CMS Security Handbook: The Comprehensive Guide for WordPress®, Joomla!®, Drupal™, and Plone®

Understanding the Patching Process

If your business consists of more than one person, and you have the luxury of an IT staff, then equipping that team with a process like the one described in this chapter can make for smooth upgrades.

This team should be organized around a process, rather than around a person. By doing so, you can quickly substitute for a person who is on vacation or who may not be available. The process described in this chapter is called the patching process. It follows seven general steps:

1. Monitor information sources for patches, vulnerabilities, and updates.
2. Back up your site and your database
3. Download the patch. (If one does not exist, you must provide a workaround.)
4. Test the patch to determine that it works and that it does not break anything in the process.
5. Deploy the patch following the instructions specific to your operating system, CMS, or hardware device.
6. Run another backup of the site and database after you patch.
7. Document the work you conducted and then return to Step 1.

As you can see, the patching process involves much more than just grabbing a patch from a website, applying it, and moving on to the next task.

Another factor that may be pertinent in the patching process is what takes place after a successful patch application. Returning to the Microsoft Windows desktop example, if you download a patch and apply it to your desktop, it might require a reboot, which is not really a big deal for your basic user. However, a reboot of a server operating ...