In any case, thanks for sharing your ideas.

re: Patch Management, the necessary evil

Massimo — Sat, 07 May 2011 20:42:38 GMT

I will give you a different (although IMHO interesting) point of view:

Feb.2010. Mid-to-large company: -3800 workstations, 250 servers. With no antivirus at all, and NO patching policy...every person decided the patching policy for his/her workstation. In Feb.2010 they acquired a new IS Manager, and in the same month we acquired the company as our client; one of our first job was to deploy an enterprise antivirus to all workstations and servers.

During the Conficker outbreak, which spread in that company in March 2010 (before starting our antivirus deployment) all the servers and workstations were infected.... the domain controllers, the exchange servers, the SQL servers, everything... we manually cleaned up everything in about 4 weeks.

At the end of cleaning and deploying the AV, when everything was back to normal, the new IS Manager, dropped a phone call to the old IS Manager to make a summary of events, and to tell him "hey man! see what your stupid missing policy about AV and Patches did". The OLD IS manager answer was quite surprising:

"Hey there, tell me: how much did it cost the outbreak for the company?... ok now, calculate how much you would have spent in AV licenses renewal in the last 10 years and in manging patches for all workstations... and now tell me... which costed the most?... I'll tell you! The company saved money thanks to me".... no comment (and the sad thing is that... maybe he is true)