S 2.428 Scalability in patch and change management

Initiation responsibility: Head of IT

Implementation responsibility: Administrator, Change Manager

When purchasing a patch and change management tool, often other requirements than those in later operations apply. The IT landscape is growing and additional IT systems that need to be taken into account by patch and change management are added. Thus, it is important that the patch and change management tool can be scaled. The question as to which scalability is required for the introduction of the system must already be clarified in the planning phase.

The main factors which have an impact on the scalability are the required pace of implementation for the distribution of hardware or software changes with respect to the existing IT infrastructure and the need to recover the IT systems massively in parallel in the case of an error.

For the event that faulty hardware or software changes are distributed, defined break points for the distribution must be specified. Since this option depends heavily on the pace of implementation, it must be specified where, how and at what time a deliberate interruption of the distribution is possible.

To detect if there is an expected pace of implementation, the operating values of the IT infrastructure such as network bandwidths and system load can be used first. However, the pace of implementation must be checked carefully in the tests prior to the initial operation of the system. Any bottlenecks occurring in the IT infrastructure must be responded to quickly by extension or change to the configuration.

A probable growth of the IT infrastructure in the period of time directly following the initial operation must be added, so as not to proceed immediately to another scaling and structural alteration phase of the system. First, more experiences should be gathered from operations, which must then be used as additional orientation for the further expansion of the system.

In practice, the approach to implement the scalability according to the physical and geographical IT structure of the organisation has proven. When allowed by the patch strategy of the organisation, distribution systems that only receive and process the software changes for the IT systems of the respective site can be used, for example, in the respective branch offices of the organisation.

If the patch strategy of the organisation, however, has a strong central orientation or if the patch and change management tools are run in the outsourcing operation, it is thus recommended to select the scaling in such a manner that dedicated systems are operated for each branch office.

If software tools are used to support patch and change management, it must be ensured that they meet the scalability requirements.

Review questions:

© Federal Office for Information Security. All rights reserved.