The document discusses various methods for maintaining cloud systems, including patching cloud components, designing and implementing automation/orchestration, and different patching strategies. It covers patching development, QA, and production environments separately and describes techniques like rolling updates and blue/green deployments. The document also discusses hotfixes, patching failover clusters, dependency considerations, and guidelines for reviewing component types, using test environments, scheduling updates, and investigating dependencies. It suggests automating tasks like snapshotting VMs, patching, restarting VMs, and removing outdated/stale components. Automation workflows and regular maintenance schedules are also proposed.

1. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Maintaining Cloud Systems
1
• Patch Cloud Systems
• Design and Implement Automation and Orchestration for Maintenance

2. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Scope of Components to be Patched
2
The components you should look to patch are:
• Hypervisors
• Virtual machinesOperating systems
• Virtual appliances
• Networking components
• Applications
• Storage components
• Clusters

3. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Production vs. Development vs. QA Patching
3
Development
QA
Patching/Test Production

4. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Rolling Updates
4
• A rolling update is a patching strategy that staggers deployment across multiple
phases.
• This helps reduce downtime and issues from the update.
• Instead of updating all of the servers or tiers at the same time, the update is installed
on one server or subset of servers at a time.
• This can be for any group of cloud components, not just servers or VMs.
• Yu want to consider peak usage times for the organization and schedule any updates
when they will have the least impact.

5. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Blue/Green Deployment Patching
5
Users
Router
New
Version
Old
Version

6. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Hotfixes
6
• Designed to fix serious or critical flaws or security vulnerabilities.
• Designed to be deployed quickly to solve a specific issue.

7. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Failover Cluster Patching
7
• You may want only the critical security patches to address severe vulnerabilities.
• You may instead plan regular outages to perform patching.
• Or you may want to stay as up to date as possible and schedule downtime to install
all patches.
• Cluster-Aware Updating (CAU) is a feature in Windows 2012 and later that updates all
servers in a failover cluster so that it does not impact the availability of the cluster.

8. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Patching Order of Operations
8
Here are the steps to help you create your own process:
Step 1: Do an inventory of all components in your environment, documenting the type of
each component, version, IP addresses, physical location, and function.
Step 2: Try to standardize components of the same type to all use the same version of
their software/firmware/etc.
Step 3: Inventory the security controls you have in place (routers, firewalls, IDSes, anti-
malware, etc.) and their configurations (i.e., firewall rules, etc.).
Step 4: You will compare any reported vulnerabilities against your inventory and security
control list.
Step 5: Once you know the vulnerabilities that apply to your environment, you need to
assess each one for how critical the vulnerability itself is, and how critical the systems it
affects are.
Step 6: You will deploy patches without disrupting uptime or production.
Step 7: Finally, monitor your patch systems for any issues and be prepared to rollback
patches in the event they create problems in your environment.

9. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Patching Dependency Considerations
9
• Some software packages have dependencies on specific versions of other software
packages.
• This can create a problem if you update one software package and another software
package requires the previous version.
• It will throw an error or not function properly, forcing you to rollback the update.
• As part of your inventory, you will determine if you have any software dependencies,
and if they require specific versions of other software.

10. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Guidelines for Patching Cloud Systems
10
• Review all of the different types of components that need to be patched.
• If you can, use a test environment to test patches before applying them to your
production environment.
• At the very least, use pilot systems to test patches on them first.
• Consider peak usage times for the organization and schedule any updates when they
will have the least impact.
• Consider following a patching order of operations to ensure you roll out updates in
the least disrupting and most comprehensive manner.
• Investigate possible dependencies among your systems that could be broken by
patching.

11. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Activity: Creating a Patching SOP
11
• Rudison Technologies does not currently have a plan for patching systems and
applications in their on-premises or cloud environments.
• They want to keep systems up to date without impacting the production
environment with downtime from applying patches or from patches affecting
production systems in unexpected ways.
• You will need to create the high-level steps that form the procedure for patching.
• You will also research automation options that will help with the patching process.

12. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Platform Automation and Orchestration Options
12
• Automation and orchestration can aid your patch maintenance efforts by allowing
you to automate the installation of patches, creating test environments, rebooting
patched systems, etc.

13. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Types of Updates
13
• Physical Hardware Checks
• Backup and Restore
• Software Updates and Licensing
• Event Logs and Services
• Disk Management
• Anti-Virus
• Security
• Active Directory
• Microsoft Exchange Mail System
• Network Performance
• Miscellaneous

14. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Maintenance Activities to Automate
14
Here are some maintenance activities you might consider automating:
• Snapshot VMs
• Cloning VMs
• Patching systems
• Restart/Shutdown VMs
• Maintenance Mode
• Enabling/ Disabling alerts
• Clearing logs and archiving logs
• Compressing drives
• Removing inactive accounts
• Removing stale DNS entries
• Removing orphaned resources
• Removing outdated rules from firewall
• Removing outdated rules from security
• Resource reclamation
• Maintain ACLs for the target object

15. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Automation Workflows
15
• In addition to using automation and orchestration, there are also automation
workflows you can employ.
• Automation workflows are either managed or unmanaged automation solutions that
have prebuilt automation workflows related to the cloud.
• Many CSPs offer their own versions of these tailored to work with their environment.
• AWS has the Amazon Simple Workflow Service (SWF)
• Microsoft Azure has Azure Automation

16. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Maintenance Schedules
16
Automation scripts run on
regular basis on different
schedules

17. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Guidelines for Designing and Implementing
Maintenance Automation and Orchestration
17
• Consider using automation and orchestration to aid your maintenance efforts.
• Consider all your maintenance tasks and which ones would be best to automate.
• Consider using automation workflow either through your CSP or a third party tool to
aid your automation efforts.
• Schedule your maintenance tasks to ensure they are performed on a regular basis.

18. Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Activity: Designing Maintenance
Automation and Orchestration
18
• As part of cloud maintenance the Executive Steering Committee wants to ensure
there are processes in place to help perform maintenance and ensure it is done
correctly.
• The Executive Steering Committee has asked you to evaluate different processes and
tasks that Rudison may want to consider automating.
• Common administrative tasks that are performed are creating new user accounts,
scaling VMs up or down, provisioning and de-provisioning VMs, patching VMs and
applications, backing up data, and managing user accounts.
• You will also need to consider what automation tools you would use.

19. Reflective Questions
Copyright (c) 2019 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Reflective Questions
1. How have your IT teams patched systems in the organizations you've worked
for?
2. In the current IT environment, what maintenance activities would be good
choices for automation?
19