Emerson has released Integrated Patch Management for the DeltaV Distributed Control System (DCS) to improve automation system security and reliability. This next generation of patch management technology is a completely new, redesigned solution– from the Emerson patch content servers to the individual workstation patching agent– with a new user interface enabling administrators to better identify the production impact of operating system updates and control system hotfixes. Most importantly, the new solution is hardened against potential threat actors to increase cybersecurity by helping prevent a breach in the secure patch management supply chain.
Integrated Patch Management uses new, Emerson-designed interfaces to help users more easily understand the currently patched status of the control system workstations and servers, their pending security patches and hotfixes, and whether a reboot is required for the pending patches.
After updates are thoroughly tested against a wide variety of system configurations by Emerson, they are delivered to the Integrated Patch Management server. Patch management administrators can instantly see the patch status of all machines on their DeltaV DCS & Safety Instrumented Systems to quickly identify which systems have pending updates. Patches are displayed in an interface similar to the DeltaV interface they interact with every day, making the system easy to understand and navigate. Moreover, each patch identifies whether it requires a reboot. Armed with this information, users concerned with downtime can incrementally increase security without disruption by immediately applying any patches they know will not require a reboot. Patches requiring reboot can then be performed one machine at a time to reduce the reboot’s impact to the overall operation of the entire system.
The Integrated Patch Management server automatically performs hash checks on all new patches, helping ensure that only original, official updates can be installed. Teams can set operating system updates or antivirus signature files to be installed in the background—ideal for remote or unmanned plants—or can choose to perform installations locally when plant scheduling allows.