voodookid

echo "nameserver 4.2.2.1" >> /etc/resolv.conf

Puppet or Cfengine to actually run the updates on the machines. Then you can run a vulnerability checker, such as nessus, to verify that the updates are installed.