Drivers are the forgotten patch
Dec 14th, 2020 by Jesper Kråkhede
In my previous post I wrote about attackers using old vulnerable drivers to switch off security products. Let me continue on the same theme from a patching perspective.
Most companies are fairly good at patching Windows by now. Some are good at patching applications. Very few patch drivers and firmware. They come from a long list of vendors, they are updated through different tools or not at all, and nobody wants to be the one who updated the network card driver on the database cluster.
The result is machines running drivers that are years old, with known vulnerabilities, and nobody knows. The same goes for the firmware in the BIOS, the disk controllers and the network cards.
Start with an inventory. Your device management tool can usually tell you which drivers and versions are installed. Then group them by vendor and find out how each vendor distributes updates. Include driver and firmware updates in the normal patch cycle, even if it is only every quarter to begin with. Test them on a few machines first. And remove what isn´t used, like old software packages that installed a driver for a feature nobody uses.
Patching is not only Patch Tuesday. Everything with code in it needs updating.