Why patching matters so much
Once a vendor closes a security hole, it is publicly known, and attackers often exploit it within a short time. The gap between the update release and installation is the window in which your system is vulnerable. The goal of a patch process is to keep that window small.
Building blocks of a patch process
- Inventory: what exists at all? Clients, servers, network devices, firmware, applications.
- Prioritisation: actively exploited and critical vulnerabilities first, especially on internet-facing systems.
- Test group: roll updates out first to a few non-critical devices.
- Rings or waves: then step by step to all devices, with the ability to pause on problems.
- Maintenance windows: fixed times for servers, agreed with the business.
- Fallback plan: snapshots or backups so a faulty update can be rolled back.
- Control: reports on which devices are not yet current.
Tools
For Windows environments there are several routes: Windows Update for Business through Intune for modern, cloud-managed devices, WSUS or Configuration Manager (SCCM) for classic environments and third-party tools for applications. On Linux, package management does the job, complemented by automation. What matters is not the tool but a defined, controlled process.
What is often forgotten
Firmware of routers, firewalls and access points, third-party applications, hypervisors and devices that are rarely in the office. Even systems that "must not be touched" need a plan: where patching is impossible, the system should at least be isolated and monitored closely.