Cloud Native Operational Solutions - Patch Management

martezreed over 5 years ago 3 minute read time

Patch management at any sort of scale has always been a mundane and time-consuming task that most administrators would like to avoid at all costs. With the proliferation of DevOps methodologies and the public cloud, the practice of immutable infrastructure has eliminated the need for patch management in the eyes of some, given the fact that there would be no long-living servers. In contrast to that notion, most environments have long-living servers that are still around and will be for the foreseeable future due to various reasons. The public cloud and DevOps are the new flavors of the month in IT for many valid reasons, but patch management is still a critical aspect of securing IT environments that can be made easier through the use of managed solutions.

The benefits of managed patch management are:

Simplified Management - The patch management solutions offered by cloud providers provide a single management interface to simplify operations. In addition to the proverbial single pane of glass most cloud providers provide a simplified manner in which to deploy the patch management agents to instances to help speed up deployment.
Scalability - Fully managed solutions have been built to scale to the largest of environments without any performance impact. This eliminates the need to rearchitect the patch management deployment to scale with the needs of the organization.
Managed Upgrades - One of the advantages of utilizing a fully managed patch management solution is the fact that the system for managing patches is automatically patched itself. This is a major win for many organizations that are already short on IT staff.

Managed Deployment

The following solutions are managed deployments. This means the patch management software company has added a deployment solution to the respective cloud provider's marketplace to allow the infrastructure to be provisioned with the click of a button.

ManageEngine Patch Manager Plus

ManageEngine Patch Manager Plus is a patch management solution that supports Windows, Linux and Mac OS endpoints. This solution is only available on AWS as a marketplace deployment option.

SaaS Deployment

The following solutions are Software as a Service (SaaS) deployments. This means the patch management software company hosts the software for its customers.

Kaseya VSA

Kaseya VSA is an RMM management platform created by Kaseya that includes patch management functionality. The patch management solution includes support for Windows, Mac OS X and 3rd party software.

Automox

Automox is a next generation patch management platform hosted in AWS that aims to provide a unified platform for managing patches across all environments. The patch management solution includes support for Windows, Mac OS X, Linux and 3rd party software.

Fully Managed

The following solutions are fully managed patch management solutions such that the cloud provider manages your patch management platform on your behalf and allows engineers to focus on ensuring that instances are up-to-date with their patches.

AWS Systems Manager (Patch Manager)

Patch Manager is AWS' managed patch management solution that rolls up underneath AWS Systems Manager. Patch Manager supports both Linux and Windows operating systems as well as on-premises workloads.

Azure Automation (Update Management)

Update Management is Azure's managed patch management solution that rolls up underneath Azure Automation. Azure Automation Update Management supports both Linux and Windows operating systems.

Patch management for many is simply a necessary evil that often goes overlooked but has a critical impact to the security posture of all environments. Leveraging a managed solution for patch management helps to make life that much easier for administrators given that patch management doesn't provide any business value for most organizations, but it has to be done lest the organization become another headline about a security breach due to unpatched systems.

Top Comments

martezreed over 5 years ago +1

SolarWinds Patch Manager would fall into the category of an unmanaged patch management solution that can be installed by administrators in a public cloud environment.

martezreed over 5 years ago

That becomes one of the major advantages of leveraging public cloud for test environments to be able to test patches against numerous applications quickly and fairly cheaply based upon being able to terminate those instances after they are tested. Of course the testing wouldn't be exactly a one to one but it definitely beats not being able to do any testing.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
tallyrich over 5 years ago

Agreed. The downside is that it makes it even harder to get management to buy into test environments for all the various applications.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
martezreed over 5 years ago

It's definitely all about what we have become accustomed to in terms of perception. Bad patches are definitely far and few between nowadays but we just expect everything to work and be perfect these days.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
tallyrich over 5 years ago

I remember the days where you only installed a patch if it was completely necessary and fixed things in your environment - even then you hoped it wouldn't break things. Now it has flipped and patches should be installed as soon as possible to keep out the baddies. Yes, sometimes things still break, but when you consider how far things have come "breakage" isn't nearly as big of an issue as it used to be. (Yes, when things break it seems like it's huge, but keep it in perspective)
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
martezreed over 5 years ago

I honestly think the cloud is a much better location for patching from the perspective of being able to fully test patches before rolling them out to production. The ability to spin up and entire environment, test patches and tear it down within a short period of time is a major benefit in my estimation. In terms of control I think in many organizations it's the same level of control that the one managing patches has which is just OS level access while someone else manages the virtual machine or bare metal hardware.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel