Patch and Vulnerability Management

Troy University Information Technology maintains a centralized patch and vulnerability management process designed to reduce security risks associated with operating systems, applications, network infrastructure, and other University-managed technology resources.

Information Technology uses centralized management, endpoint management, vulnerability assessment, and security tools to identify systems requiring updates and to deploy and verify applicable security patches. Technologies used to support this process may include Microsoft endpoint and update management services, PDQ Connect, vendor-provided management platforms, vulnerability scanning tools, and other centrally managed security technologies.

Patch Identification and Prioritization

Information Technology monitors vendor notifications, vulnerability information, security advisories, automated management platforms, and other appropriate sources to identify security updates affecting University-managed systems.

Patches and vulnerabilities are evaluated based upon factors including severity, known exploitation, exposure of the affected system, availability of vendor remediation, operational impact, and the sensitivity or criticality of the affected system or information.

Critical vulnerabilities or vulnerabilities associated with active exploitation may receive accelerated review and remediation.

Testing and Deployment

Where practical, patches and significant system updates are evaluated or tested prior to broad deployment. Testing may include deployment to designated test systems, limited groups of production systems, Information Technology systems, or other appropriate subsets of the managed environment.

Information Technology personnel review available information concerning compatibility, known issues, security impact, and operational risk when determining the appropriate deployment approach.

Following appropriate review or testing, patches may be deployed through centralized management tools, vendor management platforms, automated update mechanisms, or manual processes when centralized deployment is not technically feasible.

Verification and Monitoring

Information Technology uses available management and security tools to monitor patch deployment and identify systems that have not successfully received required updates.

Patch compliance and vulnerability information may be reviewed through endpoint management reports, vulnerability assessments, security platforms, vendor management consoles, or other appropriate mechanisms. Systems that fail to receive applicable updates may be investigated and remediated through subsequent automated deployment or manual intervention.

Exceptions and Operational Considerations

Troy University operates a diverse technology environment supporting administrative, academic, instructional, research, and other institutional functions. Certain systems may require delayed patching because of application compatibility, vendor requirements, instructional or research needs, system availability requirements, or other operational considerations.

When immediate remediation is not practical, Information Technology may employ compensating controls or other risk-reduction measures as appropriate. These may include network restrictions, enhanced monitoring, endpoint security controls, configuration changes, service restrictions, or other safeguards until the applicable patch or permanent remediation can be implemented.

Emergency Security Updates

Information Technology may expedite testing, approval, and deployment when a vulnerability presents a significant or immediate threat to University systems or information. Emergency remediation decisions may consider active exploitation, vendor guidance, threat intelligence, system exposure, and the potential impact of delayed remediation.

Rollback and Recovery

When an update causes significant operational or compatibility issues, Information Technology may remove the update, restore the affected system or configuration, use vendor-provided rollback capabilities, or implement other appropriate recovery measures.

Rollback decisions consider both the operational impact of the update and the security risk associated with returning the system to its previous state. Appropriate compensating controls may be implemented when a security update must be temporarily removed or deferred.

Roles and Responsibilities

Information Technology personnel responsible for University-managed endpoints, servers, applications, network infrastructure, and security systems share responsibility for maintaining appropriate patch levels within their respective areas.

Patch management activities are coordinated with system owners, application administrators, vendors, and other University personnel when necessary to minimize operational disruption while maintaining appropriate security protections.

The University’s patch and vulnerability management process is periodically reviewed and adjusted in response to changes in technology, threats, vulnerabilities, University operations, and available security capabilities.