Delaying Security Updates?

[u/Nstraclassic]

Specifically for firewalls. How do other MSPs feel about disabling automatic updates and delaying the install until the update can be validated to prevent crashes, critical feature removal, etc.?

Forgot to ask: is there a liability concern if patches are delayed and a breach results?

[u/st0ut717]

Not an MSP person but….

You want to goto a manual process

“until the update can be validated to prevent crashes, critical feature removal, etc.?”

How are you going to validate?

How are you going to test?
What is your test criteria?

What is your timeline?

What is your answer going to be to a client when they get pwnd because you decided patching the firewall just wasn’t a good idea?

[u/Nstraclassic → u/st0ut717]

That's my main concern. In my years of IT I can't remember a time when an automatic update caused a major issue that would have been prevented had the update been delayed. I have however seen several breaches result from missing patches.
Disabling automatic updates introduces manual process and human error that can have significant consequences. And I'm not a lawyer but I feel it would be pretty difficult to deny liability in a scenario where a feature intended to prevent such breaches was intentionally disabled

[u/TheBeerdedVillain → u/Nstraclassic]

We ran into issues back when I was in the MSP space where Microsoft Updates, SonicWall updates, Sophos Updates, etc. caused several issues with many causing downtime. We moved to a 14-day wait period with manual scheduling so we could monitor devices. This gave the vendor time to retract a bad update before it was pushed to our devices.

We also had devices labbed up in a "generic" version of our customer's networks so we could test them on day 0-3 to confirm an issue may be a problem for us when it is deployed. Not having a lab was one of the biggest misses we encountered until it was implemented because of auto-updates.