RSS |
 |
| W O R K S H O P | |
| |
NT 4.0 Patches: Protection and Prevention July 26, 1999 By Jonathan Feldman In systems administration, as in comedy, timing is everything. It used to be easy to decide when to deploy a service pack or hot fix for any operating system: If your site was experiencing problems, you'd start patching; otherwise, you'd do nothing until age and wisdom proved the patch to be a cure and not a new disease. Nowadays, though, pervasive connectivity and security concerns make it trickier to judge when to stay current with hot fixes and security patches. Do you install the latest and greatest patch--possibly afflicted with the newest and scariest bugs--or do you wait for some other guinea pig to try its luck first? Patch strategies for Windows NT 4.0 or any other OS involve a couple of different areas, including lab testing, roll-out tactics and consistency planning. We recently tested Service Pack (SP) 5 for NT 4.0 in our Savannah, Ga., labs by updating NT servers running third-party software, such as older virus-protection applications and Novell's NDS for NT. We also tested several recovery utilities, including tools from Winternals Software and Stac Software, all of which can help you recover a crashed NT system's NTFS (NT File System) partition.
SP5 packs all the post-SP4 hot fixes into one convenient package, which sure beats looking up and applying more than two-dozen discrete fixes. But does "no new features" mean "no new bugs"? Though it looks good so far, not all bugs have been discovered yet--witness the WINHLP32 security exploit, reported and hot-fixed two weeks after SP5 shipped. There's surely a good argument to be made for leaving your NT servers alone. If you have a reasonably generic NT configuration, a hot fix or two won't cause much damage, but any time you introduce complexity into a patch situation, such as when using third-party system software, you may encounter serious problems. Naturally, you follow the Microsoft README advice of stopping third-party system services and making sure that you're current on device drivers before embarking on a patch adventure. But any time you touch a server--updating a device driver doing routine administration, for instance--you risk mishaps. In the final analysis, however, there are more compelling reasons to patch than not to patch. In particular, NT's much-publicized security bugs make a case for patching (check out www.ntbugtraq.com, probably the Internet's best source of NT bug reports). Your production network should have both a firewall and an intrusion-detection system, but whether or not it does, fixing known NT security problems should remain a high priority on your network checklist.
Getting There We suggest starting your own lab testing as soon as a fix is released, and giving it three months before you begin limited deployment. Of course, vital security or denial-of-services fixes, such as the post-Service Pack 4 DOMAIN_CREATE_ALIAS exploit, may bump up this schedule. When deploying a fix, consider three levels of risk: none, low and high. No risk, of course, is the lab environment. When building it, you'll need to ensure that you duplicate the kind of environment that exists in your production servers. Though you may not be able to replicate the hardware, you can at least install the same kinds of third-party software. (You should, however, use as much of the same hardware as possible.) Our site has run into patch difficulties related to RAID controllers--we caught this in the labs and resolved it before entering the field. You'll also want to test vital software, such as backup, virus protection, directory services or metadirectory applications. Because our enterprise relies on NDS for NT, we decided to test it with a beta copy of NT SP5 (we haven't seen any problems surface thus far).
| |
|
PAGE: 1 I 2 I 3 I NEXT PAGE |
|
Microsoft points to SP5 as the latest manifestation of its intention to release "feature-free" service packs on a regular basis. These builds are meant to be bug fixes, not functionality add-ons. Microsoft will continue to support SP4 by releasing security and Y2K hot fixes until 2000 (see "A Windows Patch Time Line" to the left.)Best of the Web
Data deduplication: Declawing the clones
Data deduplication is emerging as a critically important new arrow in the storage administrator's quiver to answer hard questions about the increasing problem in storage growth costs.
Compression, Encryption, Deduplication, and Replication: Strange Bedfellows
One of the great ironies of storage technology is the inverse relationship between efficiency and security: Adding performance or reducing storage requirements almost always results in reducing the confidentiality, integrity, or availability of a system.
WAN Optimization Whitelists and Blacklists
Optimization is a fantastic way of saving money and creating really happy customers at the same time, but it doesn't work flawlessly for all applications.
WAN Optimization as a Managed Service: It's Not About the Cost
This insight examines how organizations outsourcing their WAN optimization initiatives to a third-party go about achieving their goals for application performance, reducing operational costs, and streamlining enterprise infrastructure.
