what is the recommendation about installing Sharepoint security updates

Question

I have a SharePoint on-premise enterprise server 2013. and one of the most confusing issues i have faced is how we need to manage the sharepoint security and non-security updates. now i am working with a new customer and their system admin mentioned that each 2 months they patch all the windows servers and they install all the windows security updates and any application updates (sharepoint in my case).

now i have been working with sharepoint for around 3 years, and i did not find any recommended appraoch to follow. now i remember that inside one of the farms i use to work with , our customer received the following problem suddenly

https://social.technet.microsoft.com/Forums/en-US/14788a0e-5acd-4d1f-8de4-a9250f149fe6/error-typeerror-unable-to-get-property-replace-of-undefined-or-null-reference?forum=sharepointgeneral

which was realted to installing a buggy SP security update ,, so from that time i always get worried when i work with customers which force all the sharepoint security updates to get installed.

so can anyone advice on these questions , so i can understand how i need to appraoch installing sharepoint security updates:-

1. if we are talking about the recommendation from Microsoft, is it mandatory to install the latest sharepoint security updates?

2. what is the maximum damage a buggy security updates can cause ? now from my previous experience, i remember that i have installed a security update which have changed some behaviors of the look and feel of the left navigation links (Quick Launce links), were after installing the related security updates the current Quick Launch link will get Bold. so seems security updates can affect non-security features. so could this mean that installing a buggy security update can break non-security modules?

3. On our current customer case i worked on phase one of the project around 1 years ago, and from that time the server have been patched many time. and i found around 5 sharepoint security updates have been installed ,, but they have never run the product configuration wizard.. so can i consider the current farm as if it is in an inconsistent state? since they ave installed some sharepoint security updates without running the product configuration wizard?

4. should i force the system admins to stop installing sharepoint security updates ? although this sound in-professional in a way or another,, because system admin will have a strong claim that they will not allow any server to have any security holes or vulnerability.. so installing sharepoint security updates will be a must from their side..

5. Is it a supported/valid approach if we keep installing sharepoint security updates ONLY without installing full CUs ?

6. can we chose which security updates we need to install? for example if we find that a security update will fix a major vulnerability then we might install it,, but if we find some security updates which is not critical then can we skip it? or security updates need to (preferred) be installed all at once ?

7. can i know how others is approaching installing sharepoint security updates? so i can benefit from their cases,, as i am totally confused, if i need to force the system admin to stop installing sharepoint security updates? or i am over thinking the effect of installing security updates maybe because this issue which i faced enter link description here is still in my head !!

Can anyone advice on the above 7 points?

Thanks

Answer 1

1. There is no "official" recommendation from Microsoft to always install the latest CU for SharePoint. SQL Server has such an advice. BUT: If you open a Microsoft Support Case, you will get told to patch your SharePoint-Farm before the case will continue.

2. If you really ask for "maximum damage": A completely broken farm and the need to fully restore the farm from your DesasterRecovery Backup. The risk is small, but it's not impossible to break. Always have a working backup before patching!

3. Answered here. Summary: Run ProductsConfig Wizard or psconfig.exe after every SharePoint related patch as you cannot forsee the exact changes of the patch.

4. Look at this discussion.

5. You can install Security hotfixes only. But i would recommend to install a CU at least every 6 to 12 months (see question 1). I have seen tons of cases which had never appeared if the customer's farm hadn't been that old.

6. You can install them individually. Usually they do not have a prerequisite. If they have, it will be mentioned in the KB-Article and also be checked during installation. If you install a CU, it will always contain every released security patch.

7. See discussion in question 4.

Conclusion: We do not live in a perfect SharePoint-World. If your customer REALLY wants every Application-Security-Update installed and as lees risk as possible, that means a lot of work:

• You have to read every KB-Article before installing. Google around for possible issues
• Look at ToddKlindt's wonderful CU-list for possible issues
• Install the Update on customer's test-farm first. Be sure the test-farm matches the productive environment as exact as possible. Work through the checklists, which features MUST work after patching.
• Install the updates on Prod-farm and check again.

Seems too much work? Then your customer isn't willing to handle the effort his requirement implicates. He has to live with the risks of a buggy patch or a not fully-patched farm.

My pragmatic recommendation is also mentioned in the discussion from question 4. Works perfect for lots of mid-range customers. Especially if the farm is published externally, you usually have a lot more adjusting screws to improve security than a SharePoint Security patch.