Key takeaways
- Patch on a schedule, and fast-track actively exploited flaws
- Pilot updates on a small group before everyone
- Verify installs: a scheduled patch is not an installed patch
- Isolate, and plan to replace, what cannot be patched
What needs patching
- Windows, macOS and Linux operating systems
- Firmware for laptops, servers, firewalls, switches and Wi-Fi
- Browsers and common apps such as PDF readers and Office
- Line-of-business software, usually updated by or with the vendor
- Phones and tablets used for work
Prioritize by real risk
Not every update is urgent. A flaw that attackers are already using, especially on something exposed to the internet such as a firewall or VPN, should move to the front of the line.
CISA publishes the Known Exploited Vulnerabilities catalog, a list of flaws with confirmed exploitation in the wild. It is a practical way to decide what to patch first.
A patch routine that works
Inventory
Know every device and what runs on it. You cannot patch what you do not know about.
Pilot
Send updates to a small group first, including someone who uses each critical app.
Deploy
Roll out to everyone on a regular schedule, outside working hours where a restart is needed.
Verify
Check reports for devices that failed, were offline or are waiting on a restart, and follow them up.
Document exceptions
Record anything held back, why, and when it will be looked at again.
When you cannot patch
Some systems cannot be updated: an old computer that runs lab or production equipment, or software the vendor no longer supports. Isolate them on their own network segment, limit who can reach them, watch them closely and plan their replacement.
Operating systems past the end of support are also a common reason cyber insurance applications get flagged.
How we help
Each managed workstation at ManagedITServices.Tech includes Windows, macOS and Linux patching, firmware updates and health monitoring, and managed servers include patch management with 24/7/365 NOC monitoring. Updates to line-of-business software stay with your software vendor. Asset and lifecycle tracking feeds the hardware refresh roadmap in your vCIO plan, so end-of-life systems are planned for rather than found by surprise.
Sources
- CISA: Known Exploited Vulnerabilities catalog
- NIST SP 800-40 Rev. 4: Enterprise Patch Management Planning
- CISA: Update software
Information on this page is general and is not legal or compliance advice.