From: "Geo" 

"Randall Parker"

wrote in message news:4377dbf5$1{at}w3.nls.net...
> Geo,
>
> How often do you have to go around to all your servers and install
patches?

Never. I sit at my desk and install them . As to how ofter, well
how often are patches released? Lately it's been once a month (approx).

> What fraction of those patches require a reboot?

99.93%

> How much effort is it to watch for patch announcements?

None, just subscribe to ntbugtraq or any low volume mailing list where they
announce patches.

> Aside from applying patches do you have to spend a lot of other time doing
security
> related stuff?

I do but you won't. I don't just secure a website, I secure an ISP so I do
a lot of reading about current security issues, virus, worms, network
issues, router, etc. But for just a website, you have the initial machine
hardening, then you apply patches and keep an eye open for news about
security issues with whatever software you loaded on the machine (including
backup software). It's pretty easy.

> Also, since you presumably have lots of servers how much extra time do you
spend per
> server beyond the first one? Once you have the patches can you patch them
all from a
> single command batch file run across the network? Or do you have to go to
each one
> and patch it?

My patch strategy consists of running shavlik hfnetchkpro when I hear of
new patches, it goes out and patches all the servers for me automatically
and it doesn't just patch NT or Office, it patches adobe reader, winzip,
netscape, opera, sqlserver, java, ect.

But you could just run windowsupdate if all you are doing is a web server
with MS stuff on it. Should take you about 15 minutes per month to do that.
(do it after you are sure the nightly backup ran correctly)

Geo.

--- BBBS/NT v4.01 Flag-5