Last week Microsoft released 13 security bulletins covering 34 vulnerabilities, much to the delight of overworked system administrators who now have to roll out and test the patches in their environment. Organizations are most likely at different stages in the patch deployment process, some may still be testing and some may have the patches rolled out to the entire environment. What all organizations have in common is the need to verify that patches have been installed properly. Nessus has several features, including credentialed scanning and plugins that list missing patches and can assist in the patch verification process. We have produced a short video that demonstrates how to run this type of scan:
The report that is generated by the above process is particularly useful. An example screenshot can be found below:
This can be generated daily or weekly and sent to the systems administrators whose responsibility it is to apply the patches. The most successful security processes, in my experience, are done is support of each other's work. Tout the patch reports as helping the various systems administration groups in your organization, and don't let them get a reputation of pointing out where people are making "mistakes" but as a helpful part of the process. Doing this will greatly increase your chances of a successful vulnerability management program.
