How do we patch faster?
Dec 7th, 2023 by Jesper Kråkhede
Every year the time between a vulnerability being published and being exploited gets shorter. For the most critical ones on internet facing systems, it is now a matter of days, sometimes hours. Most organisations still patch in monthly cycles, if that. How do we close the gap?
Know what you have. You can´t patch what you don´t know exists. Use your vulnerability management, for example Defender Vulnerability Management, to get a continuous inventory of devices, software and missing patches, and let it tell you what is actually exposed and exploited.
Prioritise. Not every patch is urgent. Internet facing systems, known exploited vulnerabilities and your Tier 0 systems first.
Automate. Use update rings, where a small group gets the patch first, then a larger one, then everyone, automatically. Windows Autopatch can handle much of this for clients. For servers, use automated deployment with maintenance windows that actually happen. Consider hotpatching where it is available, so some updates don´t need a restart at all.
Remove what you don´t need. Every uninstalled application and every decommissioned server is something you never have to patch again.
And for the systems that can´t be patched, isolate them and monitor them closely.
Patching faster isn´t about working harder. It´s about automating what can be automated, so your limited people can focus on what can´t.