METHOD, APPARATUS, AND PROGRAM PRODUCT FOR AUTONOMIC PATCH DEPLOYMENT BASED ON AUTONOMIC PATCH RISK ASSESSMENT AND POLICIES

• US 20080263534A1
• Filed: 06/02/2008
• Published: 10/23/2008
• Est. Priority Date: 08/02/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ramachandran, Puthukode G., Troche, Edmund, Tsai, Minto, Hirsave, Praveen Prasanna Kumar
• Granted Patent: US 8,261,353 B2
• Time in Patent Office: Days
• US Class Current: 717/168
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 43/0817 by checking functioning

Abstract

An automatic patch deployment system is provided that deploys a patch according to an assessed risk and a policy. The policy may specify actions to be taken to deploy the patch for different categories of risk. The automatic patch deployment system receives a patch notification, an assessment of the risk, and the policy and deploys the patch accordingly. For example, installation of a patch may be indefinitely delayed for high risk patches, rescheduled for medium risk patches, or installed immediately for low risk patches.

Claims

1. A method for automatic patch deployment, the method comprising:

receiving a patch to be installed for a software component on an endpoint device;

receiving a risk assessment for the patch identifying a level of risk for installing the patch on the endpoint device;

retrieving a policy; and

deploying the patch according to the level of risk and the policy.

2. The method of claim 1, wherein the level of risk is one of high, medium, or low.

3. The method of claim 2, wherein deploying the patch includes delaying installation of the patch and notifying an administrator if the level of risk is high.

4. The method of claim 2, wherein deploying the patch includes installing the patch when the software component is idle if the level of risk is medium.

5. The method of claim 2, wherein deploying the patch includes installing the patch immediately if the level of risk is low.

6. The method of claim 1, wherein the policy is retrieved from a policy file.

7. The method of claim 6, wherein the policy file is an extensible markup language file.

8. An automatic patch deployment system comprising:

a managing server, wherein the managing server receives a patch to be installed for a software component on an endpoint device and receives a risk assessment for the patch identifying a level of risk for installing the patch on the endpoint device;

a policy engine that identifies one or more policies for the patch and sends the one or more policies to the managing server,

wherein the managing server deploys the patch at the endpoint device according to the level of risk and the one or more policies.

9. The automatic patch deployment system of claim 8, wherein the level of risk is one of high, medium, or low.

10. The automatic patch deployment system of claim 9, wherein deploying the patch includes delaying installation of the patch and notifying an administrator if the level of risk is high.

11. The automatic patch deployment system of claim 9, wherein deploying the patch includes installing the patch when the software component is idle if the level of risk is medium.

12. The automatic patch deployment system of claim 9, wherein deploying the patch includes installing the patch immediately if the level of risk is low.

13. The automatic patch deployment system of claim 8, wherein the policy is retrieved from a policy storage.

14. A computer program product comprising:

a computer usable medium having computer usable program code for automatic patch deployment, the computer program product including;

computer usable program code for receiving a patch to be installed for a software component on an endpoint device;

computer usable program code for receiving a risk assessment for the patch identifying a level of risk for installing the patch on the endpoint device;

computer usable program code for retrieving a policy; and

computer usable program code for deploying the patch according to the level of risk and the policy.

15. The computer program product of claim 14, wherein the level of risk is one of high, medium, or low.

16. The computer program product of claim 15, wherein the computer usable program code for deploying the patch includes computer usable program code for delaying installation of the patch and notifying an administrator if the level of risk is high.

17. The computer program product of claim 15, wherein the computer usable program code for deploying the patch includes computer usable program code for installing the patch when the software component is idle if the level of risk is medium.

18. The computer program product of claim 15, wherein the computer usable program code for deploying the patch includes computer usable program code for installing the patch immediately if the level of risk is low.

19. The computer program product of claim 14, wherein the policy is retrieved from a policy file.

20. The computer program product of claim 19, wherein the policy file is an extensible markup language file.