Patch management

What it means

Patch management is a controlled process through which a company regularly installs security updates, or patches, on operating systems, applications, network devices and firmware. It covers knowing what runs in the company, tracking new patches, testing them and deploying them within a reasonable time.

Its importance is clear from how attacks happen. A large share of successful breaches, including ransomware attacks, exploit vulnerabilities the vendor fixed weeks or months earlier. The company was vulnerable only because it had not installed the update.

Patch management is one of the basic requirements of cyber hygiene and, for entities covered by the NIS2 directive, part of the mandatory security measures. It is complemented by endpoint protection such as EDR, which catches an attack if a patch is delayed somewhere.

How it works in practice

In a small company we start with an inventory of devices and software. Without it, nobody can say what needs updating, and it often uncovers shadow IT, programs and services management did not know about. We then enable automatic updates wherever that is safe.

For systems where an update could break something, such as accounting software or a database server, we agree a regular maintenance window. Beforehand we verify that backups work, so the previous state can be restored if something goes wrong.

Critical patches fixing actively exploited flaws do not wait for the planned window. For them it is decided in advance who approves immediate deployment and what to do if a breach may already have occurred, which ties into the incident response plan.

What to watch out for

The most commonly forgotten devices are routers, printers, cameras and network storage. They run for years without attention and their firmware does not update itself. Attackers often get into an otherwise well-protected network precisely through them.

Software the vendor no longer supports is a separate risk. An old version of an operating system or application will receive no patches at all, and the only fix is moving to a supported version. That cost should be budgeted for, not postponed until the first incident.