Before running out for the weekend, don’t forget to remind your staff of Microsoft’s upcoming Patch Day. While next week’s Black Tuesday isn’t the largest they’ve ever dropped, it’s no slouch, with eight Security Bulletins. Here’s what you should expect:
- Four updates for Windows and its components, all rated Important
- A Critical update for Internet Explorer (IE)
- A Critical update for the .NET Framework and Silverlight
- An Important patch to fix a vulnerability in Forefront Unified Access Gateway
- And finally, an important bulletin for Microsoft Host Integration Server
You can find a bit more about these upcoming bulletins, including their order of severity, in Microsoft’s Advanced Notification post for October. As usual, I recommend you try to install these updates as quickly as possible, especially the Critical ones.
I also recommend you test Microsoft patches before deploying them. That said, for desktop clients, I’ve started to relax my “test patches first” recommendation. As far as I have seen, Microsoft has not released a drastically broken client patch, which really adversely affects a desktop user, in quite a long time. On the flip side, research shows that many desktop users are falling behind in their patching, and have suffered for it. For those reasons, you’re probably better off letting desktop clients get auto-updates immediately. However, production servers are still a different story. While it’s still very important for you to patch them quickly, you should not install production server patches without a little testing. Mostly if they help keep your business running.
I’ll know more about these bulletins on Tuesday, October 11. Check out the WatchGuard Security Center then for the latest update. — Corey Nachreiner, CISSP (@SecAdept)