April 14 Slide 1

1
Leveraging Windows System Update Service and
McAfee's ePolicy Orchestrator

• Mike Corn
• Director of Security Services and Information
  Privacy
• Office of the CIO / CITES

2
What is WSUS and ePolicy Orchestrator?

• WSUS
• Patch management for Windows and other Microsoft
  Products
• Follow on product to SUS
• ePO
• Management Console for McAfee Products
• VirusScan, Firewall
• RSN Virex

3
A few features

• WSUS
• More MS products (office, sql server)
• Targeted updates to groups of computers
• Update suitability verification
• Lots more reporting options
• Programming API
• ePO
• Antivirus policy enforcement
• Antivirus push now capabilities
• Rogue machine detection
• Distributed repositories for optimizing bandwidth
• Supports Windows, Linux, and soon Mac
• Targeted policies for groups of machines

4
Why bother?

• Need to ensure.
• Windows patches occur
• Antivirus updates take place
• Nice to know
• OS patch levels
• Antivirus dat levels
• Identification of rogue machines
• Nice to be able to do this from a single
  workstation

So what can we do to help?
5
Alternatives

• Full fledged patch management
• too expensive to license for entire campus
• diminishing returns when compared to WSUS
• GPOs
• unavailable to those not on an Active Directory
• fundamentally different model
• works synergistically with both WSUS and ePO

6
Dont we already do this?

• SUS has been running for some time
• Not as widely used as it probably should be
• WSUS offers significant enhancements
• ePO was never fully licensed for the campus
  (prior to this year)
• - Now it is!

7
Why bundle WSUS and ePO together?

• Similar architectures

Internet
WSUS Secondary ePO Repository
ePO console Web browser
You
8
Gee Mike, this sounds swell. How much will this
cost me?

• As much as zero
• ePO - licensed for campus
• WSUS - free but some database constraints exist

9
Can you make it even cheaper?

• Yes
• CITES will purchase for participating Colleges a
  secondary WSUS server and all necessary software
• CITES will bring McAfee in as needed for free ePO
  training
• CITES will provide WSUS training as needed at no
  cost

10
My College isnt participating, can I still use
WSUS and ePO?

• Absolutely
• - But we wont buy you a server!

11
My unit is small and I dont want to run my own
secondary server

• A few options
• Partner with other units in you College
• Point your hosts directly at the CITES servers
• Talk your College into participating and use
  their secondary server

12
Timetable and more information

• Small team (ALS, ACES, Education, LAS, CITES)
  working on
• Hardware / software standard configuration
• Procedural issues
• Deployment recommendations
• Central servers ordered
• Hope to be in production no later than summer
• College partnerships developing directly with
  Colleges
• General information will be through usual
  channels
• CITES Security archive has ePO docs and software
• https//www-s.cites-security.uiuc.edu/archive/inde
  x.php