For a large, multinational corporation's cloud infrastructure, an automated patch management system is the most effective strategy. The scale, complexity, and dynamic nature of cloud environments make manual patching impractical, slow, and prone to human error. Automation ensures that security patches for newly discovered threats are deployed consistently, rapidly, and verifiably across all systems, including virtual machines and applications. This minimizes the window of exposure, enhances the organization's security posture, and allows for centralized management, reporting, and auditing, which are critical for compliance and governance in a multinational context.

A. Manually applying patches on a quarterly basis is far too infrequent and inefficient to protect against newly discovered threats in a large-scale environment.

B. Relying on end-users is irrelevant for cloud infrastructure patching and is an unreliable method that lacks central control and verification.

D. Disabling automatic updates is a counterproductive security practice that leaves systems perpetually vulnerable and directly contradicts the goal of timely patching.

---

1. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-40 Revision 3

Guide to Enterprise Patch Management Technologies.

Page v (Executive Summary): "Patch management can be a complex and time-consuming activity. Organizations should automate patch management activities as much as possible to improve efficiency and accuracy." This directly supports automation as the most effective approach.

2. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations.

Control SI-2 (Flaw Remediation): This control requires organizations to "identify

report

and correct information system flaws" and "install security-relevant software and firmware updates within the organization-defined time period." In a large cloud environment

meeting these time-based requirements is only feasible through an automated system.

3. Cavalcante

E.

et al. (2021). Automated Software Patch Management: A Definition and a Scoping Review. ACM Computing Surveys

54(3)

Article 63.

Section 1 (Introduction): The paper establishes that "manual patch management is a time-consuming

error-prone

and costly task" and that automation is essential to address the increasing volume and frequency of vulnerabilities. (DOI: https://doi.org/10.1145/3447880)

4. Massachusetts Institute of Technology (MIT) OpenCourseWare. 6.858 Computer Systems Security

Fall 2014.

Lecture 1: Introduction & Threats: The course materials establish the fundamental security principle that systems face a continuous stream of new threats. This implies the need for a continuous and rapid response

which in practice for a large organization

necessitates an automated patch management process rather than slow

manual

or disabled update mechanisms.