Türkiye Finans Adopts Server Patch Management Process, Improves Security

“Without the help of Microsoft Services Premier Support, it would have been extremely hard to implement our patch management process or we simply would have not done it.”

Ikram Goktas, IT EVP, Türkiye Finans Katılım Bankası

Business Needs

Türkiye Finans Katılım Bankası, the Turkey Financial Participation Bank, has 182 branches, more than 3,350 employees, and more than 1 million customers. To support its ancillary banking services and associated applications, the bank relies on more than 540 servers based on Windows Server. Because different departments and business partners managed these servers, the bank lacked an official, centralized patching process and, often, updates were not applied. In fact, according to Taner Öner, System Center Administrator for the Change and Configuration Management Department of Türkiye Finans, “Only 20 percent of our servers were compliant with new updates and patches.” Because these servers went unpatched, the bank’s antivirus software was not sufficient to protect the bank from outside threats on its own. Says Ahmet Yılmaz, Manager of the Information Technology Department at Türkiye Finans, “At one point, a virus contaminated our unpatched servers

and resulted in a shutdown and restart attack.”

Stemming from the inefficiencies of not keeping servers up-to-date, the bank experienced two instances of unplanned downtime for some servers in 2009. “When our ancillary services go down, the cost to our business is simply too high,” says Yılmaz. Realizing these inefficiencies, the bank looked at implementing an official patch management process.

SolutionTaking advantage of the proactive services made available through its Microsoft Services Premier Support contract, Türkiye Finans took part in a Software Update Management engagement. Through the engagement, Öner and the bank’s change management team worked with the Microsoft Services Premier Support team to build a tailored patch management process based on Microsoft best practices and guidance. “We were able to save considerable time by taking advantage of materials

Customer: Türkiye Finans Katılım BankasıWebsite: www.turkiyefinans.com Customer Size: 3,350 employeesCountry or Region: TurkeyIndustry: Financial services—Banking

Customer ProfileTürkiye Finans Katılım Bankası is a Turkish participation bank with 182 branches, more than 3,350 employees, and more than 1 million customers.

Software and Services Microsoft Services−Premier Support

Microsoft ServicesAs the consulting, technical support, and customer service arm of the world’s leading software company, Microsoft Services enables the successful adoption, deployment, and use of Microsoft solutions and technologies for all customers.

For more information about Microsoft Services, go to: www.microsoft.com/microsoftservices

that were already prepared,” notes Celal Hakyemez, Manager of the Change and Configuration Management Department at Türkiye Finans.

The patch management procedure itself includes several phases: inventory collection, assessment, test, pilot, deployment, monitoring, and reporting. Says Öner, “We never deploy any patches directly to production without conducting certain test activities.”

To get to this point, the teams covered areas spanning both technology and operations, with the initial stages taking only 30 days. During these first 30 days, Öner and his team worked with the Microsoft Services Premier Support team and a local partner to update Microsoft Systems Management Server to Microsoft System Center Configuration Manager 2007 SP2 to realize the benefits of new software update features and enhanced reporting capabilities. The Microsoft Services Premier Support team then helped the bank’s IT team establish templates and workflows to support a patch management process aligned with the bank’s overall change management process. Based on this initial guidance, the bank’s IT team drove the adoption of an update management process in the following 30 days. In this 30-day period, Öner and his team worked to identify the owners for all 540 servers and then provided briefings and introductory sessions on the value of updates and the changes soon to be made to existing processes.

Says Öner, “This was something we had never done before, so it was important that we clearly explained the value of what we were doing to all stakeholders as a first step in working with them.” Öner and his team then used the knowledge gained to create documentation and internal procedures that involved routing server update approval through the bank’s audit department.

BenefitsSince taking part in the Software Update Management engagement, Türkiye Finans has established the procedures needed to keep its 540 Windows Server–based machines up-to-date. Looking back at the engagement, Öner notes that he has seen a change in culture throughout the company. “Now, the server owners, compliance department, and audit department are all involved and understand the software update process,” he says. “With everyone aware, the business is now asking for compliance reports and they embrace the process.”

Achieve 100 Percent Patch ComplianceBefore the Software Update Management engagement, only 20 percent of Türkiye Finans’s servers based on Windows Server received regular updates. In contrast, Öner notes that, “Now, 100 percent of our servers based on Windows Server receive updates.”

Improve SecurityBecause Türkiye Finans keeps its servers up-to-date, it has been able to avoid outside threats. Says Öner, “IT is very essential to the success of our bank, and we are managing the information of both our internal and external clients. It has been fundamental that we have been able to reduce any security vulnerabilities that may arise from missing security patches.”

Reduce Unplanned DowntimeSo far, with the Software Update Management process in place, the bank has not experienced unplanned downtime across more than 540 servers. Says Öner, “The risk of system malfunction or any unexpected downtime is tedious for the bank. By applying the patch management process, we are able to minimize these risks.”

Says Ikram Goktas, IT EVP of Türkiye Finans, “The patch management process that we conducted by using Microsoft technology and best practices enabled the bank to increase business continuity, improve corporate image, and save money. With the help of those solutions, our bank will be better off in the future.”

© 2010 Microsoft Corporation. All rights reserved. This case study is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Microsoft is either a registered trademark or trademark of the Microsoft group of companies.

Document published September 2010