The slippery concept of risk
Wednesday, March 17, 2010
1:19 PM
The slippery concept of risk
Beattie et al, "Timing the application of security patches for optimal uptime", Proc. LISA 2002. 
[link]
If uptime is important, then one must balance the risk of work lost due to patches against the risk of security violations. 
Patching early leads to downtime and work lost; one must often "patch the patch."
In some cases, optimal strategy is to wait a month before patching a security hole, to balance risk of downtime against risk of infection. 