Endpoint Operating System Updates

Overview

The University of Alaska (UA) manages operating system updates for university owned endpoints (e.g. desktop, laptop, tablet, smartphone, etc.) using UA's Endpoint Management (EPM) service to ensure device security and compliance with UA's Vulnerability and Patch Management Standard and industry best practices by following a regular feature and security update schedule. Older and unpatched operating systems increase the likelihood of cyber-criminals exploiting vulnerabilities to control systems or steal information. Individuals will be notified of a pending update by a notification message on their screen.

As a general policy UA follows a "n-1" rule with regards to most software. This means that for authorized software, UA supports the currently released version (i.e. 'n'), and the version immediately prior (i.e. '-1'). For vendors that offer long-term service (LTS) variations of their product this is typically the supported version.

Below are a few examples:

• macOS: If the latest version of macOS is Sequoia (15.x), then the oldest supported version would be Sonoma (14.x)
• Windows: If the latest version of Windows is Windows 11 24H2, then the oldest supported version would be Windows 11 23H2.

There are trade-offs with regards to the risk of acting too fast or too slow when it comes to applying software updates, either security fixes, or major updates. The probability of there being errors, issues, or incompatibilities related to an update is rare, but does happen; however, the risks associated with leaving systems exposed to cyber-attacks by delaying the installation of updates is greater. Accordingly delaying the release of updates, or upgrades may be considered only if an incompatibility, or error is identified with core software supported by the university which would result in an increased vulnerability to cyber-attacks.

In this article:

• Apple Update Schedule
• Microsoft Update Schedule
• Disallowed Operating Systems

Notifications

When new software updates, or upgrades are available individuals will be notified by a notification message generated by their operating system (e.g. macOS notification, Windows taskbar notification). Depending upon the nature of the update to be applied it may be possible to defer the update for a limited period of time so as to minimize impact to your scheduled.

Apple Update Schedule

Rapid Security Response (RSR) Update

Rapid Security Responses are a type of software release for iPhone, iPad, and Mac that deliver important security improvements between software updates. They deliver important security improvements between software updates—for example, improvements to the Safari web browser, the WebKit framework stack, or other critical system libraries. RSRs are delivered only for the latest versions of iOS, iPadOS, and macOS, starting with iOS 16.4.1, iPadOS 16.4.1, and macOS 13.3.1. When a RSR has been applied, a letter appears after the software version number (e.g. macOS 13.3.1 (a)).

Software Updates

Software updates are frequently released patches that help secure or enhance the current operating system.

Software Upgrades

Apple typically releases software upgrades on an annual basis. Apple's software release typically does not align with academic schedules, and often release an update just prior to, or during the academic year. While Apple does provide pre-release versions, these are adequate for preliminary testing but cannot be used for final testing prior to general deployment to the university community. Accordingly, to minimize disruption IT postpones the enforcement of operating system upgrades for a period of three (3) months, which allows testing of the new operating system and common software used by the university community. Faculty and staff members may opt-in to be an early adopter by selecting the upgrade from the Kandji Self Service application.

Microsoft Update Schedule

Windows Quality Updates

Microsoft Quality Updates are frequently released patches that help secure or enhance the current operating system.

Windows Feature Updates

Microsoft typically releases Feature Updates once per year and include new functionality and capabilities as well as potential fixes and security updates. Microsoft's software release typically does not align with academic schedules, and often release an update just prior to, or during the academic year. While Microsoft does provide pre-release versions, these are adequate for preliminary testing but cannot be used for final testing prior to general deployment to the university community. Accordingly, to minimize disruption IT postpones the enforcement of operating system upgrades for a period of three (3) months, which allows testing of the new operating system and common software used by the university community. Faculty and staff members may opt-in to be an early adopter by selecting the upgrade from the MECM Self Service application.

Disallowed Operating Systems

Disallowed operating systems are not allowed to connect to the UA network as they pose a security risk to the entire network. We understand that there are some use-cases where legacy operating systems are still needed to run legacy software, or interface with older equipment. In these cases UA IT will work with University departments to determine a solution that allows the continued use of the software/hardware while mitigating the security risks to the network.

Need additional help or have issues

For support, requests may be submitted anytime using the appropriate Endpoint Management form. Requests generate a Ticket which will be worked in order received and urgency by IT Employees with the knowledge and permissions to assist with the request.

For immediate assistance please review the Contact Us page for the appropriate support group.