Productive Corporation

Download

Patch Management Comparison Article.pdf (79.19 KB)

The following article was published by Productive Corporation to provide its customers with an additional resource in determining the right data backup and recovery solution for their company's environment. Productive produces content focusing on the relevant issues of Mid-Market IT professionals to give its customers perspective on current trends. Recent topics have included patch management, hosted recovery on demand, as well the evolution of software licensing.  

Product Comparison: BigFix Patch Management and Shavlik Netchk Protect

Introduction: 

As an IT professional it is vital that your company's network is fully patched and properly configured to battle today's diverse, sophisticated threats. Patch management is a straightforward tool that will enable you to effectively address your company's security and compliance objectives. However, choosing the right patch solution for your environment isn't always as straightforward. This leads to the question, "With all the patch management solutions out there, which solution is the right one for my company?"

Microsoft's Windows Server Update Services (WSUS) is the foremost solution identified with patch management today. However, not coincidentally, its notoriety is primarily based upon the fact that it is a free product offering with exclusive support of Microsoft issued updates and patches. For most companies this solution does not automatically answer all their technology needs, thus requiring alternatives to a solution that solely supports Microsoft Products.

To get a sense of the alternatives available to WSUS, we decided to focus on two of its leading players in patch management, BigFix and Shavlik. BigFix's Patch Management offers a unique agent-based system with Fixlet components, as well as, cross platform capabilities, while Shavlik's Netchk Protect provides industry leading blended agentless and agent-based systems with comprehensive technology. Both BigFix's Patch Management and Shavlik's Netchk Protect offer you solutions with automated, flexible features that will simplify your network security. 

This article contrasts BigFix and Shavlik's Patch Solutions across six key areas: product architecture, product requirements, scalability, ease of deployment/use, cost, and platform vs. point solution. We think these may be helpful while contemplating which patch management solution is the best fit for your environment.

Product Architecture:

The architecture of a patch management solution offers you a choice between agent based and agentless systems, both of which have their advantages and disadvantages. BigFix's Patch Management and Shavlik's Netchk Protect provide you with two distinct approaches in configuring the right architecture for your environment.

BigFix's Patch Management is a comprehensive solution that features an agent-based system that allows you to install on client desktops and sometimes- connected devices. This characteristic is often considered the principal disadvantage of agent-based systems. However, this perceived drawback is also associated with the benefit of very fast, accurate architecture. This very fast, accurate architecture of "smart" agents and "dumb" servers does all the patch relevance analysis and processing for you, which keeps your roaming computers up to date without reliance on your centralized servers.

Shavlik's Netchk Protect, conversely, is a solution that features blended agentless and agent-based systems. This blended solution is able to address your company's needs from stationary systems to frequently disconnected devices to systems with bandwidth constraints. This approach can speed up and simplify your company's deployment. One downside to consider is that bandwidth throttling is not as precise as that of a single agent-based system.  

Product Requirements:

The following product requirements provide you an overview of BigFix's Patch Management and Shavlik's Netchk Protect management server/console specs, network/agent footprint and supported platforms. 

BigFix's Patch Management:

BigFix's Patch Management solution is part of a unified platform that distributes communication continuously using BigFix's unique Agent, Console and Server components. This approach allows you to utilize your desktops and personal workstations in maximizing speed and flexibility, as opposed to, slowing down your network bandwidth. 
 

• Management Console Specs: typically managed on workstations from Terminal or Citrix server (based on 1000 or less managed workstations and BigFix Agents, respectively).
  Workstation Processor: 2 GHz
  Workstation RAM: 512 MB
  Workstation Disk Arrays: 100 MB
  Terminal/Citrix Processor: 2-3 GHz - 2 Cores
  Terminal/Citrix RAM: 4 GB
  Terminal/Citrix Disk Arrays: 1 RAID Array (RAID 5,10) - 10 GB free
• Management Server Specs: based on a single BigFix dedicated server that hosts BigFix Server software, BigFix Web reports and SQL Server.
  Processor: 2-3 GHz- 2 Cores
  RAM: 4 GB
  Disk Arrays: 1 RAID Array (RAID 5,10)
• Network Footprint:
  20-50KB
• Agent Footprint: 
  < than 2% CPU utilization

Shavlik's Netchk Protect:
Shavlik's Netchk Protect solution offers a unique point solution that blends Agent/Agentless architecture, assisting with connectivity. This blended solution provides you with a complete, flexible deployment.

• Management Console Specs:
  Processor: 500 MHz CPU- 2.0 GHz recommended CPU (multi-processor machine if more than 1000 seat license)
  Memory: 256 MB RAM minimum- 2 GB of RAM (4 GB if more than 1000 seat license)
  Disk Space: 60 MB for application-  2 GB or more for patch repository
• Network Footprint, Agentless:
  Disk Space: Free space equal to 5 times the size of the patches being deployed
• Network Footprint, Agent:
  Processor: 500 MHz or faster CPU  
  Memory: 256 MB RAM minimum- 512 MB RAM+ recommended
  Disk Space: 30 MB for Netchk Agent client- 500 MB or more for patch repository

Scalability:

In contrast to WSUS, BigFix's Patch Management scales seamlessly and is extremely adaptable within an enterprise environment. A single BigFix management server can administer over 250,000 endpoints.

Shavlik's Netchk Protect offers great flexibility and functionality within the small to mid-sized environment. This scalability is optimized by Shavlik's capacity to support up to 50,000 endpoints with one console. It is very customizable and easy to extend- allowing the product to grow with your company's initiatives.

Ease of Deployment and Use:

It is crucial that the right patch management solution provides your company with effective, successful deployment and use. This feature will assist your company in being aware of how much effort needs to be relegated to deployment and use of either Big Fix's Patch management or Shavlik's Netchk Protect

BigFix's Patch Management is quickly and easily able to perform the deployment in the time span of hours to days. The deployment requires 1 BigFix agent per endpoint, 1 BigFix Server and 10 BigFix Relays. Keep in mind that 10 BigFix Relays are recommended; however you are certainly able to leverage existing systems, instead of allocating a dedicated system. For further analysis on whether this product adheres to your network and use objectives, download the trial that Big Fix offers. BigFix Patch Management Trial Download.

Shavlik's Netchk Protect is easy to use, offering fast, automatic deployment. This deployment can go from install to scanning in 30 minutes. For further analysis on whether this product adheres to your network and use objectives, download the trial that Shavlik offers. Shavlik Netchk Protect Trial Download.

Cost:

No matter which patch management solution you like technically, you must consider the cost associated with it. BigFix's Patch Management price model is based on a subscription or perpetual, per endpoint cost. The license and standard maintenance programs are broken down by list price, below.

BigFix Patch Management Price Model

Shavlik's Netchk Protect price model is also based on a subscription or perpetual, per endpoint cost. The license and standard maintenance programs are broken down by list price, below.

Platform vs. Point Solution:

Maximizing your purchase of a patch management solution requires comparing the added value and distinguishing technology of each product. Both BigFix's Patch Management and Shavlik's Netchk Protect offer distinctive value in their solutions.

BigFix's Patch Management delivers a comprehensive solution with the use of a single server. Through this solution, you will be able to provide your company with high performance, agent-based, broad platform coverage and bandwidth throttling capabilities. BigFix's Patch Management offers real-time reporting as well as allowing you to manage up to 18 applications within a single console. These applications run the gamut from System Lifecycle Management to Endpoint Protection to Security Configuration Management. Finally, this solution is based off of a unique patch management approach called "Fixlets". These "Fixlets" target and take action against any unpatched issues or related problems.

Shavlik's' Netchk Protect offers an automated, simplified and scalable patch management solution. Shavlik's solution goes beyond just patch management for your network- incorporating antivirus and antispyware technology. The integration of antivirus, antispyware and patch management into one single agent simplifies your environment, and helps to reduce cost for your company.  Netchk Protect offers industry leading capabilities that give your company the ability to choose between agentless or agent-based system architecture. Finally, this solution reduces your company's exposure to risk through its "Any Patch, Anywhere" technology.

Conclusion:

Overall, selecting the right patch management solution plays an important part in the success of your company's IT security initiatives. Windows Server Update Services (WSUS) may be the answer if your environment is small (fewer than 25 nodes), your network is primarily Windows based and a two thousand dollar solution is out of budget. If you are looking for an automated and flexible solution that addresses today's ever increasing, diversified threats and have a security budget available- then a third party solution is potentially the right fit.  BigFix is a leading player if you want patch management at your organization to be part of a broader platform that includes asset and power management. Shavlik may be your answer if you have a discrete need for simplified patching. Either way, both Big Fix and Shavlik provide your company with tier one technology that allows simplified management and increased security within the patch management process.

Additional Resources Offered by Productive Corporation:

Productive Corporation is a specialized software reseller that assists small and mid-sized businesses across North America with software initiatives in security, storage and infrastructure. We provide subject matter expertise, access to technical resources and excellent customer service. We also strive to provide the most relevant resources for our customers. Please make use of Productive's additional resources found below.

Patch Management: An In Depth Look
By any measure, patch management is a crucial task. Data security is more important than ever, and threats to your data are multiplying and growing more sophisticated all the time. On top of that, given the number of updates and patches that vendors release each month, the patch management process can quickly overwhelm the typical mid-market IT staff. What options do you have? This P-guide examines some of the latest solutions.

Video: IT Professionals Forum: Patch Management
Productive hosted a Patch Management IT Professionals Forum.  This recorded Forum explores three leading patch solutions; WSUS, Shavlik Netchk Protect and BigFix Patch Management.

Tips for Justifying Your IT Budget
During this general economic downturn more companies are cutting IT budgets. What should be done to minimize the damage and how can new and existing expenditures be justified to management?

We Can Help You
Deployment Questions
Licensing and Technical Support
help@productivecorp.com
800.726.4099