You're facing the need for security and quick IT updates. How do you strike a balance between the two?

1. Identify and assess your assets. 2. Pinpoint the most vulnerable points. 3. Prioritize based on potential impact. 4. Apply stringent security measures to high-risk areas. 5. Allow more flexibility where lower risk is acceptable. 6. Tailor your approach to each system's needs and information sensitivity.

Captain Kirk to Scotty "We need it in one hour or we all die." Scotty to the Caption -"we can do it in 8 hours" Three hours latter it is fixed and no one dies. Words and lesson to live by; Take your best estimate double it and give that as your best time. Then deliver early. Under promise and over deliver!

Balancing security and quick IT updates is a challenge, especially in light of recent events like the Crowdstrike global IT outage. Here's how to approach this balance: 1. Establish clear procedures for testing & deploying updates. 2. Use staging environments to test updates before rolling them out to production. 3. Have a rollback plan in case updates cause unexpected issues. 4. Assess the criticality of each update & prioritize security patches for known vulnerabilities. 5. Retain manual oversight for critical systems & updates. The key to a balance between staying current with security updates & maintaining system stability is in robust testing procedures & quick response to issues that arise during the update process.

I usually deliver updates in three categories, standard updates, security updates and urgent/zero day updates. In the case of zero-day vulnerabilities, there is usually not much time for testing. But for the other categories, I usually work with at least 3 rings for granular rollout and to be able to stop the process without affecting all devices.

Automation for all types of updates is key. Nobody likes to package or approve updates on a daily basis. So my advice is to automate as much as possible or use a third party service to do the validation and packaging for you. Of course, there are cases where automation makes no sense, but there will always be exceptions to this rule.

Absolutely agree! Every update should be evaluated through the lens of GRC (Governance, Risk, and Compliance). Adopting a security-first mentality ensures that we're not just focusing on functionality but also on the potential risks each update may introduce. Prioritizing security in every decision is key to safeguarding our systems and assets while maintaining operational effectiveness.

Absolutely agree! Every update should be evaluated through the lens of GRC (Governance, Risk, and Compliance). Adopting a security-first mentality ensures that we're not just focusing on functionality but also on the potential risks each update may introduce. Prioritizing security in every decision is key to safeguarding our systems and assets while maintaining operational effectiveness.