Patch management: what it is

In short

A patch is a fix released by the vendor. Most successful attacks do not exploit unknown vulnerabilities but flaws for which a fix has existed for weeks or months and has not been installed. Patch management closes that window in an orderly way, instead of "whenever it happens".

How it works

1. Inventory: knowing which systems and which software you have, and in which version. Without an inventory you cannot know what to update.
2. Monitoring of releases: vendor bulletins (Microsoft publishes its own on the second Tuesday of every month), CSIRT advisories, the results of the vulnerability assessment.
3. Priority: you combine the CVSS severity, whether attacks are under way (CISA's KEV catalogue lists the vulnerabilities being actively exploited), exposure on the internet and how critical the system is.
4. Testing on a small group of machines, for critical systems.
5. Installation within the timeframes decided for each priority band.
6. Verification: the next scan confirms that the vulnerability has been closed.

Why it matters

Technical vulnerability management is required by ISO/IEC 27001, the CIS Controls and NIS2. In practice there are three difficulties: third-party software (PDF readers, browsers, plugins, printer and NAS firmware) that is not updated through Windows Update; systems that "cannot be stopped"; and products that are out of support and will receive no more fixes. When a patch cannot be installed, the exception has to be decided, justified and offset with other measures: it becomes a residual risk accepted knowingly, not something forgotten.

Example

A company sets these rules: critical vulnerabilities on internet-facing systems within 72 hours, critical and high internal ones within 15 days, everything else in the monthly cycle. One Wednesday the firewall vendor publishes a fix for a flaw that is already being exploited: it is applied the same evening, with a short planned outage. The server running the old production software, on the other hand, cannot be updated: it is isolated on a separate network and the exception is recorded with the name of the person who approved it and the review date.

Every month a report compares the open vulnerabilities with the agreed timeframes: how many are overdue, on which systems, and why. It is the figure that management and the auditor ask for to know whether the process works.

Related terms

• CVE
• Zero-day
• Hardening
• Vulnerability assessment