stephen, patching systems, security or maintenance, is indeed a primary function of systems administration. however, it's not uncommon for larger shops to create junior positions with the specific function of, say, applying patches or running backups/restores.
if you were you were hired for a specific admin function, like patching, then pushing some of these duties back to the more senior admins defeats the purpose of your job. if you are overwhelmed, and i would imgaine that you are with NT in your env, then perhaps you need more help. getting help nowadays, of course, may be difficult. in lean times, management expects all its employees to do more with less. the onus falls on you then to prove that you're working your ass off and still can't keep up with all the M'soft security holes out there. you'll need at least two things to get managment's attention: data and repercussion. your data will have to show that you're already working overtime but that you're gradually falling further behind despite your efforts and expertise. perhaps records showing that the average number of security issues, hence patches, has increased by "x" percent over the past "x" months. you could bolster these numbers by showing too that you're env has grown from "x" number of boxes to "y" number. and perhaps there were others who helped patching boxes but because of ??? these folks are no longer around to help. basically, you need cold, hard numbers. once, and only once, you've collected the data (the facts), you need to show upper echelon that ingnoring your cries for help could be deterimental to the company. basically, you need to show 'em that if they don't get you the help you need the company could suffer greatly. convince (remind) management that ignoring security will mean more down time (internal impact) and likely leave them vulnerable to law suits by their customers (external impact). hope this helps. stephen gilliss sun >Mailing-List: contact [EMAIL PROTECTED]; run by ezmlm >List-Id: <security-basics.list-id.securityfocus.com> >List-Post: <mailto:[EMAIL PROTECTED]> >List-Help: <mailto:[EMAIL PROTECTED]> >List-Unsubscribe: <mailto:[EMAIL PROTECTED]> >List-Subscribe: <mailto:[EMAIL PROTECTED]> >Delivered-To: mailing list [EMAIL PROTECTED] >Delivered-To: moderator for [EMAIL PROTECTED] >From: Stephen Zeigler <[EMAIL PROTECTED]> >To: [EMAIL PROTECTED] >Subject: Sysadmins and Security Patches >Date: Fri, 17 May 2002 12:09:04 -0700 >MIME-Version: 1.0 > >Hi all, >I would like to get a feel for how other shops handle this issue. I am a >security admin responsible for keeping about 140 servers, Unix and NT, up to >date with security patches and hotfixes. This isn't my only responsibility >and I'd like to get the sys admins more involved in keeping their servers >patched. I love my job - but more stuff keeps landing on my plate. How is >this best handled? Is it reasonable to expect sysadmins to install security >patches? Thx >
