Patch Management Best Practices

If you’ve made it to this page I suspect you already know a little about patching and its importance. But in an ever-changing world with increasing digital threats, patching is more important than ever. This was recently showcased by the colossal Equifax breach that could’ve easily been prevented. In this article, I’ll be going through some of the best practices that technicians can implement in regard to patching.

Tracking and monitoring IT assets

There are countless challenges and difficulties one faces when it comes to patch management. Even the prerequisites for an efficient patch management framework can have you scratching your head. Having a thorough and up-to-date inventory of your IT assets is an essential first step.

Imagine how complicated this task is for a company like Equifax that has over 10.000 employees. Employees might have several devices connected to the network and some could be using their work laptops for personal use. This can lead to applications, unknown to the IT department existing on the network, never getting patched, leaving your network vulnerable. One vulnerable application means one vulnerable device and the recent iNSYNQ breach showed us that, one vulnerable device is all hackers needs.

That’s why it’s recommended by most experts to have an automated IT asset discovery system in place to ensure that nothing falls in between the gaps, and vScope offers just that! Not only will an automated discovery of your IT assets help you manage your patches, but you can also leverage the information you gather to gain insights about your IT environment.

For further improvements to your data security, consider restricting local administration privileges and application whitelisting. After you have gotten to know your IT environment, you also need to get familiar with your enemies and potential threats.

PUBLISHED September 11, 2019

Staying updated on patches & vulnerabilities

Software vendors usually have some security page that informs its users when vulnerabilities have been found or when patches have been released. For example, when it comes to staying on top of patches for Microsoft products you can turn to Microsoft Security Response Center’s Security Update Guide, that offers a lot of valuable information.

But as there are a lot of different applications from different vendors on any network, it’s not always feasible for one to subscribe to all security pages. But if you have a proper inventory of the applications on your network, you can easily identify the most common applications and stay on top of those. Alternatively, you can simply subscribe to a security advisory page by a security vendor, such as Trend Micro. Their security advisory page includes the latest vulnerabilities, patches, and security-related announcements from multiple software vendors.

For those that are interested in vulnerabilities and data security and want to learn more I can recommend the following pages:

• The National Vulnerability Database (NVD) – Offers many helpful resources in regards to Common Vulnerabilities and Exposures (CVEs).
• The DoD Cyber Exchange – Offers Security Technical Implementation Guides (STIGS) and other useful resources.

Scheduling & Conflicts

As I previously mentioned, patching affects the whole company. This can sometimes lead to conflicts between departments. The time wasted on conflicts should be spent on securing the network instead. This is why IT managers need to make sure that pre-established patch management strategies or policy is in place so that these downtimes are kept to a minimum.

When establishing such a policy one might face some resistance from upper management. In these circumstances it’s best to confront the resistance with facts. When faced with the potential cost of a breach most people usually change their minds. Scheduling and properly planning the patch roll out can also decrease tension. But make sure that you also account for emergencies that may appear, all patches can’t wait and hackers usually don’t care about schedules!