Patch everything. Yes, everything
Dec 24th, 2020 by Jesper Kråkhede
A last business post for this year, about patching. It is the least exciting topic in security and one of the most important.
This year we have seen VPN gateways, remote desktop servers and old drivers used to get into companies. In almost every case the patch already existed. Sometimes for months, sometimes for years.
Why aren´t things patched? Usually for good reasons. The system is critical and can´t be restarted. The vendor doesn´t support the new version. Nobody knows who owns the server. There is no time. All understandable. But every one of those reasons is a risk that someone in management has accepted, often without knowing it.
So think about the cost. A good patching process costs staff, tools and some planned downtime. Not patching costs nothing, until it does. Then it costs incident response, downtime, lost customers and sometimes a ransom.
What should management do? Demand to know how much of the environment is patched within a set time, for example 30 days for normal patches and a few days for critical ones on internet facing systems. Ask for a list of everything that can´t be patched and who decided that. And give IT the maintenance windows they need, even if it is inconvenient.
The patch you don´t install is the one they will use.