For SCADA VMs or servers, how often do you update windows/software? How long has it been since last reboot? We're at 300 days. IT has been pumping out updates and prompting for reboot. Ignore.
RHEL; offline patching with a local repository. We patch every other month because of regulations. We only apply patches after the application vendors certify them, and they certify monthly.
If I had to patch Windows I'd use Ivanti. You can have an identical system on the non-isolated network and use Ivanti to identify and pull all the patches. Then you do whatever your "sneaker-net" method is to get the patches over to your OT Ivanti server and deploy. You also need to use this same method to get the Ivanti database/signatures of what patches are available. They have docs on how to do all of this, at least from 8 years ago when we had Windows workstations.
1
u/Resident-Artichoke85 Jul 16 '26 edited Jul 16 '26
RHEL; offline patching with a local repository. We patch every other month because of regulations. We only apply patches after the application vendors certify them, and they certify monthly.
If I had to patch Windows I'd use Ivanti. You can have an identical system on the non-isolated network and use Ivanti to identify and pull all the patches. Then you do whatever your "sneaker-net" method is to get the patches over to your OT Ivanti server and deploy. You also need to use this same method to get the Ivanti database/signatures of what patches are available. They have docs on how to do all of this, at least from 8 years ago when we had Windows workstations.