There has been a lot of debate over what type of technology is best for a patch management solution. There are positives and negatives to each type of technology and security concerns to each as well. There is also a group of products out there who claim to be agentless, but act more like an agent. So my first order of business in this discussion is to set the stage as far as the definition of each.
An agentless solution is able to remotely detect current patch status and push tasks to the target for execution without the need to setup services, install software, or push policy to the machine through any means such as GPO etc. So the control and all action is executed from a central point of management.
An agent-based solution requires that some level of software, service, etc. is installed on the machine that needs to be managed, and from that point on tasks are queued or policy is defined and the Agent checks in and pulls down these tasks\jobs and executes them as defined.
Definitions now cleared up, which of these is the ideal solution to implement for any given environment? To understand which solution best fits an environment, we will discuss some of the benefits and drawbacks of both options.
-Agentless solutions are typically faster implementation and have a lower learning curve to fully understand the technology.
-Agent-based solutions can get around some of the port and protocol requirements of agentless or at the very least offset these requirements by making them configurable.
-Agentless technologies allow you do more effectively discover machines in the environment where agent based machines you need to deploy the agent to the machines through specific delivery mechanisms. What if you bypass the delivery mechanism? Ex: agent delivered by OU falls short for my handful of non domain machines.
-Agentless solutions need to have access to the machine at the time of the task to be executed. Agents can be configured to catch missed tasks and execute them again at an alternate time (on next reboot etc).
- Agentless solutions typically can reach Domain, multi domain, and non-domain machines more effectively for a single management console than some agent based solutions.
-Agent-based solutions can manage highly mobile machines more effectively. They can also offset bandwidth constraints for both scan and deployment side.
-Agentless solutions have no persistent footprint on a machine and for the highly regulated can bypass some very tedious software certification processes to get an agent approved to run on machines such as servers. One can argue an agentless solution requires opening up to many security risks, like file and print sharing, remote registry, etc. These requirements can be locked down to reduce the risk.
-Agent-based solutions can miss a machine altogether because it did not get the Agent or the Agent failed in some way, which is as great a security risk to the environment if it goes unpatched. However, it would be a greater security risk to address a security hole that requires at least admin authentication rather than addressing a different hole in the network that lets the end user to elevate their privilege at will, which is a greater risk in the end.
The debate could go on much longer, and has for that matter, but I think we have enough of an argument built up to come back to the original question. Which solution is best, agentless or agent-based? It is arguable that neither solution can stand on its own without at least part of the other. The best overall solution is one that utilizes the strengths of both agent-based and agentless solutions. Most organizations need to be able to do some level of agentless discovery especially in this day and age of Virtual technology. With an agentless solution, an IT admin can provision and deliver a server anywhere in the world in minutes. How easy is it to do so and miss a key step like adding the machine to the correct OU or installing a specific agent to manage the machine? It happens more than most would like to admit. Believe me, I have been part of installs where discovery scans have raised interesting questions and opened several eyes. We also need products to handle the mobility of today’s world. An agent-based solution makes more sense for these machines, as an agentless solution cannot manage laptops effectively on its own. You can get creative with configuration and mitigate the issue, but you cannot eliminate it altogether without the help of an agent. Shavlik NetChk Protect started as an agentless technology and added an Agent to manage some hard-to-reach places for agentless solutions. Most partner and customer implementations that I manage with Shavlik today involve both the agent and agentless capabilities of our product.
- Chris Goettl
