In one sentence: Patch management is the routine of finding, testing and installing the fixes that software makers release, so attackers cannot use known flaws to get in.

What it is

Software has flaws. When a maker finds one, they release a fix. That fix is a patch or security update. Patch management is the process of getting every fix onto every device in good time.

NIST defines enterprise patch management as identifying, prioritising, acquiring, installing and verifying patches, updates and upgrades across an organisation. It frames patching as preventive maintenance, a cost of doing business, and says it helps prevent compromises, data breaches and operational disruption.

The NCSC adds that all systems contain vulnerabilities, so updates should be a normal, repeating control and not an emergency job.

How it works

1. Know what you have. List every device, operating system, application and piece of firmware, including routers and firewalls.
2. Hear about fixes. Follow vendor notices, and check the CISA Known Exploited Vulnerabilities list for flaws already being used in attacks.
3. Rank them. Use the severity score (CVSS) and whether the flaw is exploited or internet-facing.
4. Test and roll out. Try the update on a small group, then deploy.
5. Verify. Confirm the update really installed. The NCSC describes vulnerability management as the process that validates how well your software update process is working.
6. Handle what cannot be patched. Apply the vendor’s workaround, or isolate or retire the system.

Who it affects and how badly

Everyone who runs software, which is everyone.

• Sole trader to 10 staff: an unpatched laptop or router is the usual way in. Worst case: ransomware locks the only copy of your work.
• 10 to 50 staff: accountancy, legal and trades firms often have an old server nobody owns. Worst case: days of downtime and a client notification.
• 50 to 250 staff: manufacturing and construction firms run older equipment that is hard to update.
• Regulated businesses and the public sector: healthcare, councils and fintech face service disruption and regulator attention.

Real examples

• WannaCry and the NHS, May 2017. The National Audit Office found that NHS Digital had issued critical alerts in March and April 2017 warning organisations to patch. At least 81 of 236 trusts in England were affected, plus 603 primary care and other NHS organisations including 595 GP practices. NHS England identified 6,912 cancelled appointments and estimated over 19,000 in total. The NAO said infected organisations had unpatched or unsupported Windows systems, and that managing internet-facing firewalls would have protected them whether or not they had patched. No NHS organisation paid the ransom.

How to detect it

• Compare your device list with each device’s update status. Your update or device management tool will report missing updates.
• Compare the CISA Known Exploited Vulnerabilities list with your inventory.
• Scan your internet-facing systems for known issues. The free Wolfcore scan covers web-facing systems.
• Check dates: Cyber Essentials expects fixes for critical or high-risk issues within 14 days of release, so any missing fix older than that is a gap.

How to fix or prevent it

1. Keep an accurate inventory of devices and software, because you cannot patch what you do not know about.
2. Run only licensed, supported software, and remove or isolate anything unsupported (Cyber Essentials).
3. Turn on automatic updates wherever possible (Cyber Essentials).
4. Install updates within 14 days of release where they fix issues the vendor calls critical or high risk, or that score 7 or above on CVSS v3 (Cyber Essentials). Cyber Essentials strongly recommends, but does not require, all updates within 14 days.
5. Patch internet-facing systems and anything on the Known Exploited Vulnerabilities list first.
6. Verify by scanning after each cycle, and fix what failed.
7. Write down who owns patching for each system, including any managed service provider.

Related terms

• cve
• cvss
• cisa kev
• cyber essentials
• vulnerability scanning
• ransomware

Frequently asked questions

How quickly should I install security updates?
Cyber Essentials requires updates for critical or high-risk issues within 14 days of release, and strongly recommends all released updates within 14 days.

What if a patch would break my system?
Use the vendor’s approved workaround, or isolate the system. The NCSC accepts that some organisations hold updates back but treats regular validation as essential.

Is patching enough on its own?
No. The NAO found that managing internet-facing firewalls would have protected NHS organisations against WannaCry whether or not they had patched.

Sources

• NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: https://csrc.nist.gov/pubs/sp/800/40/r4/final
• NCSC vulnerability management guidance: https://www.ncsc.gov.uk/collection/vulnerability-management
• NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3, security update management: https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf
• National Audit Office: WannaCry cyber attack and the NHS: https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.