1

This is more of a general question.

Most people who use a computer always try to keep up with the latest updates to whatever OS and software they're running, mostly for security reasons. Also, it has become much easier to upgrade from e.g. Windows 8 to Windows 10 and keep all your previous data/settings intact. Generally it is considered good practice to run some update manager regularly on an end-user device.

Why is it entirely different for servers though and in some cases updates and patches are completely avoided? Sure there are issues such as some downtime when updating and the possibility of an update breaking something but how are updates handled if you want to make sure everything is secure?

How are OS upgrades handled? I've read about people working on environments running some EoL OS (e.g. Windows Server 2008) on servers that are exposed to the Internet but don't upgrade or update because "something may break".

From my understanding, you shouldn't be installing new OS updates as frequently as you would on your personal devices but you can't really almost never upgrade in fear of losing functionality.

Improve this question
2
  • I know that you're pointing out Windows specifically, but an OS upgrade from Ubuntu 14.04 to 16.04 is fairly painless and quick. We've performed 400+ of these upgrades in the past six months. I expect 16.04 -> 18.04 to be equally painless. Red Hat variants have been more problematic but this is supposedly corrected in the REL 7 -> REL 8 upgrade that is in the near future.
    – doneal24
    Apr 14, 2019 at 16:15
  • Windows Server 2008 has security updates until January 14, 2020. While responsible organizations already have migrated off 2008, until then operating systems actually end of life are 2003, XP, Vista.
    – John Mahowald
    Apr 14, 2019 at 18:59

2 Answers 2

Reset to default
3

In the case of keeping EoL systems or not applying specific updates, some enterprises do a proper cost benefit analysis and take precautions to mitigate potential risks.

And everybody else is doing it wrong. It doesn't matter if they are intentionally doing nothing, or lazy or too cheap. It's still wrong.

One of those two methods takes time and resources, and the other one is dead simple. And that is why too many organizations take the second approach.

Improve this answer
2

The biggest question is this, who is accessing the server and how accessible is the server?

For example, if you run Windows Server core with only the Hyper-V role on it to host VM's, no one is going to connect to the server and work on the server, and access to the server remotely is limited and if done well, properly shielded, you can get away with not installing updates.

Security updates are released because a vulnerability has been found that can allow someone to gain access to the server. Installing such update would usually require a reboot, and a reboot of this kind of server means that all servers it hosts will go offline for some time until the reboot and install of updates has completed. But why would anyone need to patch security holes if no one will be able to access the server anyways? There are no users accessing the server that may run a program that can create a vulnerability, and there are no other services running that may require proper maintenance.

In all other cases, I would definitely do update the servers on a regular basis though, but that being said, if a customer has an RDS (Remote Desktop Services) Server running, and they want to keep logged in over night, they will not like it if the server is rebooted just like that, so you have to explain that the server needs an update once in a while and it may be up to the customer to say: "I'd rather have you not reboot the server, and I'll take the risk for it."

Remember, the customer is always king. They pay you. You just explain the hazards but if they don't want it, then it is their fault too when things go wrong.

That said, there is one last issue that needs to be adressed.

I don't say to never install updates, but it is common practice to install them on demand and on a personal schedule. The reason is that some updates that are being released may cause more harm than good, so companies tend to have a low-risk server that runs all updates, and once the updates succesfully are installed on that server and run fine for a week or two, only then, do the updates get installed on other servers.

Sometimes, an update can have unwanted sideeffects or even failures. A server that is important to be running should not just get the latest updates just like that.

Improve this answer
2
  • Unfortunately, the customer is not always king. Working in a US federal laboratory, I view my "customers" as the researchers & developers actually using the servers. However, Homeland Security/HHS/NIH have their own ideas about server security that I must follow. EOL operating systems are completely forbidden unless they are not network accessible. Security updates are installed within 30 days even if the vulnerability isn't actually a problem on a given server. The process make the systems administrators' lives more difficult and the developers lives more difficult but we learn and move on.
    – doneal24
    Apr 14, 2019 at 16:10
  • @DougO'Neal good point. But if the customer is in this position, won't they come up with the security requirements themselves anyway?
    – LPChip
    Apr 14, 2019 at 18:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .