Upgrade, Patch, and Reboot: No! Too Hard?

How can it be that upgrading software and hardware is too hard? Or is it that the reboot is too hard?

We don’t actually want to reboot do we?

I know some people who deliberately do not reboot their computers until forced to do so by power outage or other dramatic events.

Or is it that a reboot has a small chance of screwing up the balance of the computer? I.e. the registry might become corrupted (example of a registry failure after restart)? This phenomenon happens during faulty (or ‘buggy’) patches. But since we have heard about these things, we think postponing the update (for months) is better.

The solution? Test the patches with a suitable copy by your IT department. So again we run into the problem of resources. The It department has to have a suitable test machine and has to have the time to test the upgrade with all of the software that you must use.

Accounting
Word/ excel (or Office)
Website software compatibility (Firefox, Chrome, Iexplorer)
specialized software.

So now what seems like a 30 min job at most turned into several hours. And remember now it also depends on the other tasks the IT department has. Updating servers are more complex which could take longer to update. This was likely the problem at Equifax where an Apache Struts application was not patched within a short time. “Learning From Equifax Breach” Sep27 blogpost.

And I don’t know if you noticed but there are patches every month, sometimes more frequently:

Here is an example of a past patch Tuesday (2nd Tuesday of the month) in 2015 on this blog

A single vulnerability may affect 8 different types of systems, and if you have many of those systems (due to not standardizing) then each system must be tested properly to figure out if the patch will work.

So it is not that the single act of rebooting is the cause of our consternation, rather it is the large testing regime that SHOULD be done. Of course a loose IT department can just wing it and patch without testing. On most months that would be ok, but periodically there will be problems and then a lot of downtime.

So ask yourself is there a lot of unscheduled downtime for different systems? then it may be time to do things differently. We do not want to be the company that is in the news due to a cybersecurity incident (which may have started due to an insufficient update process).

Like this: