2

I recently got into a debate with a coworker about whether or not to update hardware drivers (such as NICs or RAID controllers). I have always followed the motto, "If it aint broke, dont fix it." And kept the default driver that shipped with the system. However, I recently started at a new company where the other sys admin seems to always update to the latest versions of drivers on servers - at least on their initial build. He said he used to follow my motto, but Dell has convinced him to do otherwise. To me this doesnt make sense, if you are going to update drivers, then you need to constantly be on the lookout for newer drivers, which can be done with management software, however you never know when a new bug will be introduced.

I cant seem to find a whitepaper or anything designating an official standard, should drivers on servers be updated or not?

6
  • The operating system in use is a bigger factor than anything else here. what are the specifics of the situation?
    – ewwhite
    Mar 10, 2013 at 23:35
  • the majority of the servers are Win 2k8.
    – Keltari
    Mar 11, 2013 at 0:40
  • How do you know it ain't broke though? Do you look through the release notes of each driver? Do you know for a fact that they're complete? Your actually motto seems to be, "Even if it might be broke, don't fix it." Mar 11, 2013 at 2:17
  • If the device is working as intended, then it aint broke. I have had infinitely more issues moving to newer versions of software, as they have introduced new problems/bugs. If a device works perfectly for years, why introduce the possibility of new problems?
    – Keltari
    Mar 11, 2013 at 2:20
  • I also want to point out that opinions are welcome, however what I am looking for is some a whitepaper or something "official" that I can say this is the reason for/against a decision.
    – Keltari
    Mar 11, 2013 at 2:28

1 Answer 1

4

There probably isn't an official standard. However, since I'm involved in security and IT audit, I can tell you that the "If it ain't broke, don't fix it" isn't always a good approach.

Now I won't say you should update all of your hardware instantly, unless the manufacturer recommends you too. Now obviously you can't just go upgrading RAID controllers or BIOS on production machines at any time.

First of all, and this goes for any software/hardware update, is to check what the update actually does. Sometimes the updates in the controllers fix a certain incompatibility with a certain motherboard or hard disk. Now if you aren't experiencing any issues and you recon there isn't anything in the update that should benefit you, then by all means do not update unless you actually have to take the machine down for maintenance.

However if the update specifies that it fixes an issue where you randomly could encounter things failing, I would schedule a maintenance window as soon as possible.

If the update is meant to fix a critical vulnerability, then you should instantly push it through change management and try to roll the update out in production as soon as possible.

This doesn't immediately apply to RAID, as far as I know I haven't seen too many exploits for RAID cards, but it's a good idea to update your machines. You shouldn't do it instantly if you haven't got to or when there is no benefit, but otherwise, by all means update your firmware.

Since drivers are also a form of software, they should go through normal patch management. Here are some resources you can read up on:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .