Every year the time between a vulnerability being published and being exploited gets shorter. For the most critical ones on internet facing systems, it is now a matter of days, sometimes hours. Most organisations still patch in monthly cycles, if that. How do we close the gap?<\/p>\n
Know what you have. You can\u00b4t patch what you don\u00b4t know exists. Use your vulnerability management, for example Defender Vulnerability Management, to get a continuous inventory of devices, software and missing patches, and let it tell you what is actually exposed and exploited.<\/p>\n
Prioritise. Not every patch is urgent. Internet facing systems, known exploited vulnerabilities and your Tier 0 systems first.<\/p>\n
Automate. Use update rings, where a small group gets the patch first, then a larger one, then everyone, automatically. Windows Autopatch can handle much of this for clients. For servers, use automated deployment with maintenance windows that actually happen. Consider hotpatching where it is available, so some updates don\u00b4t need a restart at all.<\/p>\n
Remove what you don\u00b4t need. Every uninstalled application and every decommissioned server is something you never have to patch again.<\/p>\n
And for the systems that can\u00b4t be patched, isolate them and monitor them closely.<\/p>\n
Patching faster isn\u00b4t about working harder. It\u00b4s about automating what can be automated, so your limited people can focus on what can\u00b4t.<\/p>\n","protected":false},"excerpt":{"rendered":"
Every year the time between a vulnerability being published and being exploited gets shorter. For the most critical ones on internet facing systems, it is now a matter of days, sometimes hours. Most organisations still patch in monthly cycles, if that. How do we close the gap? Know what you have. You can\u00b4t patch what […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[37,134,135],"class_list":["post-1385","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-patching","tag-vulnerability-management","tag-windows-autopatch"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1385","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1385"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1385\/revisions"}],"predecessor-version":[{"id":1410,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1385\/revisions\/1410"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1385"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1385"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1385"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}