Network Equipment Patching
Most organisations already have a policy in place for patching their servers and workstations. However, it is still apparent that many organisations do not patch their network equipment at all. In fact, those that regularly patch their networking infrastructure are in the minority.
There are a number of reasons why networking equipment is not patched. Perhaps the main one is that it is just not considered. Others are that it's not thought to be necessary, that patching is hard because there is no auto-update facility, and the fact that the required reboot will cause network downtime.
However, vulnerabilities are found on networking equipment and the potential impact of an exploited vulnerability on the network infrastructure is very high. The recent discovery of several vulnerabilities in Cisco's PIX and ASA product line is a case in point.
Over the years, the process for applying patches to mainstream operating systems like Windows and Linux has been getting easier, with automatic update and patch management solutions like WSUS. Unfortunately the patching process for network equipment is still in the Stone Age by comparison, with manual TFTP uploads being the norm. This means that there is no 'fit and forget' solution. Therefore, a network update schedule needs to be created.
For core network equipment, just like core servers, testing patches before they are pushed out to production equipment is vital to ensure that the update does not affect critical functions. This is especially important with emergency patches, which are often released at short notice any may not be subject to full regression testing.
Many organisations prefer to use mature versions of networking equipment software and avoid the very latest releases. Providing the version in use is still supported by the vendor and the new features in more recent versions are not required, this is often a sound decision because the frequency of patching is generally less for these older versions.
It is important that equipment at all of the organisation's locations is patched, including DR sites and branch offices. Just patching the head office network only solves part of the problem.
Organisations should ensure that they have a policy in place to patch their entire network infrastructure including firewalls, routers, switches and associated equipment, and that this is carried out at all locations.