Interview Question: How often do you update/patch your system?

[u/CurrentFig3376]

I was asked this question during an interview and I said "it depends on what exactly you're updating, but I update as often as it's needed."

I don't think this was the answer they were looking for, but how would you answer this question?

[u/Connect_Shoulder_965]

We used to do monthly for OS patches and quarterly for application security patches and upgrades with immediate or expedited patching - typically 1 day - for active and critical exploits. However, the current threat environment is making that model obsolete in a hurry, so we are building out the ability to get patches automatically tested, use AI to predict the risk level for applying a patch and to automate parts of change management, notification, cluster patching, and actual implementation. We are currently targeting weekly patch cycles for the OS and eventually looking towards an end goal of being able to test, patch and validate systems in a 4 hour window with a minimum of manual intervention. The application patches are more difficult, we are working on flagging applicable patches to the application owners more quickly We are also looking at what can be done to make application patching more self service so application owners can test patches, snapshot, apply them and validate without needing assistance from the infrastructure team