Patch management without the pain

Why patching matters more than ever

When a software vendor fixes a security flaw, it publishes an update along with a description of what was fixed. Attackers read those descriptions too. Within days, and sometimes hours, they build tools that scan the internet for systems still running the old version. Firewalls, VPN appliances and remote access tools are particular favourites because they sit at the edge of your network and are exposed to anyone.

The Canadian Centre for Cyber Security regularly publishes alerts about actively exploited vulnerabilities, and its baseline controls for small and medium organizations treat timely patching as a core requirement. For most businesses, staying current is one of the cheapest and most effective security measures available, provided it is done consistently.

Know what you have

You cannot patch what you do not know about. Start with an inventory of every computer, server, phone, network device and the main applications installed on them. Include the less obvious items: the firewall, Wi-Fi access points, printers, NAS storage, security cameras and any server in a closet that runs one old application nobody wants to touch.

Note which items are no longer supported by their manufacturer. Unsupported systems, such as older Windows versions or end-of-life firewalls, will not receive fixes for new flaws at all. They need a replacement plan with a date attached, and until then they should be isolated from the rest of the network as far as practical.

Set a predictable rhythm

Microsoft releases most security updates on the second Tuesday of each month, and many other vendors follow a monthly cycle. Build a routine around that. Apply updates to a small pilot group of computers first, wait a few days for problems, then deploy to everyone else. Schedule restarts outside business hours where possible, and give staff a clear deadline rather than endless postponements.

Have a separate fast track for emergencies. When a vendor or the Cyber Centre warns that a flaw is being actively exploited, especially in an internet-facing device, patch within days rather than waiting for the next monthly window. Make sure someone is watching for these warnings, whether that is your IT provider or a staff member subscribed to Cyber Centre alerts.

• Pilot group first, then everyone
• Restarts scheduled after hours
• Clear deadlines for staff
• Emergency track for actively exploited flaws

Do not forget third-party software and firmware

Windows Update covers the operating system and Microsoft Office, but browsers, PDF readers, Java, Zoom, accounting software and many other applications update separately. Many attacks target these programs because they are often overlooked. A patch management tool can update common third-party applications automatically and report which machines are behind, which saves a great deal of manual checking.

Firmware for firewalls, switches, access points and servers needs attention too. These updates are less frequent but often more urgent, and they usually require a short maintenance window. Put them on the calendar rather than waiting for a quiet week that never arrives. Read the release notes first, take a configuration backup and confirm you can roll back if something goes wrong.

Measure and report

A patch process is only working if you can show it. Ask your IT team or provider for a monthly report showing the percentage of devices fully patched, which machines are behind and why, and any systems that cannot be patched. Follow up on the same names appearing month after month, because they usually point to a laptop that is rarely turned on or an application with a hidden dependency.

Keep a short record of exceptions, with the reason and a review date. That record is useful for cyber insurance applications, audits and conversations with clients who ask how you manage security. A documented exception shows the risk was considered and accepted on purpose, which is very different from a system nobody noticed was out of date.