How can you ensure patches are installed on remote systems outside the corporate network?

Patching remote systems outside the corporate network is a challenge for many IT operations teams. Remote systems may have limited bandwidth, intermittent connectivity, or different security policies than on-premises systems. However, keeping remote systems up to date with the latest security and performance patches is essential to prevent vulnerabilities, compliance issues, and performance degradation. In this article, you will learn how to ensure patches are installed on remote systems outside the corporate network using different methods and tools.

1 VPN-based patching

One method to patch remote systems outside the corporate network is to use a virtual private network (VPN) connection. A VPN allows remote systems to connect to the corporate network securely and access the patch management server or tool. You can configure the VPN client to automatically connect and disconnect when needed, or prompt the user to initiate the connection. You can also use group policies or scripts to enforce the VPN connection before applying patches. However, this method requires that the remote systems have a reliable and fast internet connection, and that the VPN server can handle the traffic load.

Add your perspective

Robin S.

Azure | Windows Server | Active Directory & Entra-ID | PKI | IT-Security
Report contribution
A Windows Always On VPN machine tunnel is an excellent way to enable remote clients to access services like WSUS. The tunnel automatically connects when the system boots up. Using a dedicated machine tunnel allows you to expose only the bare minimum of resources needed for pre-authentication and system management. A machine tunnel enables you to manage a remote Windows client even if no user is actively logged on.

Like
ELOUFIR ABDELAATI

ICT Infrastructure| Remote IT Support| Network Maintenance | Channel| UC| Projects |Cyber Security| Firewalls| Polycom| Domain| Networking Data-Center| CCTV| Servers| Unified video| Content| Editing| Remote IT|
Report contribution
Ensure remote patching through VPNs, cloud-based solutions, and remote deployment tools. Enable automatic updates, schedule maintenance windows, and use mobile device management. Communicate policies, employ endpoint security, utilize remote desktop solutions, and conduct regular audits for comprehensive coverage.

Like
Godwin Oli

IT Specialist. | CCNA | Windows Server Specialist| Certified Cyber Security| Microsoft Azure Administrator| HSE 1-3 | Google ADs Search Certified| Google ADs Display Certified| Certified Webmaster |CompTIA A+ Core 1&2 |
Report contribution
Even with the VPN connection that one tend to use. You have to make sure the VPN used is end to end encrypted as experience have shown that some of these VPNs can still be sniffed on. An encrypted tunnel remains the best way as even though the data is intercepted it still won't be readable which make it useless to the intruder. Keeping both equipment up-to-date with latest updates also help in these regard.

Like

2 Cloud-based patching

Another method to patch remote systems outside the corporate network is to use a cloud-based patch management service or tool. A cloud-based patch management service or tool can scan, download, and install patches on remote systems without requiring a VPN connection. You can also monitor and report on the patch status and compliance of remote systems from a web-based dashboard. However, this method requires that the remote systems have internet access, and that you trust the cloud provider with your patch data and credentials.

Add your perspective

Godwin Oli

IT Specialist. | CCNA | Windows Server Specialist| Certified Cyber Security| Microsoft Azure Administrator| HSE 1-3 | Google ADs Search Certified| Google ADs Display Certified| Certified Webmaster |CompTIA A+ Core 1&2 |
Report contribution
I will say, in using cloud based patch management, you have to consider the reputation and integrity of the service provider, have they been compromised before? If yes what was the level of damage?

Like

3 Agent-based patching

A third method to patch remote systems outside the corporate network is to use an agent-based patch management software or tool. An agent-based patch management software or tool can install a lightweight agent on remote systems that can communicate with the patch management server or tool over the internet. The agent can check for available patches, download them from a local or cloud-based repository, and install them on the remote system. You can also control and configure the agent settings, such as patch schedule, bandwidth limit, reboot policy, and error handling. However, this method requires that you install and maintain the agent on remote systems, and that the agent can bypass any firewall or proxy restrictions.

Add your perspective

Godwin Oli

IT Specialist. | CCNA | Windows Server Specialist| Certified Cyber Security| Microsoft Azure Administrator| HSE 1-3 | Google ADs Search Certified| Google ADs Display Certified| Certified Webmaster |CompTIA A+ Core 1&2 |
Report contribution
Again using agent base system, one need to make sure that such an application doesn't come with a back end code that steals user data and sell to ADs companies.

Like

4 Offline patching

A fourth method to patch remote systems outside the corporate network is to use an offline patching technique or tool. An offline patching technique or tool can create a portable media, such as a USB drive or a DVD, that contains the patches and a script or executable that can apply them on remote systems. You can then distribute the portable media to the remote users or locations and instruct them to run the script or executable on their systems. However, this method requires that you manually create and update the portable media, and that the remote users or locations have physical access to their systems and the media.

Add your perspective

5 Hybrid patching

A fifth method to patch remote systems outside the corporate network is to use a hybrid patching approach or tool. A hybrid patching approach or tool can combine two or more of the methods mentioned above, depending on the availability, connectivity, and security of the remote systems. For example, you can use a cloud-based patch management service or tool for most of the remote systems, but use an offline patching technique or tool for the systems that have no internet access or are in remote locations. However, this method requires that you have a flexible and scalable patch management strategy and tool that can support multiple methods and scenarios.

Add your perspective

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

Add your perspective

How can you ensure patches are installed on remote systems outside the corporate network?

1

2

3

4

5

6

1 VPN-based patching

2 Cloud-based patching

3 Agent-based patching

4 Offline patching

5 Hybrid patching

6 Here’s what else to consider

IT Operations

Rate this article

Thanks for your feedback

More articles on IT Operations

More relevant reading

How can you ensure patches are installed on remote systems outside the corporate network?

1

2

3

4

5

6

1 VPN-based patching

2 Cloud-based patching

3 Agent-based patching

4 Offline patching

5 Hybrid patching

6 Here’s what else to consider

IT Operations

Rate this article

Thanks for your feedback

Explore Other Skills