Advanced Novell ZENworks®
Patch Management Deployment and Best Practices

Allen McCurdy

Category Specialist for Novell Resource Management

amccurdy@novell.com

Pat Nurre

Category Specialist for Novell Resource Management

pnurre@novell.com

Objectives

Understanding ZENworks Patch Management:

Architecture

Integration and deployment

Business Issues with patch management

ZENworks Patch Management as a solution

Business Issues of patch management

Threat of attacks from viruses, worms or other malicious software

Security Focus reported in 2003, 223 vulnerabilities in Microsoft products alone

174 reported as of October of 2004

Cost and time needed for obtaining and applying software updates

Thousands of hours spent just for patches and updates

Loss of productivity due to business continuity failures

In 2003

SQL Slammer Worm, estimated $1.25 billion damages

Blaster Worm, estimated $2 billion damages

In 2004

Bizten Trojan, Gaobot Worm, Mimmail Worm, Opaserv Worm, Backdoor.Sdbot Trojan, Xombe Trojan Backdoor.Threadsys Trojan, PWSteal Worm, MyDoom Worm, Hostidel Trojan

49 new viruses in Jan 2004

959 new viruses in May 2004

Virus Mania

September 28, 2004

Windows JPEG exploit using a new found vulnerability in Microsoft’s GDI library.

The trojan horse will, when you view an infected JPEG, will download remote control software and allow creators of trojan horse to view files and execute programs on your machine.

An Example Virus Exploit

The Problem

The problem is NOT that you cannot get the patch for the vulnerability.

Slammer worm – fastest spreading virus ever recorded, infecting 300 machines in the network a second. Patches for Slammer were released by Microsoft 6 months earlier.

The problem is two fold:

Getting it to all of your servers and workstations

Knowing about the patch, its severity and its applicability to your environment

1

2

Sneakernet Patching

Sneakernet = running around, manually patching each server and desktop and then verifying the patch (e.g. windows update)

Network Fusion says:

“...many network administrators essentially tracked patch status in their head, fixing holes on the fly. But in the last 2 years, the sheer complexity of networks and number of patches have rendered this approach ineffective.”

Sneakernet - Do The Math

Medium-sized network: 10 servers, 1000 desktops

Average patches: 2 per week

You need to spend 17 hours each day to apply patches!

Installations + Reboots = 404 per day

Assume fast 5 minute apply and patch ~ 17 hours

The Solution:
ZENworks Patch Management

ZENworks Patch Management automates the process

Notification and acquisition of the patch

Distribution to targeted devices with flexible scheduling

Maintains patch integrity

Displays applicable machines

Patch information

ZENworks Patch Management provides extensive patch information

Know the vulnerabilities addressed

Know the severity of the risk

Know if the patch is applicable to you

Also

Full dependency resolution

Superseded patch prevention

Architecture overview
ZENworks Patch Management

Microsoft

Novell

Adobe

Patch Source

Patch Server

Admin Console

Distribution Point

Agent based architecture
Security and flexibility

ZENworks Patch Management agent provides:

No NetBIOS ports required to be open outside firewall

Bidirectional initiation of updates

Full scheduling engine

Support for intermittently connected users

Consistent administrative user ID’s and passwords are big risks!

Platform support

ZENworks Patch Management supports the platforms you need

Server runs on Windows 2000/2003 Servers

Desktop support

Windows 98, NT, 2000 and XP

Server Support

Windows NT, 2000 and 2003 Servers

NetWare® 4.11 and later

Patch Support

Microsoft, Novell, Adobe, Real, Macromedia, Corel, McAfee, Sophos, Authentium, Command, Oracle, Sybase, Citrix, IBM, Compaq, Dell, Apple, CA, Symantec, SAP and Norton

Target selection

Know which devices need updates

Manage individually, by group or by policy

Policy defines required patches for all devices in your organization

Automated compliance

Scheduling options

Patch on your schedule

Exact time that patches are applied

When to check for new patches

How many devices to patch at once

Server initiated overrides

Reporting

Know the state of your organization

Graphical reports indicate status

Where are you safe

Where are you vulnerable

Device success or failure

Full support of appropriate platforms

Automated patch acquisition

Detailed information about the patch

Fully integrated security

Robust agent-based architecture

Applicable target management and selection

Scheduling options

Strong reporting

Role-based management

Minimum required patch conformance

ZENworks Patch Management

ZENworks now includes market leading patch management

Plan

Test

Pilot

Report

Research

Acquire Patch

Monitor

Detect

Deploy

Defend

Rollout

ZENworks Patch Management
Patch Lifecyle

ZENworks Patch Management
Step 1

Dedicate a Windows 2000 +SP2 or 2003 Server to host your patches

Does not need to be member of domain

Needs to be a clean, vanilla server with IIS

Connection to the Internet

1

ZENworks Patch Management
Step 2

Copy the Patch Management agent

Include agent as an Application Object in ZENworks

Use Deployment Agent Wizard to roll agent out via a domain

Individual installation

2

ZENworks Patch Management
Step 3

Allow devices to register and perform analysis and server to retrieve patch information

Analyze the managed devices

Transmit information to ZENworks Patch Management server

Generate vulnerability reports

3

ZENworks Patch Management
Step 4

Review vulnerability reports and deploy patches

Review which patches are required for your environment

Select patches to deploy

4

Best Practices

Best Practices:
ZENworks Patch Management Agent

Configuration set on Server on how often the agent will contact the Patch Server

Agent uses patented technology to keep resource consumption down to approximately 8% on the workstation

Because of the CPU throttling, the agent will not consume entire connection while retrieving patches

Agent will remain fairly undetectable to the user

Best Practices:
ZENworks Patch Management Distribution Point

Distribution Points are entered as the Proxy in the agent installation

All information is transmitted up, directly to the Patch Server

When a patch is requested the agent will go to the Distribution Point. The first agent requesting a patch will retrieve the patch through the Distribution Point (proxy). The Distribution Point will then cache the patch.

Subsequent requests for patch will be honored by Distribution Point

Best Practices:
ZENworks Patch Management Distribution Point

Distribution Points are designed primarily for small branch office arrangements

Although no specified limitations, should recognize that workload on Distribution Point obviously increases with more agents

Example of recommendations

Best Practices:
ZENworks Patch Management Patch Server

In a basic installation of the ZENworks Patch Management server you will received the MSDE engine for the database support.

This will support ~200 client devices

To grow larger, you must install MS SQL Server on the Patch Server. This can allow support up to 10,000-15,000 client devices.

To give good performance on a 5,000 device server, recommend dual processor, 4GB machine.

Best Practices:
ZENworks Patch Management Patch Server

Each server in your environment is an independent installation. They do not know about or cooperate with one another.

Each server requires its own key. This key is also provided to each agent as it is installed. The agent cannot be moved to another patch server without uninstalling the agent and reinstalling with the other server key.

Only Novell ZENworks Patch Management keys will work with ZENworks Patch Management software. And Novell software will only work with Novell keys.

In 2003 we had $3.25 billion in losses just with the SQL Slammer Worm and the Blaster Worm.

In 2004 we started out with an average of 49 new viruses a month, by May we were averaging 959 new viruses a month. The number of viruses is growing at an alarming rate.

Even just a few days ago a new trojan horse was discovered that used a vulnerability in the GDI library and can infect all JPEG graphic files. Due to the number of people that use JPEG files, this virus is expected to hit everyone hard.

There are two problems that an administrator faces with regards to vulnerabilities, patches and viruses. First we need to know if we need the fix in our environment and secondly, we need to get that fix to all of those machines. Often times the patch is available before the virus is released, however the time between vulnerability discovery and virus is growing smaller.

Many administrators do a process we call “sneakernet” where they walk from machine to machine, inspecting them for patches and applying all of the required updates.

If you took a medium size installation and you needed to install 2 patches a week, which is no where near the 950 a month that are coming in, then you could take somewhere around 202 hours each day just installing patches. Using the sneakernet process will not work in our world today.

ZENworks Patch Management is all about automation to reduce management costs. ZENworks Patch Management will automate the discovery of patches and will automatically retrieve the patch from the Patch Source. ZENworks ensures that the received patch is untampered and comes from a trusted source. ZENworks will also retrieve and dependent patches from the source.

With ZENworks Patch Management you get extensive information including: information about the vulnerability being fixed by the patch, the severity of the vulnerability and if the patch is relevant for the systems in your environment.

ZENworks Patch Management presents a multi-tiered approach for discovering and deploying patches. Patches are first delivered by vendors to an external Patch Source web server. Your local Patch Server will then periodically communicate back to the Patch Source, thereby discovering any new patches that are available. You use the ZENworks Patch Management administration console to manage how these newly discovered patches are deployed throughout your system. Individual devices then scan themselves to see if they require the patch. Reports are available through the web console that show which patches your require in your environment and which devices are in need of the patch. From there you can request that ZENworks deploy the patch to those machines.

ZENworks also provides a Distribution Point which allows caching of patches on a workstation that can then provide patch content to local workstations. This is useful in small branch offices that have a smaller connection capability back to the Patch Server.

ZENworks Patch Management uses the secure and flexible Agent-based architecture on the device. This keeps us from having to open the NetBIOS ports (which other vendors do) which can lead to security risks from the outside. This also allows the device to handle the scheduling of when a patch is applied and how often it needs to communicate back with the patch server.

ZENworks Patch Management supports Windows 98, NT, 2000 and XP workstations and will deliver patches to several servers, including: Windows NT, 2000 and 2003. NetWare support is in the works.

ZENworks Patch Management currently receives patches from many computer software and services manufacturers, 33 in all, including Microsoft, Novell, Adobe, Oracle, Sybase and Citrix.

One valuable need is to understand which devices in your environment require the particular patch. ZENworks Patch Management automatically performs analysis of each system and determines which of them require a patch. Then you as the administrator can target these systems, either manually or through groups and policies. Policies allow you to specify what are called “Mandatory Patches” which will automatically be applied to all systems with the targeted attributes (such as OS, hardware specifics). Any machine that comes into the network that matches the OS and hardware characteristics will automatically get they patch, if they need it.

Additionally, with ZENworks you can schedule when a patch is applied to the device. This allows you to control the rollout of patches to be least disruptive to your business. You can also schedule how many devices should be patched at a time to spread the patch out in a controlled pattern, or blast it out to everyone.

One critical component of ZENworks Patch Management and patching in general is to discover what level of vulnerability you may have in your systems. ZENworks provides full reporting with easy to understand graphical presentations of your patches and how they have been applied to the relevant systems.

To begin a successful deployment of ZENworks Patch Management you must start with a dedicated Windows 2000+SP2 or Windows 2003 server. This server must be a vanilla server from a clean install with IIS installed and connected to the Internet. The Internet connection allows you to register the product and get a secure connection to the Patching source.

Once you have installed a Patch server in your environment, then you need to deploy the patch agent onto your devices. This can be done via ZENworks Desktop Management or a Domain Deployment wizard that is provided.

Once your devices have registered with your local Patch server, they will begin to analyze the patches they require and reports will be generated on the server.

You can review the reports by opening a browser and going to the URL of your local patch server. This will present you with reports on each known patch and the systems that require that patch. You can then select which patches you want deployed to which devices.

This lists the set of best practices and knowledgebase that will help you with Agents on devices. First you can set a policy on the patch server that tells devices how often to connect back to the local patch server. Agent are automatically designed to take only about 8% of the CPU and will therefore only trickle down any assigned patches. This should keep the agent fairly undetectable by most users.

Distribution points allow you to cache patches for delivery to local workstations. Distribution Points may be installed on servers and workstations. The distribution point acts like a proxy to the agents. When a patch is requested the first agent requesting the patch through the distribution point will cause the distribution point to cache the patch. All subsequent requests will be delivered by the distribution point rather than retransmitting the patch from the patch server.

Distribution points are designed for small branch office arrangements. Larger installations should consider installing their own ZENworks Patch Management server.

The ZENworks Patch Management server initially is installed with the free MSDE engine. This will support approximately 200 devices. For larger installations you must install an MS SQL Server on the Patch server.

ZENworks Patch Management servers are independent and one local server is not aware of any other local patch server. Each server requires their own unique licensing key and the keys you receive from Novell will only work on Novell delivered Patch Management software.

2003-12-08T12:43:39