Windows updates on servers - GDPR

[ozydave]

Evening,

 

How often do you install windows updates to your servers?

Have you increased the frequency since GDPR came into force.

Reason being my wife works for a small company (Exchange server and DC and about 25 PC's) and has external IT support. The support company have been doing the windows server updates once a month, a service they pay for.

 

The IT company are pushing hard for the updates to be done every 14 days, you guessed it at double the cost. They are saying its in compliance with GDPR because the ICO mentions "frameworks like Cyber Essentials."

 

Cyber Essentials says that updates should be installed within 14 days of being released.

 

Its not practial or affordable for a small company like my wife's to do this.

 

Any thoughts?

[elsiegee40]

@GrumbleDook is needed. Sounds like pseudo science to me. Security updates are needed to protect data, but the risk needs to be assessed and I can't see that fortnightly is much better than monthly. Why not do it every day?!

[Jamman960]

Cyber essentials only requires critical updates to be installed within 14 days if I remember correctly, in general windows updates are only released monthly anyway so I wouldn’t expext a whole lot to be required in the interim.

 

I would expect them to approach them if a patch critical enough to be released outside of the monthly’s were to be released.

 

Our web site provider has just tried similar, they want to charge £30/mo to update Wordpress and all the plugins because they claim it’s getting more and more time consuming...

Edited February 6, 2019 by Jamman960

[GrumbleDook]

*Sigh* By all means have them in every 14 days. If updates are being released that quickly then surely it splits the amount of time in half and so they still get paid the same amount.

 

And then wait to watch them go into a long-winded explanation about why it doesn’t work like that and so on.

 

Then your wife’s company then says that this sounds a lot like something that needs a change management exercise to look at the scope of works. The support provider needs to provide guidance that should be peer-reviewed.

 

We see the paper ... give our collective critique ... and the IT firm are politely asked to stay as is, but have an option to buying in additional time for when a critical update is needed as it either affects services crucial to the business needs of the company or it affects the rights and freedoms of data subjects.

 

Translation: you may have a point but don’t extract the urine, we may opt to look elsewhere. Instead, provide an option for if we need you in an emergency. If we find you *are* extracting the urine you will be on your bike ... with no tyres ... and with a lot of people pointing their fingers at you, mocking ...

Edited February 6, 2019 by GrumbleDook

[Wubbalubbadub]

This made me chuckle... More to the point, tell your wife you will come on and setup automatic approvals. Who needs to pay someone to come in and press Ctrl A and press "approve".

Disgusting abuse of the word GDPR...

[HPlum78]

Best tell MS to up their standard release cadence for patching as they are not GDPR compliant...... :-o