Monthly Patch Release Schedules: Do the Risks outweigh the Benefits?

At the Information Security South Africa conference 2006 I published a paper arguing that our current understanding of the risks associated with monthly patch release cycles is pretty poor. This discussion is pretty important given that entities such as Gartner recon monthly release will be the new industry standard.

I basically argue that in the case of delayed (responsible) disclosure patch schedules work well, but in the case of instantaneous (0day) disclosure none of the purported benefits, namely better quality patches and better deployment scheduling are accrued. I then move onto some solutions.

I think this is a really important paper and a really important discussion. Of course, I am the author so I would think that. The paper is available at:

http://singe.za.net/masters/files/issa2006/issa-2006-patch_schedule.pdf

Posted by Dominic White