Insights / Checklist / Managed IT services and infrastructure support
ChecklistPatching and backup health check
Two basics prevent many serious problems: keeping systems current and being able to restore them. Use this checklist to see how well yours are covered.
Few IT topics are less glamorous than patching and backups, and few matter more. Two basics prevent many serious problems: keeping systems current and being able to restore them. Unpatched systems are one of the commonest ways attackers get in. Backups that have never been tested are one of the commonest reasons a bad day becomes a bad month.
Use this health check once a quarter, or before a contract review with your IT provider. Each item should be answerable with a clear yes, backed by evidence such as a report or a log. A vague answer usually means a gap.
Patch on a schedule
Apply security updates regularly, with testing for critical systems. A predictable rhythm is far better than patching in bursts when someone remembers or after a scare.
- There is a written patching policy covering servers, laptops, desktops, network devices and key applications.
- Routine security updates are applied on a fixed monthly cycle.
- Critical security updates can be applied within days when the risk is high, with an agreed fast-track process.
- Updates for business-critical systems are tested first, in a test environment or on a small pilot group.
- Maintenance windows are agreed with the business and published in advance.
- A monthly report shows the percentage of devices fully patched and lists those that are not.
- Every exception, such as a system that cannot be patched for vendor reasons, has an owner, a reason and a review date.
Watch the unsupported systems
Software and hardware past the end of vendor support no longer receive security updates. List them, decide whether to replace, isolate or retire each one, and set dates. They are often the weakest point in an otherwise well-patched estate.
Back up what matters
Backups should cover data, configurations and key applications. Restoring files is only part of recovery: you also need the settings, databases and system images that let a service run again.
- Every critical system has a defined backup: what is copied, how often and how long it is kept.
- Recovery targets are agreed with the business: how much data loss is acceptable and how quickly each service must be back.
- Backups include databases, application configurations, network device settings and cloud services, not just file shares.
- At least one copy is held separately from the main environment, offline or immutable, so ransomware cannot encrypt it.
- Backup jobs are monitored daily, and failures are investigated and resolved, not just noted.
- Access to backup systems is restricted and protected with multi-factor authentication.
- Data held in cloud applications is reviewed, since the provider’s own resilience does not always protect against deletion or corruption.
Test restores
Practise restoring so you know it works under pressure. A successful backup job shows that data was copied. Only a restore shows that you can get it back, in usable form and in the time the business needs.
- Sample file restores are performed at least monthly, from different systems and dates.
- A full restore of at least one critical system is tested each quarter, ideally to an isolated environment.
- Restore times are recorded and compared with the agreed recovery targets.
- Recovery procedures are written down and can be followed by someone other than their author.
- Restore tests are rotated across systems, so every critical service is tested over the year.
- Results, including failures and lessons, are reported in the service review.
Consider a typical professional services firm that finds, during its first full restore test, that its document management database restores correctly but the application cannot connect to it, because a configuration file was never included in the backup. Discovering that on a quiet Tuesday costs an afternoon. Discovering it after a ransomware incident could cost weeks.
Reading the results
Count the items you can answer with a confident yes and evidence. Gaps in the restore section deserve the most urgent attention, because they undermine everything else: patching reduces the chance of an incident, but restores decide how bad one becomes.
Agree an owner and a date for each gap, and repeat the check next quarter. Start this month by asking for a list of unpatched devices and scheduling one full restore test. Those two requests will tell you more about your resilience than any policy document.
Source: Intelliversal analysis.
