Every month there are new Microsoft® Windows® OS security updates, McAfee® Endpoint Security for DeltaV Systems antivirus updates, Symantec™ Endpoint Protection antivirus updates and DeltaV DCS hotfixes that need to be acted upon. Emerson’s Integrated Patch Management for DeltaV service provides a complete solution for Windows and DeltaV patches that addresses the five deployment steps — identification of Emerson-approved updates, acquisition of update executables, distribution to appropriate workstations and servers, installation for Windows updates and compliance auditing. High resolution image
Integrated Patch Management for DeltaV systems makes it easier to securely update automation software without impacting production
AUSTIN, Texas (Dec. 22, 2021) – Emerson has released Integrated Patch Management for the DeltaV™ Distributed Control System (DCS) to improve security and reliability. This next generation of patch management technology is a completely new, redesigned solution– from the Emerson patch content servers to the individual workstation patching agent– with a new user interface enabling administrators to better identify the production impact of operating system updates and control system hotfixes. Most importantly, the new solution is hardened against potential threat actors to increase cybersecurity by helping prevent a breach in the secure patch management supply chain.
Patch management tools have long enabled plants to track and apply security updates and hotfixes; however, most solutions provide limited information, making it difficult to identify the production impact of a patch before implementation. Vendor testing to comply with IEC 62443 standards helps ensure patches will not conflict with existing system configurations, but the potential for production outages due to unexpected reboots leaves organizations postponing far too many updates. Integrated Patch Management uses new, Emerson-designed interfaces to help users more easily understand the currently patched status of the control system workstations and servers, their pending security patches and hotfixes, and whether a reboot is required for the pending patches.
“In today’s environment of continual cyber threats, organizations are more focused than ever on ensuring that critical software is kept up to date,” said Ken Semph, cybersecurity program manager at Emerson. “Integrated Patch Management enables plants to apply more patches, more easily and securely, and more often, to increase confidence in their overall cybersecurity posture.”
After updates are thoroughly tested against a wide variety of system configurations by Emerson, they are delivered to the Integrated Patch Management server. Patch management administrators can instantly see the patch status of all machines on their DeltaV DCS & Safety Instrumented Systems to quickly identify which systems have pending updates. Patches are displayed in an interface similar to the DeltaV interface they interact with every day, making the system easy to understand and navigate. Moreover, each patch identifies whether it requires a reboot. Armed with this information, users concerned with downtime can incrementally increase security without disruption by immediately applying any patches they know will not require a reboot. Patches requiring reboot can then be performed one machine at a time to reduce the reboot’s impact to the overall operation of the entire system.
The Integrated Patch Management server automatically performs hash checks on all new patches, helping ensure that only original, official updates can be installed. Teams can set operating system updates or antivirus signature files to be installed in the background—ideal for remote or unmanned plants—or can choose to perform installations locally when plant scheduling allows.
